Remove Whisler, Mebroot, Sinowal Bootkit Virus Phishing Trojan by Britec Infected System Mebroot will install Torpig as payload and Torpig is by far the nastiest thing we have ever seen. Generally, it: * will steal login and other personal or confidential details from banking websites * can inject any HTML content into any website (websites can be encrypted with or without EV-SSL.) without detection * can capture CAPCHA and compromize virtual keyboards * can use the information in real-time to defeat One-Time-Passwords * has configuration files for many banking sites so that it knows exactly what to look out for * is incredibly hard to detect * works system-wide and therefore any browser is affected. (Yes, you heard right. Firefox and Chrome users are also affected) So how does it work? Well, we are still reverse-engineering and analyzing the trojan in detail, however after infecting the Master-Boot-Record, it employs a complicated mechanism to injects itself into the ATAPI Harddrive Driver to then inject core windows components (svchost.exe and services.exe) which then will hook/redirect functions for all processes that are used for internet transmissions. What’s important is that your webbrowser (Internet Explorer, Firefox, Opera, Chrome, …) is infected and they don’t even know it! So what does Mebroot/MBR/Torpig do? As said before, it is after your login credentials and personal information and the ability to manipulate this data either in real-time or use at a later …