Financial Malicious Program Shylock Infections Increasing

Boston-situated Trusteer, an in-browser Web-safety provider is cautioning of the polymorphic malicious software "Shylock" re-emerging apparently 'with revenge' to again steal financial information from the PCs of consumers. Previously, Trusteer noticed the malware back in September 2011.

Researchers state that a distinguishing feature about this malware is that it can nearly wholly evade anti-viruses' detection once loaded onto a system. The evasion involves a peculiar process of three stages, they add.

First, Shylock inserts itself into active software programs for concealing its operation. While it's really the software which's visibly active, Shylock doesn't run like another process thereby posing problem in its detection.

Secondly, the malware looks out for any anti-virus program doing a scan. Once it finds indications of that, it erases registry entries and files it initially created clean off the hard disk, while staying live merely in memory.

Lastly, Shylock remains resilient to system-reboot or shutdown that would have removed the malware while in memory, as it snatches control of the Windows' process of shutdown. Essentially, it automatically reloads onto the target computer following the closure of all other software, with anti-virus included, prior to the real Windows shutdown.

Indeed, security investigators point out that once Shylock erases its registries and files and afterwards if the computer's power source is snapped, there'll be a total cleansing of the memory in addition to the Shylock contamination. Naturally, this malware elimination technique isn't recommendable.

Chief Technology Officer Amit Klein of Trusteer stated that the Shylock terminology gave hints of its origin being Ukraine or Russia. Yet, the person behind it as also the exact place of its emergence continued to be a mystery owing to their extremely hard way for tracking. ITWorld published this on February 16, 2012.

Furthermore according to Klein, Shylock creators were executing one dangerous operation targeting specific entities like several big banks, a few card issuers as also many web-mail services. The malware had the capability for suitably changing financial fraud, including inserting code through an enhanced technique inside more Web-browser processes towards compromising the infected PC.

Significantly meanwhile, other security firms haven't as yet noticed considerable rise in Shylock detections.

Related article: Finjan Brings Out Report on Web Malware

» SPAMfighter News - 2/22/2012