In the News

Pirated Windows 7 OS Comes With Trojan, Builds A Botnet

Click here for PDF version
Kelly Jackson Higgins
May 12, 2009

At its peak, Trojan-infested counterfeit version of Microsoft's pre-release version of Windows 7 was infecting over 200 PCs an hour

A pirated version of the new Windows 7 operating system release candidate that has been circulating around the Internet is also building out a botnet.

The rogue OS, which is rigged with a Trojan downloader, at one point had around 27,000 bots in its control as of May 10, when researchers took over the command and control server that communicated with the bots and served them additonal malware. At the height of the botnet buildup, the botmaster was recruiting over 200 machines an hour, says Tripp Cox, vice president of engineering for Damballa. The victims initially downloaded the pirated OS via popular bootlegged software sites and online forums.

Damballa researchers on Sunday grabbed control of the C&C domain, but they say this is likely just one of many versions of rogue Windows 7 OS: "In this case, we neutralized one release version of the Trojan'ed OS. So if users have an older version and install it, we've neutralized it from downloading additional malware," he says.

Cox says the main goal of the Trojan tucked into the pirated OS is to add additional malware packages to the victim's machines in a "pay-per-install" scheme, where the software piracy ring makes money from the cybercrime groups who pay them to successfully install the malware. "The pirated software is the social enticement initially, and the second state is downloading additional packages of malware installed and distributed [via] the Trojan on a pay-per-install" arrangement, Cox says.

Windows 7 has indeed become the newest lure – Trend Micro researchers have reported a Trojan downloader posing as a copy of the Windows 7 Release Candidate on popular torrent sites. The Trojan appears as a file called "setup.exe" when users download what they think is the Windows 7 RC. The Trojan, dubbed "TROJ DROPPER.SPX by Trend Micro, downloads TROJ AGENT.NICE, both of which can be detected by Trend Micro's Smart Protection Network.

Meanwhile, software piracy is on the rise, especially in the U.S., according to a report released today by the Business Software Alliance and IDC. One-fifth of all PC software in the U.S. is pirated, according to the report, which is the lowest rate in the world. But the U.S. has the biggest losses from piracy, at about $9.1 billion, according to the report.

And most of the bots in the pirated Windows 7 OS scheme are in the U.S., according to Damballa, with about 10 percent of the bots, followed by Netherlands, 7 percent; and Italy, 7 percent.

Damballa's Cox says most traditional antivirus software is unable to detect the pirated Windows 7 Trojan because the OS itself is infected and most AV solutions don't yet support Windows 7. "We continue to see new installs happening at a rate of about 1,600 per day with broad geographic distribution. Since our takedown, any new installs of this pirated distribution of Windows 7 RC are inaccessible by the botmaster. The old installs are accessible," Cox says.

If you want the actual Windows 7 Release Candidate, it can be downloaded from Microsoft.