Spammed Trojan turns off security on attacked PCs

Experts at SophosLabs, Sophos`s global network of virus, spyware and spam analysis centres, has warned of a Trojan horse being spammed out to e-mail addresses around the world in an attempt to disable anti-virus and other security software.

The e-mail messages, which have no subject line, typically carry the message text "new price" and an attached file with one of several names, including: "09_price.zip", "price_new.zip", and "price2.zip".

"The attached ZIP files contain the malicious BagleDl-U Trojan horse. If launched, the Trojan horse makes changes to the registry, and attempts to turn off anti-virus and security-related software on the infected computer, opening the door for attack by remote hackers," says Brett Myroff, CEO of local Sophos distributor, NetXactics.

Using spam technology, this Trojan horse is being aggressively seeded by its creator to distribute malicious code to as many vulnerable computers as possible, and in the shortest amount of time.

"Anyone running this program runs the risk of allowing hackers access to their computer."

All computer users should ensure they are running an anti-virus product which is configured to automatically update itself, security patches and firewall software.

Myroff adds that keeping anti-virus software up-to-date is critical. "Frequent updates, as well as implementing sensible computing policies and a strong e-mail policy at the gateway, can curb the risk of these attacks and keep the threat to a minimum," he says.

Sophos recommends that companies protect their e-mail gateways with a consolidated solution to defend against viruses and spam, as well as apply an e-mail policy that filters unsolicited executable code at the gateway. Desktops and servers should also be secured with automated update protection.

Further information on the BagleDl-U Trojan horse can be found at: http://www.sophos.com/virusinfo/analyses/trojbagledlu.html