Confirmed: Virtumonde detected in C:\windows\system32\zipfdr.dll

[eki77]

Hi everyone!

Spybot detected Virtumonde on my system (Vista) in the directory C:\windows\system32\zipfdr.dll. I can delete the infection but after system restart spybot finds Virtumonde again in the same folder.
However i do not have any problems (e.g. system slowdown, pop-ups etc.) so far.

So could this be a false alarm?!

Thx for your advice

 

[eki77]

Oops! I misspelled the path.
Should be C:\windows\system32\zipfldr.dll

 

[tashi]

Hi there,

How to report False Positives

Cheers.

 

[spybotsandra]

Hello,

You seem to be using a dated version of Spybot-S&D.
Please download our current version Spybot - Search & Destroy 1.6.2. That should fix it.
You will find links to several download locations for this new version on our web site:
http://www.safer-networking.org/en/mirrors/index.html

Best regards
Sandra
Team Spybot

 

[eki77]

Hi Sandra!

You were right! Just installed the actual version and now the problem is solved.

Thx al lot and greetings from Vienna,

Eki

 

[Malloc]

Same problem here. I only have it on a few random computers while others with the same older versions (1.5.2.20) don't report the same dll. Any chance that a new update file with the older version will stop reporting this or is the only solution to upgrade? I'll eventually get to all of the machines to upgrade, but getting calls from several people asking about it.

 

[Yodama]

You should upgrade. Spybot S&D 1.5.2 is outdated an less effective against current threats than the current version 1.6.2.