5 replies to this topic

[Maurice Naggar]

Hello,

I have posted at Malware-research and thought I'd post here as well, to see if your researchers have more info on a new trojan.

I have an OP at Aumha.net Malware Removal forum with something quite similar (if not the same) to Trojan WinNT/Alureon , which was tagged and removed by MBAM.
These files were found:
gaopdxsrrytwpm.dll
gaopdxtnsxcebw.sys

My question is whether the "GAOPDX" in the root of filename is significant to this infector ?
Also, if your researchers have more info on these files or filetypes?

snippets from MBAM log

Quote

Folders Infected:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\freshplay (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\System32\gaopdxsrrytwpm.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\gaopdxtnsxcebw.sys (Trojan.Agent) -> Quarantined and deleted successfully.

REF http://aumha.net/viewtopic.php?f=30&t=...=212631#p212631

~~ Added notes ~~

I found some very helpful notes on McAfee
http://vil.nai.com/v...nt/v_154186.htm

and yes, the prefix "gaopdx" IS significant
The dll file was paired with a driver.

[lkpederson]

Windows Malware remover is finding winnt/alureon.c but the latest version of MB is not. Having trouble getting the little sucker out of there. Ideas?

[Maurice Naggar]

If you believe your system has malware, then see and follow the instructions here
I'm infected - What do I do now?

Good luck.

[Fatdcuk]

lkpederson,

Some variants of the CLB Rootkit infection have MBAM blacklisted so either we are unable to install or in somecases can install but not update the software database inorder to attack the infection.

Here's a walkthrough i knocked up for attacking the CLB driver infection and how to get MBAM back into the fight
http://www.malwareby...showtopic=12709

Hi Maurice,

They are from the same family of RK infections with the following prefix's TDSS,Seneka and UAC
Microsoft classifyfies them as WinNT.Alureon because they are RK type
The payload bots are classified as Win32.Alureon
http://www.microsoft.com/security/portal/S...winNT%2FAlureon

[Maurice Naggar]

Fatdcuk, on Apr 14 2009, 05:52 PM, said:

lkpederson,

Hi Maurice,

They are from the same family of RK infections with the following prefix's TDSS,Seneka and UAC

Hello Ade,
Yes, thanks. I got some clues a day or two after initial post.