Security threats Toolkit

Do-gooder Trojan has nasty bite

Dan Ilet ZDNet.co.uk

Published: 07 Oct 2004 14:05 BST

Symantec is warning Internet users of a Trojan horse that removes spyware but alters the security settings in computers.

While Downloader.Lunii eliminates a variety of adware programs -- often known as spyware -- the Trojan also tries to maliciously change the setup of Windows PCs and then downloads files from unknown Web sites.

"It's common that a Trojan will try to change as much security as possible," said Nigel Beighton, Symantec's director of enterprise strategy. "They often try to change Microsoft, Symantec and McAfee software. But so far we've hardly seen it."

Symantec rated classified Lunii as a low risk Trojan.

Trojan horses are often referred to as spyware because of their ability to stealthily run in the background of a computer without being detected. Anti-spam organisation Spamhaus recently warned that spyware has taken control over tens of thousands of networked computers. Spammers and hackers then use these 'zombies' to launch denial-of-service and spam attacks, the company said.

Last week the US government passed a bill to criminalise the act of altering PC configurations, taking control and downloading software onto a PC without the owner's consent.

Symantec has recommended users to switch off any unnecessary services - Windows functions such as printer and file sharing -- and to keep security patches up to date.