Re: strange software > winsupdater.exe

[Mike Barushok <barushok () keycreations com>]

I found this:
 http://sandbox.norman.no/live_5.html?logfile=105241&menulang=

With details including:
Report created: 03.03.2005 15:52:11 

Automatic Sandbox analysis of unknown malware (W32/Malware)
[ General information ]
* **Locates window "NULL [class mIRC]" on desktop.
* File length: 130048 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM\winsupdater.exe.
* Deletes file 1.

[ Changes to registry ]
* Creates value "Windows pack service"="winsupdater.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
* Creates value "Windows pack service"="winsupdater.exe" in key 
"HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices".
* Creates key "HKCU\Software\Microsoft\OLE".
* Sets value "Windows pack service"="winsupdater.exe" in key "HKCU\Software\Microsoft\OLE".
* Sets value "restrictanonymous"="" in key "HKLM\System\CurrentControlSet\Control\Lsa".

  (character between quotes, after equals sign, could not be pasted)


[ Network services ]
* Looks for an Internet connection.
* Connects to "box1.servepics.com" on port 5525 (TCP).
* Connects to IRC Server.
* Attempts to delete share named "IPC$" on local system.
* Attempts to delete share named "ADMIN$" on local system.
* Attempts to delete share named "C$" on local system.
* Attempts to delete share named "D$" on local system.

   (there is more, I did not quote the entire page, since I would not want
    anyone quoting an entire page of mine without permission).

Hope this helps.

On Tue, 15 Mar 2005, SDA wrote:

> Hi:
>
> We are looking at an abnormal program named "winsupdater.exe" and we are
> having trouble installing antispyware software on the infected computers,
> and the antivirus is not detecting the malware.
> We were able to disable it manual trough regedit, were it leaves a key entry
> in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run named
> "Microsoft Window Updater", but anyone knows if this is a new virus or
> spyware?
>
> Esteban Lara
> Director de IT
> Soluciones Digitales de Almacenamiento S.A.

--

Mike Barushok
Senior Security Administrator
KeyCreations.com/KCISP.net/ispKansas.com