Security Incidents mailing list archives
RE: wmon16.exe
From: Meidinger Chris <chris.meidinger () badenit de>
Date: Mon, 10 May 2004 17:41:53 +0200
Those symptoms sound exactly like some variant of agobot/phatbot. info: http://www.sophos.com/virusinfo/analyses/w32agobotlb.html http://www.sophos.com/virusinfo/analyses/w32agobotrg.html there are lots of variants, and it will probably not be fun to clean. If you are not patched, I would probably turn off your switches at this point. As far as the name, the best I can find is this, nothing concrete: http://anticode.antionline.com/download.php?op=geninfo&did=35122 Good lunk, feel free to mail if you want to talk, Chris
-----Original Message----- From: Jason High [mailto:strongcypher () hotmail com] Sent: Monday, May 10, 2004 3:03 PM To: incidents () securityfocus com Subject: wmon16.exe I believe that I have a HUGE problem, and I can't find anything anywhere. Here are our symptoms: - C:\winnt\system32\wmon16.exe appeared and began running (no idea what it is or does) - hosts file was altered to redirect antivirus sites to 127.0.0.1 (similar to Trojan.QHOST but nothing else matches - disables antivirus - creates lots of connections to network computers using microsoft-ds and netbios ports I am completely lost. No removal tools have worked, no A/V is picking it up. I've got about four hosts with these symptoms (so far) and I'm just unplugging network cables at this point. Anyone with any pointers? Jason E. High,RHCT,GSEC,MCP http://www.alwaysright.org _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.com/go/onm00200415ave/direct/01/ -------------------------------------------------------------- ------------- -------------------------------------------------------------- --------------
--------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- wmon16.exe Jason High (May 10)
- Re: wmon16.exe Peter Kosinar (May 10)
- Re: wmon16.exe Harlan Carvey (May 10)
- Re: wmon16.exe KUIJPERS Jimmy (May 10)
- Re: wmon16.exe Nick FitzGerald (May 10)
- RE: wmon16.exe Ken Dunham (May 11)
- <Possible follow-ups>
- RE: wmon16.exe Meidinger Chris (May 10)
- RE: wmon16.exe Levinson, Karl (May 10)
- RE: wmon16.exe lsi (May 11)
- Re: wmon16.exe Willem Tahon (May 11)
- Re: wmon16.exe Nick FitzGerald (May 11)
- RE: wmon16.exe lsi (May 11)
- Re: wmon16.exe Willem Tahon (May 11)