Sneaky New Windows Virus Steals Financial Data

[csv8]

Sneaky New Windows Virus Steals Financial DataPosted Jan 14th 2008 11:37AM by Terrence O'Brien
Filed under: Computers



Warning -- a new virus is making its way around the Internet. The virus, dubbed Mebroot, lodges it self in the Master Boot Record (MBR), a part of the hard drive responsible for loading the operating system, where it is out of the reach of most anti-virus software.

The virus itself doesn't actually harm a PC, but it does load other software on the computer, including key-loggers that are triggered when a user visits any of 900 financial institutions' Web sites. The virus then captures the user's log-on information and sends it back to the virus writers, who specialize in stealing confidential information.

The virus is classified as a root kit, meaning it hijacks the administrator functions on the computer and evades detection by normal scanning methods, in this case by hiding in the MBR. Few anti-virus programs can detect the virus, and none can remove it. Because of its location in the MBR, the virus cannot be removed once the computer has been booted.

That said, an independent company GMER has developed software that can scan for and remove the rootkit.