Just a brief synopsis of the infected files found would suffice
Thank you essexboy and Dim@rik,
So my first hunch about this was right, now some remarks on the Anubis report on this heuristic trojan, the find is rather new because I cannot get further resources on the MD5 hash 923c9a67b56577cfdab6da42b39c9bc1 as I google for it. Also 1 result here: https://www.vicheck.ca/md5query.php?hash=923c9a67b56577cfdab6da42b39c9bc1
The Internet Explorer browser is more vulnerable to this packed.win32.trojan than other browsers seem to be.
We see a remote weakness in IIS in ntdll.dll used, kernel32.dll CAN be infected by several different kinds of virus like here, the legitimate advapi32.dll is being removed in backdoor trojans as this.
Run-time dll info: non-system processes like avifile32.dll originate from this software/malware you mistakenly have installed on your system.
As most applications store data in your system’s registry, it is likely that your registry has suffered fragmentation and accumulated harmful error.
Registry keys created show rogue spyware characteristics probably from Russia: HKU\S-1-5-19\Software\Bjpvumvmug; C:\WINDOWS\system32\avifile32.dll makes that the trojan won’t be removed
and explorer shuts down.
- fsharproj\PersistentHandler (Default) is a quality the malware shares with vundo malware etc. TSUserEnabled works elevation for remote access,
and we’ll find particular attack code here: “C:\WINDOWS\system32\619102996”
and finally Device\KsecDD provides a block device interface to a file,
Good that that was all now cleansed from your machine, and seems to be history now,
polonus
Hi forum friends,
Can now inform you all avast is detecting this as: Win32:Tracur-BY [Trj]
See updated version of VT scan here: http://www.virustotal.com/file-scan/report.html?id=77c2e0d82ecadc0c6ef3454c11b5543379bea6ad50256a986871ca4dda5c2ec9-1311456228
polonus
Phew, I’m glad it is off my laptop. Thank again!