Sinowal/Mebroot Super Trojan

[Taffycat]

This one looks like a tricky critter. Apparently, it can by-pass most security applications (although XP is said to be more vulnerable than Vista.) More info HERE.

 

[Ian]

After reading that I ran the Blacklight rootkit scanner just to be safe!

Good find TC

 

[guest_9323wk]

TC,

Great fine btw.


Ian, is the Blacklight rootkit scanner built into Kaspersky or do you have to download it off the net?

Edit, Found out in the infomation where to download it.

Thanks,

Wiz

 

[Ian]

Glad you found it Wiz, I'll post it here for others though just in case:

http://www.f-secure.com/security_center/

It's the 2nd from bottom link, called "BlackLight – Rootkit Detection and Elimination Tool"

 

[Taffycat]

Thank you for that link Ian - I've just downloaded that for XP, but do you think it would be a good idea to use it on Vista too please?

 

[Ian]

Thank you for that link Ian - I've just downloaded that for XP, but do you think it would be a good idea to use it on Vista too please?

Vista does have some extra protection against rootkits already, but there's no harm in running it It's one of the few rootkit detectors that works in Vista as far as I know

 

[Taffycat]

Vista does have some extra protection against rootkits already, but there's no harm in running it It's one of the few rootkit detectors that works in Vista as far as I know

Thank you for your reply Ian - I thought I should check, just in case "Blacklight" was likely to clash with anything within Vista's gubbins

 

[Ian]

I was round at a friends house today as they have been infected by this trojan. The only way they knew was a letter from the bank informing them that online banking had been cut off because they detected Sinowal access to her account. I've run everything I can think of, and nothing has detected it (HJT, Blacklight, Avira, SAS, Housecall, AVG etc...).

This little bugger is hard to find

FWIW, here is the followup article to the one above which explains how you might try to remove it:

http://windowssecrets.com/2008/11/26/03-Antivirus-tools-try-to-remove-Sinowal-Mebroot