Malware Again Attacks Ichitaro Word Processor
March 16th, 2009
For years, the Japanese word processor Ichitaro has been attacked by malware authors exploiting flaws in the application. So it is no surprise that in the last week we discovered in the wild specially crafted Ichitaro document files exploiting a new vulnerability.
This time, the crafted file (detected as the Exploit-TaroDrop.g Trojan) drops and runs the Generic Dropper Trojan, which is responsible for dropping the BackDoor-DNW Trojan. The last attempts to connect “lightsut.com:80” and opens a backdoor to give attackers remote access to compromised machines. McAfee proactively detects Generic Dropper, which prevents users from being infected with BackDoor-DNW even with a non-patched copy of Ichitaro.
Detection alert of Japanese McAfee VirusScan Enterprise
The patch for this vulnerability has already been published by JustSystem. Ichitaro users should apply the update as soon as possible.
Back to McAfee Research Blog overview
