jonathanmoeller (![[info]](http://p-stat.livejournal.com/img/userinfo.gif){kind=small} jonathanmoeller) wrote,@ 2007-11-15 11:50:00 |
|
Zlob: ode to a worthy adversary
In my line of work, I see a lot of viruses, Trojans, worms, and related malware. Blaster, Nimda, Sasser, Welchia, the Storm worm, I’ve seen it all. Some of them even get to be like old friends, in an adversarial sort of way.
Zlob is one of them.
What is Zlob? It’s a Trojan that masquerades as video or multimedia codecs, often on peer-to-peer filesharing networks or on free porn sites. The unsuspecting user finds a “media file” that he cannot view or listen to, since he lacks the proper codecs. But wait! Here’s a convenient and helpful free codec package he can install!
And then the computer starts running slower. And all these annoying pop-ups start appearing, warning that the computer lacks antivirus software. But all these convenient and helpful links appear, offering downloads to free security software. Of course, the “free security programs” are in fact more malware, and they turn around and draw down still more malware once they’re up and running.
A lot of people fall for this. Zlob doesn’t have the sort of epic scale like Blaster and Sasser did, or that the Storm worm currently does. But I do see Zlob a lot, over and over again. Kill one infection and a dozen more take its place. I’ve cleaned off Zlob using specialized software tools, manual removal of the infected files and Registry keys, and in rare cases, wiping the hard drive and reinstalling everything from scratch (usually after the system in question becomes too malware-laden to function at all).
It doesn’t matter. Zlob seems to be immortal, invincible, and it will be back. A few days later I’ll see yet another computer, its owner complaining about poor performance or security warnings or whatever…and there will be a new infection of Zlob, all bright-eyed and bushy-tailed.
Well, so goes the battle. And I don’t mind, because it’s fun work, and it pays the bills.
But beware those free media codecs, because Zlob would just love to meet you, personally.
-JM
In my line of work, I see a lot of viruses, Trojans, worms, and related malware. Blaster, Nimda, Sasser, Welchia, the Storm worm, I’ve seen it all. Some of them even get to be like old friends, in an adversarial sort of way.
Zlob is one of them.
What is Zlob? It’s a Trojan that masquerades as video or multimedia codecs, often on peer-to-peer filesharing networks or on free porn sites. The unsuspecting user finds a “media file” that he cannot view or listen to, since he lacks the proper codecs. But wait! Here’s a convenient and helpful free codec package he can install!
And then the computer starts running slower. And all these annoying pop-ups start appearing, warning that the computer lacks antivirus software. But all these convenient and helpful links appear, offering downloads to free security software. Of course, the “free security programs” are in fact more malware, and they turn around and draw down still more malware once they’re up and running.
A lot of people fall for this. Zlob doesn’t have the sort of epic scale like Blaster and Sasser did, or that the Storm worm currently does. But I do see Zlob a lot, over and over again. Kill one infection and a dozen more take its place. I’ve cleaned off Zlob using specialized software tools, manual removal of the infected files and Registry keys, and in rare cases, wiping the hard drive and reinstalling everything from scratch (usually after the system in question becomes too malware-laden to function at all).
It doesn’t matter. Zlob seems to be immortal, invincible, and it will be back. A few days later I’ll see yet another computer, its owner complaining about poor performance or security warnings or whatever…and there will be a new infection of Zlob, all bright-eyed and bushy-tailed.
Well, so goes the battle. And I don’t mind, because it’s fun work, and it pays the bills.
But beware those free media codecs, because Zlob would just love to meet you, personally.
-JM
