Sidebar: Trojan Horse Spreads via Mass Spam Mailing

IDG News Service - Antivirus and e-mail security companies last week sent out warnings about a new Trojan horse program that they claim is being mass distributed on the Internet by means of spam.
The program, called Backdoor-CGT, is a new form of a Trojan horse that's installed when users of Microsoft's Outlook e-mail program follow a Web link embedded in an e-mail message. The Trojan horse was believed to have infected thousands of systems even though antivirus software and up-to-date versions of Outlook are immune to attack, said Maksym Schipka, senior antivirus researcher at MessageLabs Ltd. in Gloucester, England.
MessageLabs received more than 3,600 e-mail messages with links to the Trojan horse during a two-hour period, the result of a spam distribution that was more than 10 times the normal amount for such a program, he said. Trojan horse programs give remote attackers access to or control over machines on which they run, and they often run unnoticed by users or pose as legitimate applications.
The Backdoor-CGT program uses a "multistage" attack to place malicious code on victims' computers. After clicking on an e-mail link embedded in the spam message, victims go to a series of Web sites, each of which carries out one stage in the attack.
The attack takes advantage of a now-patched flaw in Outlook called the "IFRAME" exploit to hide the Web site redirections from the user and silently download and install the Backdoor-CGT program, Schipka said.
McAfee also released an advisory about the new Trojan horse, which is also known as "SS," but rated it a "low" threat to users. McAfee has released software update files to detect the Trojan horse, according to the advisory.

Reprinted with permission from

IDG.net
Story copyright 2009 International Data Group. All rights reserved.