Worm fighting worm - sounds interesting

Feb 29, 2008 16:26 GMT  ·  By

Usually, when hacking a computer, cyber criminals have to choose one of the seven levels this can be attempted at. All of the reported stories of famous over-protected sites, that have had their security found a match for, have suffered because of this. Just in the same way, Trojans work with your PC on a level under that being constantly monitored by the anti-virus software. The only catch is that the malware cannot attempt to do this unless it is somehow copied on the computer. That's when security software comes in handy, usually spotting the malicious content.

Rootkits are something different, once they are installed on a computer (and they do it by themselves, no need to bother you about it), they are nigh untraceable by regular anti-viruses. Simply worded, they just hide, making them exponentially more dangerous than the usual viruses. If I may venture a comparison, it's like Pinky and the Brain, with rootkits playing the part of Brain and you can guess who's Pinky. Once a rootkit is on the computer, it will make keystroke-logging an undetectable breeze, phishing without having to redirect, just to name one aspect.

The Register reports that Trend Micro has detected the Pandex Trojan, which stops previously installed rootkits from working, by removing their hooks into system calls. Afterwards, it installs its own rootkit component, Pushu-AC. The Bozori worm is also programmed to remove infections with earlier versions of the Zotob worm and additional malware, so it can have the host only for itself. Both of the above have been created to replace code of stealthy malware infections belonging to rival creators.

This comes hot in the heels of the recent war between the creators of the Storm worm and rival gangs. Just a simple opinion, but the sheer size of Storm should easily overpower its competitors unless they come together in an alliance.