Gozi Trojan

The Gozi Trojan is a spyware program that's designed to steal confidential information such as browser-based information related to bank accounts and other types of info that are profitable for criminals. Using the same Man-in-the-middle-based attack philosophy as the infamous Trojan Zeus, the Gozi Trojan is capable of altering the contents of web pages so that victims will give up information without realizing that they're no longer interacting with the bank's own website. These attacks even can include confirmation of suspicious transactions, allowing Gozi Trojan to take over and empty a bank account without many symptoms for the victim to detect. SpywareRemove.com malware researchers consider Gozi Trojan a high-level threat that should be blocked and, if necessary, deleted by the best anti-malware programs that are available.

Gozi Trojan: the Spyware that Aims to Overtake a Greek God

The Gozi Trojan is designed to use similar attacks to Zeus, which was noted for its prolific distribution, sophistication of attack methodology and overall invasive nature. Like Zeus, Gozi Trojans operate by enabling fraudulent transactions through normal website interfaces that are used by banking sites; similar 'transactional' types of Trojans include Carberp and SpyEye. Already, SpywareRemove.com malware researchers have gathered evidence that several dozen US-based banks have been targeted by Gozi Trojan-related attacks.

The Gozi Trojan uses malicious DLL files and Registry changes as part of its installation process and, like Zeus, doesn't display a separate memory process even when Gozi Trojan is open. The meat of Gozi Trojan's attacks uses HTML injection techniques to alter the contents of web pages. This can be used to 'phish' for additional information from victims, but is especially dangerous because it allows the Gozi Trojan to initiate and confirm financial transactions on bank websites. As spyware, Gozi Trojan also monitors and steals both dynamic and static information, such as passwords, security question answers and login names.

Although your web browser may use slightly more RAM than normal, Gozi Trojan doesn't show major symptoms of any of these attacks that could be detected by eye. Encryption defenses also prevent outdated and simplistic anti-malware products from detecting the Gozi Trojan accurately.

Shutting the Gozi Trojan Down Before It Filches Your Life Savings

While the Gozi Trojan has acquired attention from the press due to its man-in-the-browser style HTML injector attacks, SpywareRemove.com malware research team also is forced to note that Gozi Trojan may be utilized for other attacks. As a Trojan that makes contact with a C&C server, Gozi Trojan can be configured to install other PC threats or compromise your computer's safety in additional ways. At this time, infection vectors for Gozi Trojan have, unfortunately, not been defined thoroughly.

Advanced anti-malware software should be used if detecting a Gozi Trojan infection or deleting a Gozi Trojan is necessary. The Gozi Trojan has a track record of evading detection, as well as confusing anti-malware products into believing that it's a different form of malware. You should be certain that all anti-malware products that you use have the latest updates and are capable of defeating high-level threats like Gozi Trojan.

Technical Details