20-year-old Trojan King Revealed, Maker of over 100 Banking Trojans

A 20-year-old Brazilian kid has been revealed as the maker of more than 100 banking trojans by the security firm Trend Micro. He is known online by the name of ‘Lordfenix’, ‘Filho de Hacker’ and ‘Hacker’s Son.’

The security firm writes that a 20-year-old college student from Tocantins, Brazil known by the name Lordfenix has become Brazil’s top malware maker. He has developed this reputation by giving birth to more than 100 online banking trojans. Most of these banking trojans were sold by him for about $300 each.

He is a computer science student who earned this money between April 2013 and targeted banks like Bank of Brazil, HSBC Brazil and Caixa. He began his career by asking for hacking advice in forums and today he is found offering free version of highly-efficient banking Trojan source code to the forum members in the underground world.
One of the Trojans detected called TSPY_BANKER.NJH identifies and wakes up when a user enters its target banks’ URL. Then it closes the active browser window and displays an error message to open a new fake browser windows. This is so smooth and unnoticeable that user doesn’t have a clue.
Now the user enters the login username and password in the fake window and the trojan sends back the information to the attacker. For more protection, the trojan terminates the process GbpSV.exe associated with the popular security software G-Buster Browser Defense, a security program used by many Brazilian banks.


Lordfenix claims that these free versions can steal credentials of bank customers of four different banks. On the other hand, the paid $300 versions target more banks using the tricks to disable the popular security software popular in Brazil. The security company has posted a picture of programmer’s Facebook page that shows a big pile of local currency on his bed.



Apart from his expertise in this area, the other factors that helped Lordfenix were the facts that more than half-population of Brazil uses internet for transaction and dealing with digital crime isn’t a top priority in the country.

Did you like this story about the 20-year-old Trojan King? Tell us in comments.

Image: David Goehring/Flickr

How to uninstall and remove Superfish malware completely

The Superfish malware has been in news recently, with Lenovo pre-installing it on all their new computers. This post shows how to find out if your Lenovo computer has Superfish malware installed and offers instructions on how to uninstall it and remove it completely.

The Superfish malware replaces the advertisements on the website which the user visits, and replaces them with new advertisements which possibly benefit Lenovo and Superfish.
This raises security concerns, since, when it intercepts HTTPS encrypted webpage to replace its own ads, it creates a mix of secure and insecure content, laying open the path for other hackers to potentially carry out its own attacks.
If you bought a Lenovo laptop recently, you may want to first check if you have Superfish malware installed on it. If you find out that you do, then here are the steps you need to take to completely remove it from your computer.
After issuing a statement and expressing regret about it, Lenovo has posted instructions on how to go about uninstalling the malware completely.

Remove Superfish malware completely

1] Open Control Panel > Program and Features.



Here you will see an entry Superfish Inc. VisualDiscovery. Select it and click on Uninstall. Once the uninstallation in completed, restart your computer.
2] Now open a command prompt windows and type certmgr.msc and hit Enter, to open the Certificate Manager.

Certificates are digital documents used to manage network authentication and the exchange of information. The Certificate Manager or Certmgr.msc in Windows lets you see details about your certificates, export, import, modify, delete or request new certificates.
3] Under Certificates – Local Computer, expand Trusted Root Certification Authorities. You will see Certificates. Select it.



Now in the right side, you will see Superfish, Inc. Right-click on it and select Delete.
4] Windows will prompt you to confirm deletion. Click Yes and restart your device.

5] If you use Firefox browser, there is one more step you will have to carry out. Open Firefox Options > Advanced > Certificates > View Certificates. If you see a listing for Superfish, click on it and select Delete.




6] Finally to be doubly safe, run a full-scan of your antivirus software and restart your computer. Incidentally, Microsoft has updated Windows Defender. It now removes Superfish along with the root CA certificate.
You will have now completely removed Superfish malware from your computer.

UPDATE: Lenovo has released SuperFish Removal Tool, which makes its removal, a matter of a click.

Stay safe!