“Kneber” = Zeus

Recently, Symantec observed some high-profile coverage of a threat being reported as a new type of computer virus known as “Kneber.” In reality Kneber is simply a pseudonym for the Zeus Trojan/botnet. The name Kneber refers to a particular group, or herd, of zombie computers (a.k.a. bots) being controlled by one owner. The actual Trojan itself is the same Trojan.Zbot that also goes by the name Zeus, which has been observed, analyzed, and protected against for some time now.
 
Since Zeus/Zbot toolkits are widely available on the underground economy, it is not uncommon for attackers to create new strains, such as Kneber, of the overall Zeus botnet. Though it is true that this Kneber strain of the overall Zeus botnet is fairly large, it does not involve any new malicious threats. Thus, Symantec customers with up-to-date security software should already be protected from this threat.
 
Symantec detects the Zeus Trojan, otherwise known as Trojan.Zbot, as the following:
 
•    Trojan.Zbot
•    Trojan.Zbot!gen
•    Trojan.Zbot!gen1
•    Trojan.Zbot!gen2
•    Trojan.Zbot!gen3
•    Trojan.Zbot!gen4
•    Trojan.Zbot!gen5
•    HTTP Trojan Zbot Domain (IPS)
•    HTTP Zbot Malicious File Download (IPS)
Check out the blog post Zeus, King of the Underground Crimeware Toolkits on Symantec’s Security Response blog to get a better feel for how an attacker (continue reading...)