Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital here, but from everything I can tell the "malware" seems to do nothing but remove another piece of malware. It even removes itself if the other malware isn't there!

Has some important info been pruned from the trend micro page in the interests of not sharing exploits that might make this make more sense, or is this normal for a piece of malware? Perhaps this is an analogue of graffiti artists removing another artists tags from something (the image of rogue, vigilante malware removing other malware is somewhat amusing to me, but I kind of doubt this is it).

share|improve this question

1 Answer 1

up vote 1 down vote accepted

It is all about control of turf. Crimeware gangs want to have exclusive control of as many PCs as possible. When you are remotely controlling a machine used for online banking, you want exclusive control. Once a machine is compromised by one gang, another gang may find it even easier to commandeer it. Install your backdoor, remove the previous backdoor.

share|improve this answer
    
huh... I thought that I was positing a ludicrous yet amusing possibility - turns out that's the answer. So I am guessing in this case that BAT_VOBFUS would be a small component of a larger payload, which would probably also include more nefarious code? –  Chris O'Kelly Apr 22 '13 at 4:19
    
@ChrisO'Kelly Precisely. It's an indicator of infection. –  Polynomial Apr 22 '13 at 13:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.