030 igetnet ignkeywords

From: Waitman C. Gobble (waitman@emkdesign.com)
Date: 11/11/02

From: "Waitman C. Gobble" <waitman@emkdesign.com>
To: incidents@securityfocus.com
Date: 10 Nov 2002 19:02:17 -0800


I have found more information regarding my original 030.com post.

The machine that is infected is running Windows XP Professional with all
service packs and hotfixes.

Additionally, it is running Norton Antivirus 2003 with the latest
database, and the machine checks clean.

There is a file running on boot:

C:\WINDOWS\WinStart.exe (the date of this file is November 11, 2002)

The file properties indicate that it originates from IGetNet, LLC. The
whois information shows that this is the owner of ignkeywords.com

Also, this file exists: C:\WINDOWS\prefetch\WINSTART.EXE-2C11637C.pf.

It's date and time reflect the last time the machine was booted. Please
note that I am not sure what this file is, but it seems to relate.

The machine now seems to go to ignkeywords.com, however sometimes it
goes to 030.com, which is what we originally observed.

The WinStart file is labelled as a "Browser Upgrade" in the file
properties thingy.

Thanks and Best

Waitman Gobble
EMK Design
Buena Park, California

This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com