White Hat Hacker Tweaks Dridex Malware to Distribute Antivirus Software

The Dridex banking malware has been a huge headache for a large part of the financial and technology industries, but it seems there’s a white knight out there looking to turn the tables on this pesky infection. After a mysterious hijacking of the virus distribution servers, they’ve now started dealing out legitimate installers for Avira Free Antivirus, thus helping to remove the infection from systems and hopefully clearing up a few other issues along the way. The bonus being that anyone stupid enough to fall for the infection in the first place could technically come out cleaner on the other side.

The malware is most often spread through spam messages and malicious Word documents. Being one of the three most widely used trojans in the world, the malware targets online banking users and steals information before feeding it back to a server where it can be used to take money, as well as other information from your accounts. Agencies in the UK and US managed to disrupt the botnet last year, even going as far as indicting a man in Moldova who they believe was responsible for the attacks, but it did little, if anything, in the long run to prevent the botnet from distributing the software.

Researchers at Avira recently noticed that the Dridex distribution servers begin pushing an up-to-date Avira web installer instead of the trojan, which is obviously a great step in combatting the problem, although how long this will last remains to be seen.

“We still don’t know exactly who is doing this with our installer and why, but we have some theories,” said Moritz Kroll, a malware expert at Avira, via email. “This is certainly not something we are doing ourselves.”

The only theory that makes sense so far is that a white hat hacker has hijacked their servers and tried to turn the tables.

“I really think it is a hacker who has discovered how to do a good thing but perhaps with not strictly legal methods,” Kroll said. “If you think about it, there was a huge media announcement when Dridex was ‘taken down’ by the government authorities and a much smaller level of reporting on its return to the marketplace. That has got to be frustrating to some and might cause them to think: ‘The government tried to take it down, they could not, I can do something myself’.”

Either way, anything that slows this nasty bit of software is a good thing!

Microsoft Is Leading PC Anti-Virus Vendor According To Report

New research figures by software and IT solutions company OPSWAT suggest that Microsoft dominates the desktop and laptop anti-virus markets with its free Microsoft Security Essentials offering. Microsoft has an impressive 25.4% of the market with all its products combined, though this is mainly comprised of MSE and Windows Defender. Microsoft is followed closely behind by Avast who manage to rack up an impressive 23.6% mainly through their free anti-virus offering. AVG, Symantec, ESET, Avira and Kaspersky also made the list with market shares between 6.5 and 8.3%.

In terms of the single most popular programs well Avast lead the way with their free antivirus followed closely behind by MSE. Windows Defender, Avira and AVG come in third, fourth and fifth respectively meaning the entire top 5 is comprised of free anti-virus solutions – which is hardly surprising. The leading paid anti-virus solutions are produced by ESET, Kaspersky, Norton, Avast and AVG respectively.

For more details and in depth graphs on the current state of the PC anti-virus market, see here.

Image courtesy of OPSWAT