Keylogging Trojan Dodges Anti-virus Detection

A new variant of the Russian Trojan Gozi is circulating on the Web, this time armed with a keylogging function and the ability to scramble itself so it is difficult to detect by anti-virus software.

The Trojan is believed to have been spreading since April 17. Like the original, which was discovered earlier in 2007, the new version of Gozi steals data from encrypted SSL (Secure Sockets Layer) streams.

The latest variant was uncovered May 7 by Don Jackson, a security researcher at SecureWorks in Atlanta. Jackson also found one data cache from the Gozi variant that contained 2,000 new victims and several thousand account records, including bank and credit card account numbers, Social Security numbers, and other personal information.

Click here to read about an RSA security service targeting Trojans.

SecureWorks researchers suspect that other servers with stolen Gozi data exist, Jackson said.

“If you were infected before mid-May, then it will act like a rootkit and hide itself on your PC and will make itself undetectable by most anti-virus software,” he said.

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internet’s Security IT Hub.

To remedy this, he suggested that home users reboot their computers in Safe Mode and run an anti-virus scan—if their anti-virus vendors have a signature for the Gozi variant. Currently, about 15 of the major anti-virus vendors have signatures to detect the new Gozi variant, he added.

The newest installment of Gozi has a compression component that it uses to uncompress the blocks of code that it needs to run. When it no longer needs those blocks of code, it recompresses them, making it almost impossible to see everything the variant is doing in memory and that much harder for anti-virus scans to detect, Jackson said.

Check out eWEEK.com’s Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK’s Security Watch blog.