attention ..all HJT helpers...Wowcraft

pchelpman · 14 September 2006 at 12:05PM

Watch out for these entries in a HJT log ...

F2 - REG:system.ini: Shell=Explorer.exe 1
O4 - HKLM\..\Run: [Torjan Program] C:\WINNT\WINLOGON.EXE
O4 - HKLM\..\RunServices: [Torjan Program] C:\WINNT\WINLOGON.EXE

Be careful when you come across them.

Do NOT go in with guns blazing. You may render all .exe files inoperable.

Read Symantec's write up -

http://www.sarc.com//avcenter/venc/data/infostealer.wowcraft.d.html

There is one fix for this. Maybe more will follow but take care.

PCH

pchelpman · 14 September 2006 at 6:08PM

bump ......

woo · 14 September 2006 at 6:18PM

Link isn't working?

pchelpman · 14 September 2006 at 6:23PM

Ooops .... thanks ... link corrected.

PCH

Browntoa · 14 September 2006 at 6:32PM

oh goody, looks like a blinder !!

hopefully all the big boys products can deal with this now

pchelpman · 14 September 2006 at 9:24PM

Browntoa wrote:

hopefully all the big boys products can deal with this now

Maybe. Eventually. Meantime .. .watch out for the nasties.

pchelpman · 15 September 2006 at 1:56PM

bump......

attention ..all HJT helpers...Wowcraft

Comments

Confirm your email address to Create Threads and Reply

🚀 Getting Started

Categories

Is this how you want to be seen?

Get our FREE Weekly email full of deals & guides - and it’s spam-free