How to detect the Sinowal trojan?

here is info concerning your question.

http://www.f-secure.com/v-descs/trojan-psw_w32_sinowal_cp.shtml


Glenn

"With PSW trojans etc, you won't really know just how much the pc have been compromised, if it was my pc I would just reformat and start again and change all passwords that have been used in the infected pc(using another clean pc if possible) and of course check with your bank."

Would Combofix, SFix and MBAM identify Sinowal by name, so I can justify a reformat.

Thanks for the ThreatExpert link - does Sinowal always make the same changes to the Registry and, if so, would it be sufficient to check these on a suspicious computer?

mikeabc27: Kaspersky 30-day free trial with identify by name.

www.kaspersky.com

Hope it helps,

-kaddict

sorry, with = will identify by name.

>>>Would Combofix, SFix and MBAM identify Sinowal by name<<<
Combofix detects and removes the service/driver and legacy keys and files but won't identify it by name 'sinowal'

Combofix deleted service and legacy
-------\Legacy_{BEE686B9-4C84-4487-9D72-9F40F051E973}
-------\Service_{BEE686B9-4C84-4487-9D72-9F40F051E973}

Hijackthis entry:
O23 - Service: {bee686b9-4c84-4487-9d72-9f40f051e973} - Unknown owner - C:\WINDOWS\System32\svchost.exe


This one has more registry keys and values.
http://www.threatexpert.com/report.aspx?uid=edf8549a-94e2-4493-a31d-6bd1205d1f5b

Kaspersky 30-day free trial will identify by name."

Thanks Kaddict - I do find Kaspersky really slow on an infected PC - evaluation version anyway.

"Combofix detects and removes the service/driver and legacy keys and files but won't identify it by name 'sinowal'

Combofix deleted service and legacy
-------\Legacy_{BEE686B9-4C84-4487-9D72-9F40F051E973}
-------\Service_{BEE686B9-4C84-4487-9D72-9F40F051E973}

Hijackthis entry:
O23 - Service: {bee686b9-4c84-4487-9d72-9f40f051e973} - Unknown owner - C:\WINDOWS\System32\svchost.exe "

Thanks for pointing me in the right direction. Once the keys have been removed would you still recommend a reformat? Obviously, all passwords would changed on a clean machine.

</P>

</P>

Hi back,

It would be "the safest way" to format,
And it should be ok without formatting but there's always a risk with such powerful trojans.

If you reboot and scan again with the tools that found / repaired and find nothing it'll soothe your mind but always remember that there's a risk.

About Kaspersky being slow, of course a powerful solution uses some more power then none or something "less powerful" but on my computer (dual core, 4gb ram, vista) I can game without noticeable lag. Maybe its just because the computer ain't very powerful, and maybe because you start with some infection that causes slowdowns too.

happy to hear it helped!

-kaddict

Thanks

>>>Once the keys have been removed would you still recommend a reformat? <<<
Once the pc is clean, and passwords changed it should be alright. Suggestion of reformatting is just a pre-caution as it's a helper's responsibility to inform the user on pcs infected with PWS trojans.

Thanks!