Results 1 to 6 of 6

Thread: Virtumonde.sdn

  1. #1
    Junior Member
    Join Date
    May 2008
    Posts
    8

    Default Virtumonde.sdn

    The last two weeks, after updating with the latest definitions, at the conclusion of a scan Spybot reports a Virtumonde.sdn infection, as follows:

    Virtumonde.sdn: [SBI $4F0ABAF2] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PFW

    I suspect that this may be a false positive, but would appreciate help from those in the know. If it's not a false positive, what steps should I follow to fix the problem?

    OS: Windows XP SP3 Professional
    Browser: IE6
    Spybot: 1.6.0.30
    Latest definitions Update: 28 April 2010
    Report appeared following a routine scan

    Regards,

    John

    Image of the Registry key involved is attached:
    Last edited by marjohnau; 2010-04-29 at 02:57.

  2. #2
    Senior Member
    Join Date
    Oct 2005
    Location
    Germany
    Posts
    5,263

    Default

    Hello,

    You seem to be using a dated version of Spybot-S&D.
    Please uninstall Spybot - Search & Destroy according to the following link.
    Then download our current version Spybot - Search & Destroy 1.6.2.
    You will find links to several download locations for this new version on our web site.

    Best regards
    Sandra
    Team Spybot

  3. #3
    Senior Member Yodama's Avatar
    Join Date
    Oct 2005
    Location
    Buchenheim
    Posts
    1,110

    Default

    hello John,

    please look for the following file on your computer: UmxWnp.dll
    the Virtumonde.sdn detection your receive is connected to this file.

    If you find the file please send it to detections@spybot.info along with a full Spybot S&D report file for analysis.

    If you do not find the file you can safely fix the item Spybot S&D finds.


    Please also consider upgrading your Internet Explorer to the current version. The Internet Explorer 6.0 is very outdated and very vulnerable, it is also not compatible to common web standards.
    born in the shadow to die in the shadow, that is the fate of the shinobi

    Spybot S&D Downloads

    Please help us improve Spybot and download our distributed testing client.

  4. #4
    Junior Member
    Join Date
    May 2008
    Posts
    8

    Default

    Yodama,

    Thanks to both you and Sandra for your replies to my post.

    I have taken Sandra's advice and installed version 1.6.2; following that I downloaded the latest updates etc. and then did a scan.

    Once again Spybot reported a Virtumonde.sdn infection, so I searched for and found the file UmxWNP.dll; I have sent it with the log file to the address provided.

    Looking forward to receiving the results of the analysis.

    Regards,

    John

    PS. I'll also take your advice regarding upgrading IE to the latest version, but it will have to wait a *little* longer.

  5. #5
    Senior Member Yodama's Avatar
    Join Date
    Oct 2005
    Location
    Buchenheim
    Posts
    1,110

    Default

    Thanks for your feedback and for sending in the requested file.
    I can confirm that it is a false positive.
    The next detection update will correct this issue, you can also exclude this false positive from further searches as described in the email reply.
    born in the shadow to die in the shadow, that is the fate of the shinobi

    Spybot S&D Downloads

    Please help us improve Spybot and download our distributed testing client.

  6. #6
    Junior Member
    Join Date
    May 2008
    Posts
    8

    Default

    Yodama,

    Thanks to you, and all involved, for the prompt analysis of the file, and for the confirmation that it is a false positive.

    Appreciate your friendly and helpful service.

    Regards,

    John

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •