Full Disclosure mailing list archives
Re: wintcpmod.exe Hear of it?
From: Michael Holstein <michael.holstein () csuohio edu>
Date: Fri, 06 May 2005 13:09:09 -0400
Probably a <flavor_of_the_month>bot variant. Run it by Norman's sandbox and see what shakes out.
http://sandbox.norman.no/live_4.htmlTry to Un-[upx|rar|zip] it first .. Norman's website dosen't handle programs that are compressed multiple times so well (and bot-kiddies like to do just that to hide them/frustrate us).
Also .. check standard spots in the registry to see if it's set to run on startup (HKLM/Software/Microsoft/Windows/CurrentVersion/Run and RunServices).
As mentioned in another post, http://www.virustotal.com is another good spot to run it through.
Seeing the same file in those two places is fairly common bot behavior .. they want to ensure they get it at least one place that's in the $PATH.
If all else fails, a VMware guest (with Ethereal on the host O/S) is your friend.
Cheers, Michael Holstein CISSP GCIA Cleveland State Univeristy Dan Bambach wrote:
I noticed today that a program wintcpmod.exe, located in two places on my hard drive, windows\system and windows\system32 was attempting to access port 53. My firewall blocked it and sent an alert. I am on the road, so I have not had time to fully investigate this yet, but a Google search produced very little about this program. It sets a registry key for local machine “run”, and can be seen on the process screen. It does not appear in the services list. I was able to kill it, but in my Google search, someone has claimed that they were unable to kill the process. I am running WinXP SPk2 fully patched, and Symantec AntiVirus, ZoneAlarmPro. Microsoft AntiSpyware does not report anything.Has anyone else seen this program?Dan Bambach Dan () dbambach net <mailto:Dan () dbambach net>------------------------------------------------------------------------ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- wintcpmod.exe Hear of it? Dan Bambach (May 05)
- Re: wintcpmod.exe Hear of it? Michael Holstein (May 06)
- <Possible follow-ups>
- RE: wintcpmod.exe Hear of it? Todd Towles (May 06)