Security researchers have spied malware that stashes a copy of itself in a Windows help file to ensure victim computers remain infected.

The trojan, dubbed Muster.e by anti-virus provider McAfee, infects a Windows file called imepaden.hlp so it stores the main components of the malware in encrypted form. In the event the installed malware is removed, the secret payload is decrypted into an executable file called upgraderUI.exe and run by a companion installation file that automatically runs as a Windows service.

"This is hiding in plain sight," said Craig Schmugar, a threat researcher at McAfee Labs. "The help file trick is pretty new to us. Usually on the client, we don't see this very often."

The technique ensures Muster.e remains installed on an infected PC even if most of the files associated with the malware are removed. No doubt it's also perplexed its share of users who for the life of them can't figure out how their PCs keep getting reinfected.

McAfee has more here. ®

Related stories

• Updated Microsoft will issue emergency IE patch on Thursday (20 January 2010)
• Facebook snuggles with McAfee in security spree (13 January 2010)
• Mossad hacked Syrian laptop to steal nuke plant secrets (6 November 2009)
• Malware ecosystem thrives thanks to pay-per-install fees (30 September 2009)
• Analysis Microsoft Security Essentials shakes up consumer antivirus (30 September 2009)
• Mass infection turns websites into exploit launch pads (24 August 2009)
• Unpatched PowerPoint flaw spawns Trojan attacks (3 April 2009)