Energizer DUO Trojan May Have Infected PCs for 3 Years. Trojan found in Energizer USB battery charger software.

Software that can be downloaded for use with the Energizer Duo USB battery charger contains a backdoor that could allow an attacker to remotely take control of a Windows-based PC, Energizer and US-CERT is warning.

"The installer for the Energizer Duo software places the file UsbCharger.dll in the application's directory and Arucer.dll in the Windows system32 directory," the U.S. Computer Emergency Readiness Team said in an advisory on Friday. "Arucer.dll is a backdoor that allows unauthorized remote system access via accepting connections on 7777/tcp. Its capabilities include the ability to list directories, send and receive files, and execute programs."

The Windows software was made available via a download with the Energizer Duo Charger, Model CHUSB, Energizer said in a statement.

The battery maker said it does not know how the Trojan got into the software. "Energizer has discontinued sale of this product and has removed the site to download the software," the statement said. "Energizer is currently working with both CERT and U.S. government officials to understand how the code was inserted in the software."

For systems with the software installed, US-CERT recommends removing the Energizer Duo software and Arucer.dll file, as well as blocking access to port 7777 via network perimeter devices or firewall software.

The Trojan may have been in the software since it was first offered three years ago, according to Symantec.

According to the security vendor’s analysis, there is evidence the Trojan dates back to May 10, 2007.

"It’s really impossible to say for sure that this Trojan has always been in the USB charger-monitoring software, but the creation date in the Trojan binary's header indeed states that it was created back in May 2007,” noted Dean Turner, director of Symantec’s Global Intelligence Network. “This would imply that the Trojan was most likely created back in 2007; however, there is a possibility that the time and date were set wrong on the computer that was used when the binary source files were compiled.”

Source: CNET News / eWeek