Rootkit Wars

Filed in archive Malware on March 2, 2008

The latest Trojan to hit the net is capable of removing rootkits from already compromised PCs, but then installs it's own nearly undetectable backdoor. Named the Pandex Trojan, it stops existing rootkits by removing their hooks into system calls, then installs its own rootkit called Pushu-AC. It isn't the first time virus makers have competed for control. In 2005 several groups of hackers released a flood of worms in an effort to take control of the then infamous Plug and Play vulnerability that affected Windows PC's. A year before that it was the Netsky worm competing against the MyDoom worm, and today the efforts of hacker gangs seems to be focused on competing against Storm. Tomorrow...who knows? The turf wars seem destined to continue.