winnea.ime - Trojan Uses Windows to Compromise Systems

[Guest Gh05t]

The input method in Windows is now a popular way for hackers to inject malicious code.

 

Security researchers have discovered a Trojan which taps in Windows to over-write installed security software to compromise infected systems.

 

The malware, which poses as a security update, utilizes the input method editor (IME) in Windows to inject a system. IME is commonly used to allow users to enter characters not supported by their keyboard, such as a user with and English-language keyboard looking to enter Chinese characters.

 

“The trojan can install itself as an IME, then it kills any running antivirus processes and deletes the installed antivirus executable files,” according to a write-up by Websense. “The original executable file of this trojan disguises itself as an antivirus update package.