Re: Secedit

From: Jason Ede (j.d.ede@sheffield.ac.uk)
Date: 09/04/02 

From: "Jason Ede" <j.d.ede@sheffield.ac.uk>
Date: Wed, 4 Sep 2002 16:05:47 +0100

If you know the name of the virus then take a look on McAfee or Sophos
website. It may document the virus along with what registry keys it changes.
Also even if it doesn't then if you email them they may be able to say..

Jason

"Sean" <seanmeeker@meadowburke.com> wrote in message
news:11cc201c2538f$0dcc3270$39ef2ecf@TKMSFTNGXA08...
> Thanks Rich.
>
> But that is a last resort. I assume that i can figure
> this out, but as a time saver, I was hoping to find out if
> someone knew of the exact location in the registry where
> this is located.
>
> >-----Original Message-----
> >We have seen a number of intrusion cases that used this
> trojan...We
> >recommend if customers are unsure that they wipe the box
> & reformat it.
> >Unfortunately its the only to be absolutely safe.
> >
> >Hope this helps
> >
> >Rich
> >
> >This posting is provided "AS IS" with no warranties, and
> confers no rights.
> >
> >
> >"Scott" <scott@itinerarysol.com> wrote in message
> >news:ca3d01c25368$7d197600$a4e62ecf@tkmsftngxa06...
> >> I had an IRC virus that opened the secedit window.
> >> Somehow, my shared resources are now requiring passwords
> >> (and I do not know the psw nor know how to set or remove
> >> it). If you see a brief mIRC logo appearing in the
> upper
> >> corner of your screen at startup, you may have this irc
> >> trojan virus. If so, mine was in the file taskmngr.exe
> >> (not taskmgr.exe) and it uses an nt32.ini file.
> There's a
> >> corresponding registry entry to make it run at startup.
> >>
> >> If you have the share password issue and know of or
> find a
> >> resolution, PLEASE post it. I'm not an expert, but I
> >> still have to find an answer and there's a few others on
> >> here looking for the same...
> >>
> >> thanks
> >>
> >>
> >> >-----Original Message-----
> >> >The Secedit program starts when I log in to Windows. I
> >> >have never played with this program. Does anyone know
> the
> >> >best way to view and edit the configurations. Better
> yet
> >> >is anyone aware of any current virus using this
> program.
> >> >.
> >> >
> >
> >
> >.
> >

Relevant Pages