CastleCops® - Sunbelt updates Counterspy to thwart the vicious keylogger

Sunbelt's Patrick Jordan in an earlier article discovered a heinous CoolWebSearch ID Theft Ring. Today, Alex Eckelberry updates netizens with more details. This keylogger is coined "Srv.SSA-KeyLogger": is a backdoor program that, among other things, secretly steals data from users’ internet sessions, including logins and passwords from online banking sessions, eBay, PayPal, and other programs that use html forms to collect personal information. It is a new variant of a family of existing trojans generally known as Dumaru or Nibu.

So far, the earliest known infected hijackthis log is from Dec 20, 2004. See this post with winldra.exe. More information can be found in this startup entry (with references to Symantec and Sophos).

Quote: – It runs under Internet Explorer (IE), so it is generally undetectable by a software or hardware firewall. So much for my ranting about the need to run a software firewall.

A typical practice with Zone Alarm is to set a Prompt flag on Internet Explorer (and other browsers) when it tries to access the Net. There have been malware applications in that past that would launch a new parent ID instance of Internet Explorer which would gain outside access because users typically "trust" IE in their firewall. With Zone Alarm, setting it to Prompt on new IE instances will prevent that from occuring without gaining the users permission first. No more transparent net access riding on a new IE process ID. We do not know at this time if that is the case with winlrda.exe, or if somehow winlrda.exe is gaining entry to an existing IE process connection which is authorized external access.

Alex continues in his blog:

Protecting yourself against this keylogger: On Thursday, Sunbelt will be offering a free detection and removal tool on its website specifically targeted at this keylogger.

As an alternative, users can immediately download the two week trial version of CounterSpy, which provides free scanning and remediation for this keylogger and a large number of other spyware threats.

Visit the official Counterspy forums for details.

Note: As the story unfolds and more information is made available, Sunbelt quote: "This keylogger is not CoolWebSearch. It was discovered during a CoolWebSearch (CWS) infestation, but it actually is its own sophisticated criminal little trojan that's independent of CWS. "


	2002-2008 © Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 183ppm 0.184s (0.019s) Making cybercriminals unhappy since 2002*