Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I just watched this malware do a man in the middle attack on one of my clients paying for a service using their credit card and cannot find any source to confirm it is in fact Sunspot so I can verify post removal process. No anti-viruses detect it! http://www.net-security.org/malware_news.php?id=1719 Any ideas?

share|improve this question
How did you "watch" it? Packet sniffing? – Amazed Jul 12 '11 at 8:49
Try the System Sweeper boot disc....connect.microsoft.com/systemsweeper – Moab Jul 12 '11 at 15:14
possible duplicate of What to do if my computer is infected by a virus or a malware? – Wuffers Jul 12 '11 at 15:31
I watched the user complete the transaction they do on a monthly basis and when they did the post back another form popped exactly as described in the article. Claimed to be mastercard but image links were broken. The giveaway was it was asking for an ATM pin. I'll grab a screen shot next time. – Cameron McGrane Jul 12 '11 at 20:17
Updated title and description to "Identify" as to more accurately define the problem – Cameron McGrane Jul 12 '11 at 20:23

1 Answer

up vote 1 down vote accepted

I would look at the two registry keys mentioned in the article you posted, this is where it launches from.

Once installed, Sunspot is started either by "rundll32.exe" via

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

or via 

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components.

It uses CBT hooking to load its DLL into the browser (Internet Explorer/Firefox).

Or better yet use a browser it does not "hook", like Chrome Browser

share|improve this answer
Yeh, I checked HKCU\RUN was clear and HKLM\Install Components had too many CLSIDs and folders distinguish. What do you mean by hook? – Cameron McGrane Jul 12 '11 at 20:21
"It uses CBT hooking to load its DLL into the browser (Internet Explorer/Firefox)." Its a term use to describe injecting a process or dll into another program or process, some are legitimate, some are malware. – Moab Jul 12 '11 at 22:35
You would have to look through all the install component keys for something that does not look legitimate in the right pane, use google when needed, I have only 24 installed components in my reg key. You will be looking for a dll or path to a dll that is not legitimate windows dll. Did you try the System Sweeper I recommended? – Moab Jul 12 '11 at 22:40
I used System Sweeper which successfully removed the malware. – Cameron McGrane Aug 15 '11 at 7:36
I like that scanner boot cd, its a good one. Glad you got it removed....superuser.com/questions/100360/… – Moab Aug 15 '11 at 15:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.