prostoalex's Journal: Trojan installs its own antivirus

eWeek is reporting on a new kind of Trojan horse that self-installs a patched pirated copy of Kaspersky's AntiVirus, which then removes every virus and spyware, except the SpamThru virus itself. From the article: "Stewart also found SpamThru using a clever command-and control structure to avoid shutdown. The Trojan uses a custom P2P protocol to share information with other peers--including the IP addresses and ports and software version of the control server. "Control is still maintained by a central server, but in case the control server is shut down, the spammer can update the rest of the peers with the location of a new control server, as long as he/she controls at least one peer," he said."