Tech Support Forum - View Single Post - Sinowal Trojan

Mountainman1863 · 11-01-2008, 02:01 PM

This is a bad one, very recently reported, and for which there are no easy removal techniqies yet, unless you believe reformatting your drive isn't too bad. It rests in the MBR (master boot record) of your boot drive until it is called upon by your 'securely' connecting with one of the programmed financial sites. Then it installs false text blocks requesting sensitive info, and once you've entered that (it's your bank, your account, and the yellow lock shows, right?), guess who its sends that data to? Not to your account. Further, it morphs into new signatures, I believe, possibly automatically or on interrogation by the perpetrators. Reportedly only a few antivirus programs can detect it and none can remove it. I got all this info from several sites reporting it last night.

I'd suppose many organizations are working on detection and removal techniques. Anyone here have some insight into what can be done now?

11-01-2008, 02:01 PM	#1 (permalink)
Mountainman1863 Registered User Join Date: Dec 2007 Location: Syracuse Posts: 57 OS: XP Pro SP2 (both machines)	Sinowal Trojan - How to detect it This is a bad one, very recently reported, and for which there are no easy removal techniqies yet, unless you believe reformatting your drive isn't too bad. It rests in the MBR (master boot record) of your boot drive until it is called upon by your 'securely' connecting with one of the programmed financial sites. Then it installs false text blocks requesting sensitive info, and once you've entered that (it's your bank, your account, and the yellow lock shows, right?), guess who its sends that data to? Not to your account. Further, it morphs into new signatures, I believe, possibly automatically or on interrogation by the perpetrators. Reportedly only a few antivirus programs can detect it and none can remove it. I got all this info from several sites reporting it last night. I'd suppose many organizations are working on detection and removal techniques. Anyone here have some insight into what can be done now?