Trojans Lurking in Pirated Copies of Windows 7 RC

The Windows 7 Release Candidate is finally out! Released to testers on Tuesday the Windows 7 RC is now available for comprehensive user downloading. Unfortunately, as often as times of celebration come so do times of sadness, cyber-criminals could just not let this big event pass without adding their input. From late last month cyber-criminals somehow managed to obtain illegal copies of  the release candidate and made it available on, free file-sharing site, BitTorrent. To add insult to injury a large number of the pirated copies had a Trojan attached to them.

The infected pirated copies got quite a few users in trouble and expressing their concerns on several forum sites. Frank Fontaine, a user that did some research on the infection, found the Trojan was embedded in the setup.EXE file which, on its own, is simply a program utilized when installing new software on your computer. Further investigation showed that setup.EXE file is in fact a self-extracting executable container that contained two files inside it, Setup.exe and codec.exe.

The security software used by Fontaine identified the second file in the container,codec.exe, as the Win32.Trojan-gen infection. This is a backdoor Trojan horse that can give an attacker access to a targeted users' computer by exploiting security holes. This Trojan also has the ability to record and steal private information such as passwords from an infected computer.

Table 1.  Alias names of the Trojan

If you are concerned that you might have installed the infected version of Windows 7 RC, it would be a good idea to check the MD5 of the ISO file. The clean MD5 should be; 8867C13330F56A93944BCD46DCD73590 for the x86 version and 98341af35655137966e382c4feaa282 for the x64 version. The MD5 of the infected version was 838F96D945C9554835A96CF41DEC9453, so if that's what you have it's time to do some cleaning up.

Here are other symptoms you can look out for if you suspect that your computer is infected:

• Changes in your internet settings,
• Slow performance of your computer,
• The  constant appearance of irritating pop-ups,
• Unknown Additional shortcuts on your desktop,
• E-mails being sent out from your mailbox without your knowledge.