Crooks Selling Web Proxy With Backdoors

You know that great deal you got on that paid proxy service? Symantec says you are getting some free backdoor action without even knowing it.

The dropper installs the payload as a service on the computer, copying the payload executable to the system and installing the rootkit. The rootkit attempts to protect the malicious payload and all other files associated with the threat to increase the threat's persistence. The rootkit implements a novel method to avoid device-stack file scanning. The payload itself is a DLL, which is executed when the computer starts and acts as a low-level proxy service that enters the compromised computer into a large botnet used for funneling traffic.

Comments