Vundo Changing Again!

Seems as though our friends at virtumonde have gone a couple steps further in thrawting our attempts at removal.
Firstly they added code to change the clsid on every reboot and it is almost 100% random.
Secondly they have made a mutex that detects HijackThis’s running process hijackthis.exe and if it detects it, it hides itself from it. Renaming HijackThis.exe to any other name lets you see the BHO and Winlogon entries just fine.
Detection for this new variant, ShellImplRes.dll variant, is going to be difficult and I am currently working on it.
For the time being I have added code for manually adding a file to the list in VundoFix.exe. To add a file simply right click the list box (white box) in the main VundoFix window. Select “Add More Files?” from the menu that comes up. This will open a new VundoFix window where you can type or paste the extra filename(s), including the path, into and then click the “Add Files” button. Doing this will add the file to the list on the main VundoFix screen. Once you are done adding extra file(s) click the close window button to return to the main VundoFix window. Now continue with running vundofix in the normal way.
Atribune

Read more at atribune

Related posts:

1. Yet Another New Vundo
2. Enabling ipod disk usage
3. Workaround for KB 933245 - Lsm.exe Handle Leak
4. PCButts1 Returns…
5. New Trojan Spreading Via Email!
6. Changing privacy setting in firefox

Related posts brought to you by Yet Another Related Posts Plugin.