Although this info is not applicable to eCS I figure there may be some readers here who
occasionally use XP on their TP. So here is something FYI.
Lewis: If you think this is inappropriate then I apologise and please remove this in that case.
jon
Thursday November 20, 2008
Lenovo Ships Malware With Software
A Windows XP software package distributed by Lenovo earlier this week was infected with malware.
The program has been removed from the Lenovo site.
The problem was in the Lenovo Trust Key software for Windows XP, a digitally signed driver package
for Windows XP SP2 systems. The application is used for secure logon and secure private folders.
Microsoft identified the infection as Win32/Meredrop, a Trojan dropper. Such programs download and
install other malicious programs. Other anti-virus vendors are detecting the threat as a 'hooligan'
virus or a porn dialer.
Even though the report indicates that it is the XP version which is affected, the Vista version is
also no longer available on the Lenovo site. Perhaps the are the same version.
In such cases it is good practice to revoke the digital certificate used to sign the package. I
have no word yet on whether Lenovo will do this. If they do so and have used the same certificate
to sign other packages, all of those will need to be resigned and re-issued.
back to list