Dr. Web has been following a Trojan that works on TeamViewer, the popular remote control utility, since it first appeared in 2011.

It called the latest iteration of the TeamViewer Trojan “BackDoor.TeamViewerENT.1” to differentiate it from previous instances. Whereas those earlier versions of the Trojan downloaded a malicious library that it installed on the target machine, this version uses the TeamViewer app itself to carry out surveillance on the victim.

TeamViewer Trojan Owns Windows Users

The Trojan’s main payload is placed into the avicap32.dll library. The operational parameters are stored in an encrypted configuration block.

Because the of way Windows loads its libraries, the Trojan stores a malicious library with that same name as the one it would normally seek in the folder with the original TeamViewer executable file. This way, Windows loads the malicious library rather than the legitimate one into the memory.

Once it gets going, the Trojan disables error messages. It also classifies its files and the TeamViewer files as system, hidden or read only. The backdoor it creates includes support for various commands, such as a restart, fully turning off the computer, relaunching or removing TeamViewer, start or stop listening through the internal microphone, and start or stop viewing of the web camera. Files can be downloaded, saved to a temporary folder and then run.

Dr. Web also said the Trojan can update a configuration file and the backdoor’s executable file, connect to the specified remote server, run cmd.exe and execute input/output redirection to a remote server. That’s quite a list of nasty potential actions.

A Shifty Attack

There’s a shifting of the attack between geographical areas, too. According to Dr. Web, “the backdoor targets residents of particular countries and regions at different times.” In July, for example, it targeted computers in Britain and Spain, before moving into the U.S. in August. There were also hijack attempts reported in Russia.

Dr. Web offered no specific mitigation for the TeamViewer Trojan. Instead, it simply advises that you keep your antivirus products current. Regularly updating security programs and conducting scans can help users identify issues before they become major violations of privacy.