Re: New Virus/Worm

From: Ian JP Kenefick (ian_kenefick_at_eircom.net)
Date: 03/15/05

  • Next message: Ian JP Kenefick: "Re: New Virus/Worm" 
    Date: Tue, 15 Mar 2005 05:05:19 +0000

    On Mon, 14 Mar 2005 20:45:02 -0800, "Colin"
    <Colin@discussions.microsoft.com> wrote:

    >Ian,
    >
    >we have no problem stopping the process and deleting the all the wmpa36d
    >entries of which there are several. it seems to fix the problem until the
    >next day and it re-appears in the registry and task manager.
    >
    >none of the anti-virus scanners we use (nortons and mcafee) have detected
    >anything.
    >
    >I have reported it to the symantec security center.
    >
    >Colin

    You can stop and delete the processes but if they are re-appearing you
    are not disinfecting your computer properly. Please try and run
    procedure a on my website as mentioned and report back the results.
    You may also wish to send the wmpa36d.exe to scan[at]virustotal.com
    with subject 'SCAN' without the inverted commas. This will give
    analysis from multiple engines on it's reply. This malware is not new
    though. There is already one case reported on the 10th. I get this
    info from Google.

    1. Do the scan using procedure a
    2. send the file for analysis at virustotal

    Report back. 

    -- 
Regards,
Ian Kenefick
Got a virus? 
Go to www.ik-cs.com > 'Got a virus?'
  • Next message: Ian JP Kenefick: "Re: New Virus/Worm"

    Relevant Pages

    • Re: New Virus/Worm
      ... >>entries of which there are several. ... it seems to fix the problem until the ... >procedure a on my website as mentioned and report back the results. ... This malware is not new ...
      (microsoft.public.security.virus)
    • RE: Remove duplicate entry in combobox
      ... When I open the unbound form, I get the single entries as opposed to the ... This is the first time I've ever worked with combo boxes and unbound forms. ... having the report based on a query where the user had ... Destination fields but could not get it set up properly. ...
      (microsoft.public.access.formscoding)
    • Re: ReportBuilder 9.03 is now available for Delphi 2005, Delphi 7, and Delphi 6!
      ... >> - Added support for TeeChart 7.05. ... >> - Fix for RichText Editor in Delphi 2005, ... >> when the report generation process is canceled. ... >> - Modified the RAP compiler to allow the local Var and Const sections to ...
      (borland.public.delphi.thirdpartytools.general)
    • Re: Computer reboots spontaneously
      ... IOW don't try to fix anything. ... diagnostics would be on disk and on manufacturer's web site. ... But marginal hardware tends to fail ... The status report on the hard drives shows OK when the computer boots. ...
      (microsoft.public.windowsxp.general)
    • Re: when to fix , when to not to fix the vuln.
      ... Someone gave you a pentest report, or a basic tool scan report or ... fix it, or when you dont fix it? ... risk profile such that patching itself is considered a bigger risk to ...
      (Pen-Test)