Stealth rootkit infects thousands of websites
Created: 20 Apr 2009 | 2 comments
Thousands of websites have been rigged to deliver a powerful piece of malicious software that many security products may be unprepared to handle.
An earlier version of Mebroot, which is what Symantec named it, first appeared around December 2007 and used a well-known technique to stay hidden. It infects a computer's Master Boot Record (MBR). It's the first code a computer looks for when booting the operating system after the BIOS runs.
Read more on:
blog entry Filed Under:
About Security Community Blog
The Security Community Blog is the perfect place to share short, timely insights including product tips, news and other information relevant to the Security community. Any authenticated Connect member can contribute to this blog. Filter by:
Blog Tags
Endpoint Protection (AntiVirus) 11.x Data Loss Prevention (Vontu) Tip/How to Endpoint Protection Small Business Best Practice Messaging Gateway 10.x Installing Basics Reporting Configuring Symantec Information Manager General Symantec Mobile Security 9.x and Earlier Features Security Risks Network Access Control Critical System Protection Upgrade Symantec Protection Suites (SPS) Control Compliance Suite Endpoint Encryption 12.x
Comments
Thanks for the information
Hi, thanks for the valuable information.
Stealth rootkit
From Stealth rootkit infects thousands of websites article :
Erasmus said it appears that thousands of websites have been hacked to deliver Mebroot to vulnerable computers that don't have the proper patches for their web browsers.
The infection mechanism is known as a drive-by download. It occurs when a person visits a legitimate website that's been hacked. Once on the site, an invisible iframe is loaded with an exploit framework that begins testing to see if the browser has a vulnerability. If so, Mebroot is delivered, and a user notices nothing.
Hope Symantec will deliver virus defs update quickly. It seems really dangerous....
Would you like to reply?
Login or Register to post your comment.