Security experts have warned of newly intercepted malware which loads a rootkit onto compromised PCs
Zcodec malware is designed to download other malicious programs onto the system

Rootkit malware has double sting in its tail

Zcodec modifies DNS settings and loads additional malware

Written by Robert Jaques

Security experts have warned of newly intercepted malware which loads a rootkit onto compromised PCs. The rootkit blocks search engines by changing local DNS settings, and installs additional malicious code.

According to Panda Software, the Zcodec malware is included in a program that purports to install codecs needed to play some multimedia formats.

When unwitting users are about to install this application, a user licence window is displayed. However, no codec is installed.

The program does not wait for users to accept or reject the licence agreement, as Zcodec is installed on the computer when they click on the downloaded file.

Once downloaded, a rootkit is installed. Rootkits are a program designed to hide processes, files or registry entries.

Zcodec installs two executable files. The first modifies the DNS settings so that when a user clicks on results from search engines a different page is displayed.

This tactic is exploited by the program's creators to profit from pay-per-click systems, or even to redirect users to pages designed to steal confidential data.

Additional malware executables vary. In some cases it installs the Ruins.MB Trojan designed to download other malicious programs onto the system.

On other occasions the file continually launches a casino application, asking for the user's permission for installation.

However, even if the user rejects installation of the program, an icon is created on the Windows desktop which will prompt installation when clicked.

"The combination of different techniques is becoming a frequent trait of computer attacks. In this case we see social engineering, rootkits, Trojans and even the manipulation of computer settings," said Patrick Hinojosa, chief technology officer at Panda Software USA.

"The aim of the creators is to infect computers without arousing suspicion. Given that there are many such malicious programs on the internet, it is vital to make sure that your system is protected.

"To protect against this type of malicious program, it is also essential to check the source of any files downloaded onto the system as well as to pay close attention to the licence agreements when installing programs."

Tags:

Further reading

Related articles

Storm malware still blowing strong

One year on and no sign of fading away   More...

Malware writers cash in on Olympics

Rootkit-laden video is latest to exploit Tibet protests   More...

Storm botnet blows itself out

But overall malware volumes still rising fast   More...

Halloween 'skeleton' spam hides Storm Trojan

Don't let your PC be turned into a zombie   More...

Do you agree?

Advertisement

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Watch

04 Jul 2008

5.51 MBPodcast Special: Views from the Valley More...

03 Jul 2008

3.46 MBGreen grid computing, Trojans stop play and location-based services More...

02 Jul 2008

3.2 MBOnline TV, SME security and flexible laptops More...

Poll

EUROPEAN E-COMMERCE

EUROPEAN E-COMMERCE

Are you happy making an online purchase from another European country?

Previous poll results

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Spotlight

Online pornography

US rebate cheques spent on porn

Economic stimulus package works wonders   More...

Louis Vuitton

UK online fake goods market worth £800m

Legal experts warn of dramatic rise in 'e-fencing'   More...

Advertisement

Fibre-optics

New fibre-optic connections overtake cable

Broadband first-timers choosing fibre where possible   More...

Stars and Stripes

Cyber-crooks celebrate Independence Day

Security firms warn users to take extra care   More...

Advertisement