A serious infection most antivirus apps miss

bigbazza · Nov 20, 2008

From todays' WindowsSecrets newsletter at http://WindowsSecrets.com/comp/081120

Scroll down until you find the article, Don't be a victim of Sinowal, the super-Trojan. Partial quote as follows:-

Sinowal/Mebroot works by infecting Windows XP's Master Boot Record (MBR) — it takes over the tiny program that's used to boot Windows. MBR infections have existed since the dawn of DOS. (You'd think that Microsoft would've figured out a way to protect the MBR by now — but you'd be wrong.)

Vista SP1 blocks the simplest MBR access, but the initial sectors are still programmatically accessible, according to a highly technical post by GMER, the antirootkit software manufacturer.

The key to Sinowal/Mebroot's "success" is that it's so sneaky and is able to accomplish its dirty work in many different ways. How sneaky? Consider this: Sinowal/Mebroot doesn't run straight out to your MBR and overwrite it. Instead, the Trojan waits for 8 minutes before it even begins to analyze your computer and change the Registry. Digging into the MBR doesn't start until 10 minutes after that.

Sinowal/Mebroot erases all of its tracks and then reboots the PC using the adulterated MBR and new Registry settings 42 minutes into the process.
Click to expand...

A really nasty one. Bazza

KingSteve · Nov 20, 2008

Sounds really interesting actually. Makes me wonder why people that are this intelligent do it for malicious reasons. Thanks for the info Bazza.

plodr · Nov 20, 2008

why people that are this intelligent do it for malicious reasons.
Click to expand...

To some money is more important than anything.

red death68 · Dec 5, 2008

people are screwed up there no 2 ways around it the only problem is those who are screwed up usualy have a mental problem time and time again history has shown some of the smartest ppl are both the sickest and sometimes the most unstopable

LI_Geek_95 · Dec 5, 2008

Why would someone want to make a virus. Whats wrong with people?

Log in or Sign up

A serious infection most antivirus apps miss

bigbazza R.I.P. 14/12/2011 - Good Onya Geek

KingSteve MajorGeek

plodr MajorGeek Super Extraordinaire Moderator Staff Member

red death68 Command Sergeant Major

LI_Geek_95 Post-and-Run Geek