Virus ?

[Hick22]

Recieved the following email today... Unable to find anything about this on the web inc. mcafee, sophos etc. so if anyone can shed any light on the following please ?

Many Thanks

We have 2 clients who have reported serious problems which are pointing towards a brand new virus.

Here are the symptoms so far:
1) The virus removed the registry sub keys under HKLM\Systems\CurrentControlSet\Control\Safeboot
The removal of these keys prevents booting into safe mode.
2) The virus deletes the Sophos executables
3) The virus generates traffic to

http://www.bashnet.ru

and alpha.bashtel.ru
4) Accessing antivirus websites such as

http://www.mcafee.com,

http://www.sophos.com,

http://www.kaspersky.com

is disabled through IE and Firefox
5) Opening a text file with e.g.

http://www.sophos.com

written in it hangs notepad

One of the clients has also identified a possible culprit which looks like part of the virus, but it is detected as clean when using McAFee and other AV products. The file is wmdrtc32.dll (and/or wmdrtc32.dl_) and is located in c:\windows\system32 on Windows XP machines (here with SP2)

 

[pechenegs]

There's not mcuh on this but Sophos says it's an E-mail worm!

http://www.uk.sophos.com/security/analyses/w32salityad.html

http://www.sophos.com/support/disinfection/pedis.html

Download hijack this from the link below.Please do this. Click here:

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

to download HijackThis. Click scan and save a logfile, then post it here so
we can take a look at it for you. Don't click fix on anything in hijack this
as most of the files are legitimate.


Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[Hick22]

Thanks for the reply...

Just wanted to make sure it was genuine and was covered by our current files.