dumador keylogger protection?

Discussion in 'NOD32 version 2 Forum' started by webyourbusiness, Aug 12, 2005.

Thread Status:
Not open for further replies.
  1. webyourbusiness

    webyourbusiness Registered Member

    Last edited: Aug 12, 2005
  2. rothko

    rothko Registered Member

    thanks for the info, greg.

    to quote from the abcnews article:

    The Srv.SSA-KeyLogger is so new, says Sunbelt, that few antivirus vendors have developed definitions to remove the threat from infected machines. Srv.SSA-KeyLogger appears to be a variant of existing forms of keystroke-stealing Trojan Horses, called Dumador or Nibu.

    if nod32 detects dumador, will it definately detect srv.ssa-keylogger?
     
  3. lotuseclat79

    lotuseclat79 Registered Member

    Checking the Trend Micro Whatsnew files for PC-Cillin updates I have received, it appears that PC-Cillin Internet Security 2005 has had dumador protection since Aug 7th.

    -- Tom

    P.S. Went back to check earlier files and Trend Micro has been protected since 11/26/2003 in update 690 from BKDR_DUMADOR.A, and up to 8/8/2005 for update 2-763 from BKDR_DUMADOR.AN, BKDR_DUMADOR.AX.
     
  4. rothko

    rothko Registered Member

    but the threat in the article is Srv.SSA-KeyLogger, just because the variants are in the signature database does that mean this one is definately protected against?
     
  5. Detox

    Detox Retired Moderator

    That's nice, but I'm pretty certain that the post is about Srv.SSA-KeyLogger - which is a new variant of the older "dumador" threats you are posting about.
     
  6. Detox

    Detox Retired Moderator

    Hm I had read the first post incorrectly myself :oops:

    I see tons of "dumador" entries but can't find an SSk - but then Eset might have called it dumador.something like the other older versions o_O I dunno.
     
  7. webyourbusiness

    webyourbusiness Registered Member

    it's actually a good point - that ssa.keylogger MIGHT not be detected explicitly in signatures, but heuristics should (yes - should), detect it as unknown pe. Perhaps someone in Eset can confirm...

    if you think you mis-read my OP - you might not have - I did have it posed as a question, as I was mis-typing dumador when I was searching at first... ;)
     
  8. rothko

    rothko Registered Member

    yeah i'd really like to know the answer to this too :)
     
  9. rothko

    rothko Registered Member

    hiya, anyone have an answer to this? :) thanks, lee
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice