Has there ever been a known case where a machine acquired spyware like a browser toolbar, or plugin but that spyware also deployed more dangerous malware like a trojan, botnet, or worm?

  • 3
    Short answer: yes. Long answer: always. By the way, a spyware is a form of malware. – Simon Dec 12 '13 at 23:49
  • 2
    Isn't saying "very bad malware" like beating a dead horse..all malware is "very bad". That's why it's called malware. – NotMe Dec 13 '13 at 1:26

Yes. What happens is that something gets a foothold on the system, phones home, and then is bootstrapped with a rootkit that is suited to the browser or operating system.

Once compromised, the attacker can deploy different payloads - this month it might be a bitcoin miner, next it could be ad injection into the browser, whatever it is that they are being paid to do.

It doesn't always happen, but I'd say it is pretty common. This leads us to conclude that to be certain your machine is not compromised, always rebuild, no matter how mild the infection might appear to be.

  • IMO the chances of having really bad malware is lower than usual after having removed a normal malware. After all, how often does one check every detail with a rootkit revealer etc.? – CodesInChaos Dec 13 '13 at 12:37
  • I'm afraid I must respectfully disagree. I have rebuilt many machines where the users report that the issues increase in severity over time. There are hardly any cases where the issue remains at the original level for extended periods. It seems that you have a different perspective to offer, so please do detail it in a separate answer - differing opinions improve the quality of discussion! – scuzzy-delta Dec 13 '13 at 19:02
  • But is there a known documented case? Like something reported online somewhere that shows conclusively that adware/spyware can be a gateway to rootkits/Trojans etc. I tried finding that and couldn't immediately find anything concrete. – user35603 Dec 16 '13 at 17:01
  • Certainly. Alureon/TDSS is a rootkit that is bootstrapped by an initial trojan infection. So is Rustock and Vundo. This discussion is somewhat hampered because of language - if something only is "adware", by definition it cannot then be a trojan. The actual problem is that code of dubious origin is executing on the compromised system, and the only way to be sure of eradicating it is to rebuild. – scuzzy-delta Dec 16 '13 at 18:28
  • Very true. I probably should have used the term "adware" in the beginning instead of spyware or whatever. The point in all this is that there is a certain percentage of our staff that isn't concerned when they see that a machine "just has adware" on it. They don't see that the adware can be a gateway to more nefarious code. If there was a known documented case or two I could point them to, that would definitely help. A Trojan infection that leads to a rootkit was something I was able to find lots of instances of, but adware that bootstraps a rootkit . . . I didnt see anything immediately. – user35603 Dec 17 '13 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.