Keylogging Trojan Dodges Anti-virus Detection

A new variant of the Russian Trojan Gozi, armed with keylogging functionality, is making the rounds again. What makes this time different is that the Trojan can scramble itself to avoid detection by your anti-virus software.

The Trojan is believed to have been spreading since April 17. Like the original, which was discovered earlier in 2007, the new version of Gozi steals data from encrypted SSL (Secure Sockets Layer) streams. The latest variant was uncovered May 7 by Don Jackson, a security researcher at SecureWorks in Atlanta.

I have Nod32 but I will restart and try to do a scan in safemode.

How does a pc get infected with this? Through surfing, email attachments, or some other means?

Technically, isn't all new viruses, worms, trojans, or exploits undetectable by anti virus systems? It's a matter of hours and somone will have a patch that will catch this.

I thought good ones could take a look at files and say "this looks like a virus, lets stop it and ask the user about it.".

With enough encryption and packing and EP changing, anything can become UD.