Re: Virtumonde, Registry Keys, User Accounts, Microsoft
- From: "Scott" <scott@xxxxxxxxxxxx>
- Date: Fri, 29 Aug 2008 15:39:39 -0700
Thanks for the answers.
Scott
Los Angeles
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:%237kGdSxBJHA.2292@xxxxxxxxxxxxxxxxxxxxxxx
From: "Scott" <scott@xxxxxxxxxxxx>
Hi Scott:
Replies are inline...
| Can you identify the originator of Virtumonde by the registry keys it
| leaves?
No. They may only identify they are realted to the malware itself/
| Would a user account prevent Virtumonde from installing? Would I get a
| notice that administrator priviliges are needed?
Not if the site that hosts the installer uses exploit code that causes a
buffer overflow
condition and a resultant elevation of privileges.
| Does Virtumonde use the Visual Basic language of Office, or something
else?
I haven't heard of it using VB.
| Will Microsoft's Malicious Software Removal Tool completely scan my
system
| independent of whether it's run from an admin or user account?
Yes.
| Can I confidently assume my XP Home desktop system is clean since Ad
Aware
| has not found anything and the August Malicious Software Removal Tool
ran
| once?
No. There is no 100% assurance. Ad-aware isn't 100% on all variants.
You would have to
also scan with other utilities such a the MalwareBytes Anti-Malware to
increase your
chaces but you won't reach 100% if it is a new and unknown variant.
| I have a notebook that connects to the desktop through a router. Can
this
| malware spread to my notebook through the router? I exchange files using
the
| Shared Documents folder.
No. It is NOT a virus and does not self replicate. The vundo form and
the Virtumond
adware assistance to get installed such as Social Engineering and
vulnerability
exploitation.
| Details.
| On Aug 5, Ad Aware found a file "yacscom.dll" it declared to be
Virtumonde.
|
| Yahoo Anti Spy found four registry keys it called hijackers.
| One is ISTbar from a company called Internet Search Technologies:
| HKLM\software\microsoft\windows\currentversion\internet
settings\zonemap\domains\contentmatch.net
| Three were from Mirar. They had the exact
| form above but with different
| domain names at the end: mirarseach.com, netnucleus.com,
| getmirar.com
| If I investigate these domains, will I get infected?
Possibly !
--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
.
- Follow-Ups:
- Re: Virtumonde, Registry Keys, User Accounts, Microsoft
- From: David H. Lipman
- Re: Virtumonde, Registry Keys, User Accounts, Microsoft
- References:
- Virtumonde, Registry Keys, User Accounts, Microsoft
- From: Scott
- Re: Virtumonde, Registry Keys, User Accounts, Microsoft
- From: David H. Lipman
- Virtumonde, Registry Keys, User Accounts, Microsoft
- Prev by Date: Re: Antivirus 2008/2009
- Next by Date: Re: Antivirus 2008/2009
- Previous by thread: Re: Virtumonde, Registry Keys, User Accounts, Microsoft
- Next by thread: Re: Virtumonde, Registry Keys, User Accounts, Microsoft
- Index(es):
Relevant Pages
|
