<CT> Re: W32.BugBear@mm email trojan

  • From: Gaby.Chaudry@xxxxxxxxxxx (Gaby Chaudry)
  • To: calmira_tips@xxxxxxxxxxxxx
  • Date: Wed, 9 Oct 2002 20:18:47 +0200

Reid,

> Er, uh Glenn, Gaby, what are the symptoms of this particular worm? 

I can only tell you how you can detect it manually: It generates an 
EXE file (about 50k in size) with a random 4 letter name and copies it 
to the system directory. There'll also be a registry key in 
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current 
Version/RunOnce which launches this exe file. As for the symptoms, 
look here: http://vil.nai.com/vil/content/v_99728.htm

> loss.  I doubt I'm infected.  I'm using XP Pro SP-1.

Does it run Calmira? ;-)

Anyway, there must be somebody in this list who *is* infected....

Bye, Gaby



--
press any key to continue or any other key to quit
--
To unsubscribe, send a message to ecartis@xxxxxxxxxxxxx with
"unsubscribe calmira_tips" in the body.
OR visit http://freelists.org



Other related posts: