Re: Workstations trying to GET /download/IEService215.chm HTTP/1.1 fr om

From: Ronaldo C Vasconcellos (
Date: 07/11/04

  • Next message: Paul Schmehl: "Re: Workstations trying to GET /download/IEService215.chm HTTP/1.1 from"
    Date: Sun, 11 Jul 2004 10:37:30 -0300 (BRST)

    On Fri, 9 Jul 2004, Humes, David G. wrote:

    > Starting around July 8th we noticed workstations trying to access
    > on port 80 and do a
    > GET /download/IEService215.chm HTTP/1.1
    > Analysis of the users' browsing activity did not reveal any pattern that
    > would suggest that the activity was user-initiated. We suspect that this is
    > something trying to "phone home", but not sure quite what. A reverse lookup
    > of the IP just returns, and whois just tells me
    > that it belongs to XO. Has anyone else seen this and know what it is?

    A few more info about this file:

    . File type: MS Windows HtmlHelp Data (according to the latest version of
    . MD5 checksum is e47db712c8684bd5be91de20e6650993
    . Identified as TrojanDownloader.VBS.Psyme.ak by Kaspersky 3.0 and Sybari
       7.5.1314 (thanks to

    PestPatrol - TrojanDownloader.VBS.Psyme

    Symantec Security Response - Downloader.Psyme


    [1] file - determine file type

  • Next message: Paul Schmehl: "Re: Workstations trying to GET /download/IEService215.chm HTTP/1.1 from"

    Relevant Pages

    • Re: Midi and Wav file wont play
      ... David, try the experts at ... > I have tried everything as you suggested and also uninstalled Real Player ... > made Window Media Player the default player. ... >> partial ownership of the file type. ...
    • Re: Registerprincipinst√§llningen?
      ... David - here's a link to the solution in Swedish ... Sandy - you did understand perfectly! ... "You are attempting to open a file type that is blocked by your registry ... Du försöker spara en filtyp som blockeras av ...
    • Re: setup associate application with file type
      ... I have tried it but the "Always" checkbox is disabled. ... In which, client user is ... David ... >> I can not change the associated application with file type. ...
    • RE: power point viewer, sp2
      ... published any stats on post SP2 install malfunctions? ... "david" wrote: ... > panel/folder types and create an association. ... > power point is still shown as the program for that file type and the file ...
    • RE: exporting report from Access to Excel
      ... switch the file type to excel ... "David" wrote: ... we're brand new users of Access. ...