Rootkit software infects gamblers' computers

Playing online increasingly a gamble as hackers hijack PCs

Written by Dinah Greek, Computeractive

Gamblers on an online gaming site have had their PCs infected with a rootkit.

Malicious rootkit software , known as RBCalc.exe - or the Rakeback calculator -  has been distributed from Checkraised.com's website to its customers' PCs. Rootkits are used by malware authors to hide malicious software.

This attack was found by security company F-Secure's rootkit detection technology, Blacklight. The software dropped four executable files into the gamers' computers and used the rootkit to hide its presence.

Advertisement

The malware then covertly stored gamblers' information and the executable files allowed hackers remote access to the victims' computers.

The stolen information has been used to log into various online poker websites including Partypoker, Empirepoker, Eurobetpoker and Pokernow. Having gained access, the hacker can then play poker against himself, losing on purpose and reaping the rewards.

Shortly after the discovery, Checkraised.com removed the offending exe file from its website and issued an official statement on its website advising users to change their poker site passwords as well as offering instructions for manually removing the malware.

Kimmo Kasslin, a researcher at F-Secure's data security laboratory, said: " Following the exponential rise of interest in online poker, it is inevitable that malware authors would follow suit with programmes to separate players from their money.

"What is significant is the fact that this particular scam was hosted, albeit unwittingly, on a legitimate site, using rootkit technology to cloak itself."

Kasslin continued: "Malware authors are increasingly wise to standard anti-virus and intrusion techniques and are constantly looking for a new exploits. Having standard data security software from the bigger vendors would not have protected you against this rootkit exploit. F-Secure's software does."

F-Secure has advised that people visiting the Checkraised.com site to ensure their PCs are not infected. A free scan is available from the F-Secure Online Scanner Next Generation Beta , which also now has rootkit detection capabilities through the F-Secure BlackLight engine.

People can also read  updates on this story from F-Secure' Data Security Lab weblog as the news unfolds.

Tags:

Reader comments

More from Computeractive

News

The latest home computing news

Downloads

The best PC tools, applications and more

Reviews

Independent opinions on new hardware and software

Step-by-step guides

Easy-to-follow projects with pictures

PC Help

Solve PC problems with our Q&A

Videos

PC projects demonstrated and product reviews

Articles

An in-depth look at how to get the best from your PC

Magazine

What's coming up in Computeractive

Forums

Get help with your PC problems from our readers

Competitions

Your chance to win computing prizes

Shopping

Great deals on products, services and more

NEW! Computeractive CD Rom 11
All 26 issues of Computeractive from 2008 on one CD-Rom.

Ultimate Guide to Disc Burning
Everything you need to know about creating your own discs.

Create your own calendars softwareCreate your own Calendars
The fun and easy way to create your own calendars!

Computeractive - Issue 280Computeractive Back Issues
Missed an issue? Click here to find a back issue

Blogs

Windows Watch

Windows Watch

Keeping an eye on the latest XP and Vista news

Outlook 2007 email controversy

One of the major changes in Outlook 2007 had nothing to do with the Ribbon but that Word was used to display...

Download Junkie

Download Junkie

Your daily dose of download discussion

Backup important data with SyncBack SE

Keeping certain files backed up helps to keep items safe in case anything disastrous happens to your computer, but although most of...

Advertisement

Free email newsletters

Techno babble demystified...

[Display all definitions]

Or type in any computer-related word and click "Go"

Advertisement

Computeractive is not reponsible for content of Google adverts

Primary Navigation

© Incisive Media Ltd. 2009. Incisive Media Limited, Haymarket House, 28-29 Haymarket, London SW1Y 4RX, is a company registered in England and Wales with company registration number 04038503

Search computeractive.co.uk