RE: New Win32 Worm regsvc32.exe offers rootkit features

["Aditya, ALD [Aditya Lalit Deshmukh]" <aditya.deshmukh () online gateway technolabs net>]

> Looks like IRC Backdoor
> check registry:
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run and delete 
> entry with regsvc32.exe
> (such as Registration Service = "regsvc32.exe")
> Do the same with 
> HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices


the port 1025 is good used for binding the task schuduler, is this doing something with the task schuduler.  there are 
plenty of naughty things to do there ....

-aditya


________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html