Keylogging Trojan Dodges Anti-virus Detection

The Trojan is believed to have been spreading since April 17. Like the original, which was discovered earlier in 2007, the new version of Gozi steals data from encrypted SSL (Secure Sockets Layer) streams.

The latest variant was uncovered May 7 by Don Jackson, a security researcher at SecureWorks in Atlanta. Jackson also found one data cache from the Gozi variant that contained 2,000 new victims and several thousand account records, including bank and credit card account numbers, Social Security numbers, and other personal information.

Click here to read about an RSA security service targeting Trojans.

SecureWorks researchers suspect that other servers with stolen Gozi data exist, Jackson said.

"If you were infected before mid-May, then it will act like a rootkit and hide itself on your PC and will make itself undetectable by most anti-virus software," he said.

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

To remedy this, he suggested that home users reboot their computers in Safe Mode and run an anti-virus scan—if their anti-virus vendors have a signature for the Gozi variant. Currently, about 15 of the major anti-virus vendors have signatures to detect the new Gozi variant, he added.

The newest installment of Gozi has a compression component that it uses to uncompress the blocks of code that it needs to run. When it no longer needs those blocks of code, it recompresses them, making it almost impossible to see everything the variant is doing in memory and that much harder for anti-virus scans to detect, Jackson said.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.