Sinowal virus scan

Please check this Knowledge Base page for more information. Analysis by: Anthony Joe Melgarejo. Infection Channel: Downloaded from the Internet. File Size: , bytes. Memory Resident: Yes. Initial Samples Received Date: 29 Oct Minimum Scan Engine: 9.

Press the restart button of your computer. When prompted, press any key to boot from the CD. When prompted on the Main Menu, type r to enter the recovery console. It may also secretly install other malicious programs. Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part.

If you wish, you may also:. First check if your F-Secure security program is using the latest detection database updates , then try scanning the file again. After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis. NOTE If the file was moved to quarantine , you need to collect the file from quarantine before you can submit it. If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

Note You need administrative rights to change the settings. Find the latest advice in our Community. See the user guide for your product on the Help Center. Chat with or call an expert for help. CP drops and loads a password stealing component on the infected system and tries to steal account information from it.

Could I help? No problem, I said. Leave the notebook with me and use one of my computers. Seeing an obvious opportunity, I made sure to get assurance of dinner at the restaurant of my choice before turning over one of my notebooks. My friend's presentation turned out fine, but I wasn't having any luck in finding out what was wrong with his notebook.

It appeared to work just fine. I called and asked him if possibly the German beer hadn't clouded his judgment. He denied any wrongdoing, telling me to look elsewhere using words I'm not about to repeat. Enough said, I decided to replicate the exact conditions under which the problem occurred, which meant allowing his notebook to access the Internet through my network.

I normally don't like to do that with suspect computers, even on an isolated guest VLAN. To my surprise, the computer crashed shortly after being connected to the Internet. That's interesting; I've never experienced a situation quite like this before. I decided to see if I could capture enough Ethernet traffic from the notebook to determine what's going on before it crashes. In my second attempt, I was able to get several hundred packets before the notebook dumped.

I noticed right away that a significant portion of the capture consisted of encrypted packets aimed at one remote IP address. That seemed odd to me. Oops, all sorts of bells began to go off.

I hadn't even thought about malware possibly causing the crashes, but I can take a hint. In a degree turnaround, I did all the normal malware checks, especially making sure that the operating system Windows XP Pro and AV signatures were up to date. I ran some scans and didn't get any hits. Having been down this path numerous times, I was all set to reformat and reload, might as well just get it over with.

Being the ultimate in considerate, I called my friend and told him of my findings and possible bad news. He didn't appear to be in a rush for his notebook, mumbling something about mine working better than his. Actually, I was glad to hear that, because it took the pressure off and I really wanted to figure this out.

It didn't look good "sector MBR rootkit detected. Still I was excited because this would be my first opportunity with this sort of malware. I started searching the Internet for information about MBR rootkits.

What I learned was a bit scary needless to say. It appears putting MBR rootkit together with encrypted traffic gets you the Sinowal trojan. I also learned that RSA FraudAction Research Lab has been following the Sinowal trojan for over three years, compiling some really interesting data about it:.

Sinowal uses the normal methods to gain access to the computer being attacked. Initially most infections were via e-mail links, but it now appears that drive-by droppers, such as NeoSploit on malicious Web sites, are the attack vector of choice. Interestingly, Sinowal is selective about geographical location and incorporates an IP versus location application to focus on specific areas, and guess what, Germany is one such area.