Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just watched this malware do a man in the middle attack on one of my clients paying for a service using their credit card and cannot find any source to confirm it is in fact Sunspot so I can verify post removal process. No anti-viruses detect it! Any ideas?

share|improve this question
How did you "watch" it? Packet sniffing? – Andrew Lambert Jul 12 '11 at 8:49
Try the System Sweeper boot – Moab Jul 12 '11 at 15:14
possible duplicate of What to do if my computer is infected by a virus or a malware? – Wuffers Jul 12 '11 at 15:31
I watched the user complete the transaction they do on a monthly basis and when they did the post back another form popped exactly as described in the article. Claimed to be mastercard but image links were broken. The giveaway was it was asking for an ATM pin. I'll grab a screen shot next time. – Cameron McGrane Jul 12 '11 at 20:17
Updated title and description to "Identify" as to more accurately define the problem – Cameron McGrane Jul 12 '11 at 20:23
up vote 1 down vote accepted

I would look at the two registry keys mentioned in the article you posted, this is where it launches from.

Once installed, Sunspot is started either by "rundll32.exe" via


or via

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components. 

It uses CBT hooking to load its DLL into the browser (Internet Explorer/Firefox).

Or better yet use a browser it does not "hook", like Chrome Browser

share|improve this answer
Yeh, I checked HKCU\RUN was clear and HKLM\Install Components had too many CLSIDs and folders distinguish. What do you mean by hook? – Cameron McGrane Jul 12 '11 at 20:21
"It uses CBT hooking to load its DLL into the browser (Internet Explorer/Firefox)." Its a term use to describe injecting a process or dll into another program or process, some are legitimate, some are malware. – Moab Jul 12 '11 at 22:35
You would have to look through all the install component keys for something that does not look legitimate in the right pane, use google when needed, I have only 24 installed components in my reg key. You will be looking for a dll or path to a dll that is not legitimate windows dll. Did you try the System Sweeper I recommended? – Moab Jul 12 '11 at 22:40
I used System Sweeper which successfully removed the malware. – Cameron McGrane Aug 15 '11 at 7:36
I like that scanner boot cd, its a good one. Glad you got it… – Moab Aug 15 '11 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .