Trojan keylogger uses Adobe reader as bait

Click here to email Frank Washkuch Jr.

Researchers from the Scotts Valley, Calif. company said in an alert published this week that the malware asks users to download the latest version of Adobe Reader 7.0.8.

Once downloaded, the trojan downloads other malicious files that monitor browser activity, then opens an Adobe read-me page.

The trojan also installs spamming malware, which claims to be a Windows Live Messenger advertisement from Microsoft and contains malware of its own.

Susan Larson, SurfControl vice president for global content, told SCMagazine.com today that the malware is more complicated that most attached to spoof emails.

"The first [trojan] came down like it was an update to Acrobat, it had an Adobe logo, it was very well done," she said. "It actually turned your machine to sending spam, and it had a Microsoft logo. Then it downloaded the same trojan, but this time with an Internet Explorer logo, very believable."


A statement from Adobe recommended users open email with caution.

"Adobe has been made aware that a third party has begun to circulate a spoofed email that incorrectly appears to be coming from Adobe. This email is suspected to contain malicious links posing as links to Adobe technology downloads," read the statement.

"Adobe has requested that the internet service provider take appropriate action and shut down access to the linked web pages. As always, Adobe recommends that consumers exercise caution when receiving unsolicited email communications that include untrusted links or attachments."

adobeasbaitkeyloggerreadersecuritytrojanuses