I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital here, but from everything I can tell the "malware" seems to do nothing but remove another piece of malware. It even removes itself if the other malware isn't there!

Has some important info been pruned from the trend micro page in the interests of not sharing exploits that might make this make more sense, or is this normal for a piece of malware? Perhaps this is an analogue of graffiti artists removing another artists tags from something (the image of rogue, vigilante malware removing other malware is somewhat amusing to me, but I kind of doubt this is it).

1 Answer 1


It is all about control of turf. Crimeware gangs want to have exclusive control of as many PCs as possible. When you are remotely controlling a machine used for online banking, you want exclusive control. Once a machine is compromised by one gang, another gang may find it even easier to commandeer it. Install your backdoor, remove the previous backdoor.

  • huh... I thought that I was positing a ludicrous yet amusing possibility - turns out that's the answer. So I am guessing in this case that BAT_VOBFUS would be a small component of a larger payload, which would probably also include more nefarious code? Apr 22, 2013 at 4:19
  • @ChrisO'Kelly Precisely. It's an indicator of infection.
    – Polynomial
    Apr 22, 2013 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .