Anti Rootkit Blog

Users who recently downloaded a program to help them calculate rackback on previously played poker hands have had their PC infected with malicious files and a rootkit. The program called Rackback Calculator with a filename of RBCalc.exe was downloaded from a well known and legitimate website called Checkraised.com. Checkraised.com had employed an external programmer to create the program for them. The programmer would email the program into Checkraised and they put it up on their website. Checkraised were informed by a third party that malware existed in the RBCalc.exe. On inspection of RBCalc.exe it was found that it held piece of malware that would retrieve the usernames and password for the users pokersites including Partypoker, Empirepoker, Eurobetpoker and Pokernow from the users PC. It also included the functionality for the attacker to gain access to the users computer remotely. The attacker would then play poker against himself and the infected user would lose all their money to the attacker in their absence.

What was unique about this attack is that RBCalc.exe also included a rootkit to hide the existance of the files that the attacker was using on the PC. What the attacker didnt realise is that the very presence of a rootkit indicated that malicious files were more than likely present.

Poker players who have used any version of RBCalc.exe are advised to delete the program. Even poker players who have not used RBCalc.exe should still follow the procedure below as they may have been infected by other methods or software.

Open up your C:\Windows\System32\ directory. Look for the following files.

\WINDOWS\system32\d3dclsrv.dll
\WINDOWS\system32\ndsdavsrv.sys
\WINDOWS\system32\comclg32.dll
\WINDOWS\system32\utlsrv.exe
Please note that these files have VERY similar names to system files needed by Windows. This is because they want you to believe these files are important. You are only infected if these file names are EXACTLY the same as above.

If you notice these files then it is safe to assume you are infected. To remove these please delete the following:

\WINDOWS\system32\d3dclsrv.dll
\WINDOWS\system32\ndsdavsrv.sys
\WINDOWS\system32\comclg32.dll
Then open the registry (START > RUN > type ‘regedit’). In the folder view on the right please open up the following path:

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ndsdavsrv
In that folder you will see the following:

ImagePath=\??\C:\WINDOWS\System32\ndsdavsrv.sys . Please delete this entry.
Reboot your machine.
Go back to the registry (START > RUN > type ‘regedit’) and open the following path:

HKEY_LOCAL_MACHINE\ Software\Microsoft\Windows\CurrentVersion\Run

You will see the following key.

Comclg32=C:\WINDOWS\System32\utlsrv.exe /Comclg32.dll

Please delete that entry.
Now bring up your Task Manager (CTRL+ALT+DEL, click the Processes tab). Look for the program utlsrv.exe and right click on it and select End Process.
Open the C:\Windows\System32 folder and find the file utlsrv.exe. Delete it.
Poker players should then change all their passwords for any poker site they use.

Keep Safe

regards
Steo
www.antirootkit.com