On Oct. 12, 2010, Microsoft added detection and removal capabilities for the Zeus financial malware (also known as Zbot and Wsnpoem) to its Malicious Software Removal Tool (MSRT). MSRT, which was first introduced in 2005, is updated monthly and released on the second Tuesday of each month to scan user’ computers. It is meant to help prevent the infection and spread of the most prevalent forms of malware.

Joining the Fight Against Malicious Software

Microsoft’s decision to join the fight against financial malware is an important step. Winning the war against criminals requires the participation and cooperation of more software vendors and increased involvement by law enforcement agencies. I hope Microsoft’s efforts won’t stop here since there is still a lot more to be done.

With MSRT out in the field, our research organization decided to evaluate its effectiveness in detecting and removing Zeus. They tested MSRT against hundreds of Zeus files and found that MSRT detects Zeus 2.0 46 percent of the time, but it was unable to detect the new 2.1 version of this financial Trojan. The good news is that MSRT has been able to kill approximately half of the Zeus population and will continue to do so. This detection rate is very respectable. Most if not all antivirus solutions have a much lower detection rate; however, this low detection rate also emphasizes how hard it is to remove Zeus.

Zeus May Have the Upper Hand

Zeus also has a significant advantage over MSRT when it comes to committing fraud. Since MSRT does not operate in real time and only disinfects a machine when it is running, hackers have a golden window of opportunity between the time of a Zeus infection and the next scan by MSRT to siphon off money from the victim’s bank account. Thousands of new computers are infected with Zeus every day and are instantly analyzed by fraudsters. Our research team has found that financial fraud usually occurs shortly after a computer is infected with Zeus because sensitive information is immediately transmitted back to the criminals. In the majority of cases, the ability of MSRT to prevent Zeus-related fraud and data loss will be minimal because the damage has already been done by the time it performs its scan.

Will MSRT Do More Harm Than Good?

I believe that MSRT will actually serve to further shorten the time between a machine becoming infected and the time it is used to commit fraud. I also expect this will reduce the effectiveness of antivirus solutions because they typically cannot detect a new variant until a few days after it is released.

I also wouldn’t be surprised if some financial malware starts targeting MSRT to render it useless. Based on previous activity I have witnessed by financial malware developers, this is very likely. Zeus and other financial malware can accomplish this fairly easily since they have a distinct technical advantage over MSRT: They are already running when MSRT starts scanning. This allows the Trojan to block MSRT from running altogether. Disabling MSRT will inflict even further damage since it is effective at detecting and removing many other forms of malware.

Microsoft is working hard and making important contributions toward improving online security with their Malicious Software Removal Tool and Microsoft Security Essentials. However, in the battle against Zeus, I believe Microsoft chose the wrong weapon. What’s needed are real-time, signature-independent solutions and more operating system improvements if we want to defeat Zeus and others like it.

More from Software Vulnerabilities

Analysis of a Remote Code Execution (RCE) Vulnerability in Cobalt Strike 4.7.1

Command & Control (C2) frameworks are a very sensitive component of Red Team operations. Often, a Red Team will be in a highly privileged position on a target’s network, and a compromise of the C2 framework could lead to a compromise of both the red team operator’s system and control over beacons established on a target’s systems. As such, vulnerabilities in C2 frameworks are high priority targets for threat actors and Counterintelligence (CI) operations. On September 20, 2022, HelpSystems published…

Controlling the Source: Abusing Source Code Management Systems

For full details on this research, see the X-Force Red whitepaper “Controlling the Source: Abusing Source Code Management Systems”. This material is also being presented at Black Hat USA 2022. Source Code Management (SCM) systems play a vital role within organizations and have been an afterthought in terms of defenses compared to other critical enterprise systems such as Active Directory. SCM systems are used in the majority of organizations to manage source code and integrate with other systems within the…

X-Force Research Update: Top 10 Cybersecurity Vulnerabilities of 2021

From 2020 to 2021, there was a 33% increase in the number of reported incidents caused by vulnerability exploitation, according to the 2022 X-Force Threat Intelligence Index. A large percentage of these exploited vulnerabilities were newly discovered; in fact, four out of the top five vulnerabilities in 2021 were newer vulnerabilities. Vulnerability exploitation was the second most common initial infection vector observed by IBM Security X-Force in 2021, falling closely behind phishing. Cybercriminals are finding new ways of bypassing security…

How Log4j Vulnerability Could Impact You

MITIGATION UPDATE: New vulnerability in 2.17 — CVE-2021-44832 Upgrade to 2.17.1 to mitigate this vulnerability Do NOT enable JNDI in any versions Follow: https://logging.apache.org/log4j/2.x/security.html If you hadn’t heard of Apache Log4j, chances are it’s on your radar now. In fact, you may have been using it for years. Log4j is a logging library. Imagine writing your daily activities into a notebook. That notebook is Log4j. Developers and programmers use it to take notes about what’s happening on applications and servers.…