Trojan Installs Rogue Firewall

First reported by antivirus vendors on June 1st, the Fantibag.A Trojan installs a packet filter that blocks incoming and outgoing traffic for a wide range of security related websites. By blocking the traffic, the Fantibag Trojan can prevent infected users from accessing antivirus updates and thus avoid detection. A second variant of the Fantibag Trojan, Fantibag.B, was discovered on June 29th. The rogue packet filter represents a new twist on blocking access to antivirus vendor websites.