Introduction

The "National Bank bankrupt" trojan incident

Frequently Asked Questions

1. Are you saying that anti-virus is not effective?
   
   No, AusCERT still recommends that people use antivirus software.
   
   Up to date antivirus software provides protection against known malicious software, however it needs to be used in conjunction with other protection mechanisms [9].
   



2. Is this type of trojan attack common?
   
   Yes, since 2004 AusCERT has seen an increasing number of these types of attacks which are aimed primarily at stealing personal and financial data. This is not an isolated incident and the information below is generally applicable to these types of trojan and malware attacks.
   



3. How can I protect myself from infection from this (and other) trojan attacks?
   
   There is no single "silver bullet" that can protect a system from malware infection. However, compromise by malicious code can be often prevented through a combination of counter-measures and good security practices. For full details on these counter measures, please see the AusCERT's document "Protecting your computer from malicious code" [8]. It is also important to note that this particular trojan required user interaction (clicking on a web link) to infect a computer. It does not self-propagate like a worm.
   



4. I use SSL when exchanging sensitive information, won't that protect me from these trojans?
   
   SSL provides encryption protection between your computer and the remote site with which you are connected. If your computer is already compromised with an input/output monitoring trojan, SSL cannot prevent the trojan from capturing web form data, keystrokes, and passwords.
   
   
5. How do I know if I'm infected?
   
   Due to the stealthing (rootkit) and anti-virus disabling capabilities of this malware, a clean scan with an anti-virus product may not guarantee that you are free from infection. However, AusCERT has received reports that rootkit detection tools such as RootkitRevealer [9] may detect malicious files.
   
   AusCERT has also attempted to notify affected organisations where information relates to their customers, so notification from an institution that your account has been compromised may also indicate infection. The institution involved should be able to inform you whether the compromise relates to the Haxdoor trojan.
   
   
6. I think I'm compromised, what should I do?
   
   Unfortunately, once infected it is difficult to detect that you are infected and removing this malicious software is not trivial. AusCERT is not able to provide a tool or instructions to remove it. We recommend that you contact an IT professional or your anti-virus vendor for detailed removal instructions.
   
   AusCERT suggests that ultimately re-installation of the operating system from the original installation media is the only way to be confident that all traces of the malware has been removed. Additional information is available from other AusCERT publications [8].



7. Does this trojan target e-tax client software?
   
   AusCERT has not seen any evidence that this trojan targets taxation information or the e-tax client software specifically. The e-tax software does use certain web browser components and because of this, e-tax information may be vulnerable.

References