A new Trojan horse program that attacks and removes adware, is circulating on the Internet, according to anti-virus company Symantec.
The program, called Downloader.Lunii, was discovered on Monday. When run, it attempts to kill off computer processes and delete files used by common adware programs like Powerscan and BargainBuddy. However, Lunii is not entirely benevolent. Like other Trojan horses, it also modifies the configuration of Microsoft Windows machines and attempts to download files from a remote location, Symantec warned.
Lunii works by halting Windows processes that adware programs use to communicate and by removing known adware programs from systems it infects. The Trojan program also modifies a Windows file called the "hosts" file, inserting its own list of bogus Web sites, which may block access to certain Web pages, Symantec said.
Lunii was rated a low threat by Symantec, which has released an anti-virus signature to detect the Trojan on Monday.
The proliferation of spyware programs in the last year has been linked to the growth of organised criminal groups that pursue illicit gain through identity theft, extortion and other online scams, often using spyware programs to steal data or hijack compromised machines to use in online denial of service attacks.
The problem has attracted the attention of US lawmakers. The US House of Representatives voted 399-1 Tuesday to pass a bill dubbed the SPY ACT (Securely Protect Yourself Against Cyber Trespass), which makes it illegal to download programs onto other users' computers without their permission, hijack someone's computer or modify its configuration settings.