Security Incidents mailing list archives
wmon16.exe
From: "Jason High" <strongcypher () hotmail com>
Date: Mon, 10 May 2004 09:02:50 -0400
I believe that I have a HUGE problem, and I can't find anything anywhere. Here are our symptoms:
- C:\winnt\system32\wmon16.exe appeared and began running (no idea what it is or does) - hosts file was altered to redirect antivirus sites to 127.0.0.1 (similar to Trojan.QHOST but nothing else matches
- disables antivirus- creates lots of connections to network computers using microsoft-ds and netbios ports
I am completely lost. No removal tools have worked, no A/V is picking it up. I've got about four hosts with these symptoms (so far) and I'm just unplugging network cables at this point. Anyone with any pointers?
Jason E. High,RHCT,GSEC,MCP http://www.alwaysright.org _________________________________________________________________FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.com/go/onm00200415ave/direct/01/
--------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- wmon16.exe Jason High (May 10)
- Re: wmon16.exe Peter Kosinar (May 10)
- Re: wmon16.exe Harlan Carvey (May 10)
- Re: wmon16.exe KUIJPERS Jimmy (May 10)
- Re: wmon16.exe Nick FitzGerald (May 10)
- RE: wmon16.exe Ken Dunham (May 11)
- <Possible follow-ups>
- RE: wmon16.exe Meidinger Chris (May 10)
- RE: wmon16.exe Levinson, Karl (May 10)
- RE: wmon16.exe lsi (May 11)
- Re: wmon16.exe Willem Tahon (May 11)
- Re: wmon16.exe Nick FitzGerald (May 11)
(Thread continues...)