Zeus banking virus is back warns security firm

bbc ^ | 21 April 2010

[JoeProBono]

Zeus, a virus that steals online banking details from infected computer users, is more powerful than ever, warns a web security company. Trusteer says it has spotted the Trojan virus in one of every 3,000 of the 5.5m computers it monitors in the US and UK.

Zeus 1.6 can infect people using Firefox and Internet Explorer web browsers, the company claims.

The malware steals login information by recording keystrokes when the infected user is on a list of target websites.

These websites are usually banks and other financial institutions.

The user's data is then sent to a remote server to be used and sold on by cyber-criminals. "We expect this new version of Zeus to significantly increase fraud losses, since nearly 30% of internet users bank online with Firefox and the infection is growing faster than we have ever seen before," said Amit Klein, chief technology officer at Trusteer.

[JoeProBono]

[JoeProBono]

ZeuS-Botnet: Command&Control in the Cloud

The ZeuS Tracker project stumbled upon a ZBot variant which used Amazons Cloud hosting service EC2 as Command&Control (C&C) server. ZBot is a widespread trojan which can spy on online banking credentials and steals other login information. It gets sold as a construction kit where the buyer can choose which servers to contact, what to spy upon and so on.

The usage of Amazons Cloud is just a coincidence though. It seems that some Cloud user had insecure services running which got hacked by the cybercriminals. Meanwhile the C&C isn’t online anymore. Anyhow this shows that you have to take security measures in the Cloud as well.

Avira detects the ZBot variant generically as TR/Crypt.ZPACK.Gen, without an update. Users of Avira products thus are safe from the threat.

[Skillman]

In my experience AVIRA is superior to most other anti-virus products. And it's free.

[Skillman]

In my experience AVIRA is superior to most other anti-virus products. And it's free.