Kaspersky Lab is one of the first major antivirus vendors to incorporate both detection and successful treatment for the new Sinowal modification in its personal antivirus solutions.
Kaspersky Lab has implemented detection and treatment for a new variant of a unique MBR rootkit. The new variant of Sinowal, a malicious program that is capable of hiding its presence in the system by infecting the Master Boot Record (MBR) on the hard drive, was detected by the company’s experts at the end of March 2009. Kaspersky Lab is one of the first major antivirus vendors to incorporate both detection and successful treatment for the new Sinowal modification in its personal antivirus solutions.
Throughout 2008, Kaspersky Lab's analysts provided detailed reports about other variants of this rootkit: in the first quarterly report on malware evolution and in the article “Bootkit: the challenge of 2008”. However, the new variant has come as a surprise for researchers. Unlike earlier versions, the new modification, Backdoor.Win32.Sinowal, penetrates much deeper into the system to avoid being detected. The stealth method used in this variant hooks device objects at the operating system's lowest level.
This is the first time cybercriminals have used such sophisticated technologies. This explains why no antivirus products could treat computers infected with the new Sinowal modification or even detect it when it first appeared. Once the bootkit penetrates the system, it conceals the payload's activities, which are designed to steal user data and various account details.
Intrusion via Adobe Acrobat Reader
According to Kaspersky Lab's experts, over the last month the bootkit has been actively spreading from a number of malicious sites that exploit Neosploit vulnerabilities. In particular, it can penetrate a system via vulnerability in Adobe Acrobat Reader that allows a malicious PDF file to be downloaded without the user’s knowledge. Implementing detection and treatment for the bootkit, which is still spreading throughout the Internet, is the most difficult task that antivirus specialists have faced for a number of years.
To check whether the bootkit has infected a computer, users must update their antivirus databases and perform a complete system scan. If the bootkit is detected, the computer will need to be rebooted during the treatment process. Kaspersky Lab specialists also recommend that users install all the necessary patches to close vulnerabilities in Acrobat Reader and any browsers that they use by going to www.adobe.com/support/security/bulletins/apsb09-04.html.
About Kaspersky Lab
Kaspersky Lab is the largest antivirus company in Europe. It delivers some of the world’s most immediate protection against IT security threats, including viruses, spyware, crimeware, hackers, phishing, and spam. The Company is ranked among the world’s top four vendors of security solutions for endpoint users. Kaspersky Lab products provide superior detection rates and one of the industry’s fastest outbreak response times for home users, SMBs, large enterprises and the mobile computing environment. Kaspersky® technology is also used worldwide inside the products and services of the industry’s leading IT security solution providers. Learn more at www.kaspersky.com. For the latest on antivirus, anti-spyware, anti-spam and other IT security issues and trends, visit www.viruslist.com.
