Capable of generating thousands of "sub-trojans" as bait, the symptoms of user infection "randomly change"

by man8737 on 2009-01-06 12:02:18

Just as the New Year of 2009 arrived, the situation of network security became extraordinarily severe. A vicious Trojan named "Mare Downloader" almost escaped from the elimination by all mainstream security software with its super abilities of "penetrating restoration", "super fast update variation" and "anti killing". It was widely attacking netizens' computers. For this reason, the 360 Security Center urgently launched the latest "360 Stubborn Trojan Killer Collection" which could completely get rid of the malicious "mare". It is recommended that netizens download and use it as soon as possible.

According to Dr. Shi Xiaohong, a security expert of 360, in the past week, the "Mare Downloader" has been consistently ranked in the top three of the Trojan killer list of the 360 Security Center with more than 1 million daily detections. As of 8 pm on January 1st, the Trojan and its mutated malicious Trojans have occupied five out of the top six positions on the detection list, becoming the most dangerous Trojan of the New Year 2009. This Trojan bundled a large number of other Trojans and viruses, disrupting the operation of security software. Once executed, it would generate thousands of "child Trojans", and even on the same computer, various different symptoms would randomly appear after being infected, indicating that its update frequency and mutation ability have reached an unprecedented level. According to the test of the 360 Security Center, all current mainstream antivirus software cannot completely eliminate it, and most of them would be "anti-killed" and damaged by this Trojan.

According to Dr. Shi Xiaohong's analysis, the "Mare Downloader" adopted a "machine dog"-style penetration restoration technology, infecting system files to achieve self-startup, and could penetrate system restoration software such as IcePoint and Shadow. Even if the users in Internet cafes restart their computers for restoration, they still cannot escape from its harassment. Compared to the machine dog, the "Mare Downloader" has stronger self-update and mutation capabilities. Each time the same Trojan sample runs, the changes in the system files it infects are different, and the infection methods and characteristics also change accordingly. At the same time, it can automatically generate up to more than 4000 "child Trojans" to confuse people, hiding the main process file among them, thereby evading the pursuit of security software and downloading a large number of account-stealing Trojans and risk programs, posing a great threat to the security of users' online games, QQ accounts and data!

Dr. Shi Xiaohong stated that in the past week, the 360 Security Center mobilized dedicated personnel to confront the author of the "Mare Downloader". Given that the characteristics of this Trojan are constantly updating, the "360 Stubborn Trojan Killer Collection" actively updates the feature library in real time, chasing and eliminating it relentlessly. The detection volume increases day by day, with a peak of 1,324,133 detections in a single day. This obviously annoyed the author of the Trojan, who made a fierce counterattack in the recent variants, using the "human sea tactics" to massively construct "child Trojans", blocking the channel for security software to delete malicious programs when the system shuts down, and then reviving through the infected system files after restarting.

Picture description: The "Mare Downloader" automatically generates a huge amount of "child Trojans" to evade the "shutdown rewrite protection" of security software.

Currently, the 360 Stubborn Trojan Killer Collection is the only security software that can completely eliminate the "Mare Downloader". The 360 security experts remind users to handle it as soon as possible according to the following plan:

1. Download the latest version of the 360 Stubborn Trojan Killer Collection and perform a detection and kill under the connected state, then restart.

2. Enable the 360 self-protection and scan for Trojans and malicious plug-ins, clearing any possible residual items.

3. Regularly use 360 to repair system vulnerabilities, thoroughly cutting off the transmission path of Trojans.

In addition, the 360 security experts strongly recommend that users use the 360 Safe Browser online, so that your computer can automatically shield malicious websites and intelligently intercept malicious codes on web pages, reducing the probability of getting infected to the lowest level.