|
Posted by Leythos on November 4, 2008, 2:41 pm
Please log in for more thread options
GavTelinBCCA@discussions.microsoft.com says...
show/hide quoted text
> Have SMTP Trojan embedded that uses svchost PID 560 or 432 opens ports UDP
> 3001, TCP 3002,3,4 and attaches either to RpcSs or Services and evades all
> Rootkit finders and Virus scanners. Shows up in Process Explorer and Open
> ports scanner. Have ripped registry apart looking for clues. Starts by
> downloading on port 443 from 195.190.13.198 writes to readable area in
> HKLM\Software that has key a5 and contains code. destroy it and it is
> replaced. Also writes to software hive and software.bak.tmp . Malicious Tools
> scans clean, as do all Spyware scanners. McAfee no help either. Sysinternals
> shows it all happen using registered Microsoft components. This thing is in
> the registry and can be stopped....
>
> I just want to find how this was done as I've tried everything
Have you tried these two antimalware tools?
These sites are for downloading Anti-Malware and Anti-Spyware tools, in
order that I would use them myself:
Dave Lipman's tools:
Download MULTI_AV.EXE from the URL --
(this is a non-english site, but it's a great tool)
http://www.pctipp.ch/downloads/dl/35905.asp
MalwareBytes Anti-Malware
From http://www.bleepingcomputer.com/
http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe
--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)
| 
XML Sitemap
> 3001, TCP 3002,3,4 and attaches either to RpcSs or Services and evades all
> Rootkit finders and Virus scanners. Shows up in Process Explorer and Open
> ports scanner. Have ripped registry apart looking for clues. Starts by
> downloading on port 443 from 195.190.13.198 writes to readable area in
> HKLM\Software that has key a5 and contains code. destroy it and it is
> replaced. Also writes to software hive and software.bak.tmp . Malicious Tools
> scans clean, as do all Spyware scanners. McAfee no help either. Sysinternals
> shows it all happen using registered Microsoft components. This thing is in
> the registry and can be stopped....
>
> I just want to find how this was done as I've tried everything