Re: NetDevil - ADVAPI

From: Ian Kenefick (ian_kenefick_at_eircom.net)
Date: 01/22/05 

Date: Sat, 22 Jan 2005 00:15:17 +0000

On Fri, 21 Jan 2005 15:53:03 -0800, "bclay"
<bclay@discussions.microsoft.com> wrote:

>Every reference with a Google search for ADVAPI came up with the Netdevil
>virus. A subsequent Technet search found one hit - apparently ADVAPI is a
>Kerberos component in AD.
>
>The massive logon attempts, still disconcerting.

The massive login attempts are explained by the fact that netdevil is
a RAT - Remote Access Trojan. Can you capture a sample and send for
analysis to your AV vendor? If you can, do this! - and for an instant
analysis send it to scan[at]virustotal.com with subjectline 'SCAN'
without the inverted commas (replace [at] with @).

Post back with results!

Regards,
Ian Kenefick
http://www.IK-CS.com