2

Has there ever been a known case where a machine acquired spyware like a browser toolbar, or plugin but that spyware also deployed more dangerous malware like a trojan, botnet, or worm?

Improve this question
2
  • 3
    Short answer: yes. Long answer: always. By the way, a spyware is a form of malware.
    – Simon
    Dec 12, 2013 at 23:49
  • 2
    Isn't saying "very bad malware" like beating a dead horse..all malware is "very bad". That's why it's called malware.
    – NotMe
    Dec 13, 2013 at 1:26

1 Answer 1

Reset to default
2

Yes. What happens is that something gets a foothold on the system, phones home, and then is bootstrapped with a rootkit that is suited to the browser or operating system.

Once compromised, the attacker can deploy different payloads - this month it might be a bitcoin miner, next it could be ad injection into the browser, whatever it is that they are being paid to do.

It doesn't always happen, but I'd say it is pretty common. This leads us to conclude that to be certain your machine is not compromised, always rebuild, no matter how mild the infection might appear to be.

Improve this answer
7
  • IMO the chances of having really bad malware is lower than usual after having removed a normal malware. After all, how often does one check every detail with a rootkit revealer etc.?
    – CodesInChaos
    Dec 13, 2013 at 12:37
  • I'm afraid I must respectfully disagree. I have rebuilt many machines where the users report that the issues increase in severity over time. There are hardly any cases where the issue remains at the original level for extended periods. It seems that you have a different perspective to offer, so please do detail it in a separate answer - differing opinions improve the quality of discussion!
    – scuzzy-delta
    Dec 13, 2013 at 19:02
  • But is there a known documented case? Like something reported online somewhere that shows conclusively that adware/spyware can be a gateway to rootkits/Trojans etc. I tried finding that and couldn't immediately find anything concrete.
    – user35603
    Dec 16, 2013 at 17:01
  • Certainly. Alureon/TDSS is a rootkit that is bootstrapped by an initial trojan infection. So is Rustock and Vundo. This discussion is somewhat hampered because of language - if something only is "adware", by definition it cannot then be a trojan. The actual problem is that code of dubious origin is executing on the compromised system, and the only way to be sure of eradicating it is to rebuild.
    – scuzzy-delta
    Dec 16, 2013 at 18:28
  • Very true. I probably should have used the term "adware" in the beginning instead of spyware or whatever. The point in all this is that there is a certain percentage of our staff that isn't concerned when they see that a machine "just has adware" on it. They don't see that the adware can be a gateway to more nefarious code. If there was a known documented case or two I could point them to, that would definitely help. A Trojan infection that leads to a rootkit was something I was able to find lots of instances of, but adware that bootstraps a rootkit . . . I didnt see anything immediately.
    – user35603
    Dec 17, 2013 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .