winampa.exe and netbios disabler

[rwong]

Hi there,

I have a small network of 5 or 6 Pcs. A couple of days ago, two of the computers lost connection to the server and the other pcs, printers, etc. The internet was working fine except if you try to browse places like

http://www.symantec.com,

http://www.mcafee.com,

etc.
I uninstalled and reinstalled the TCP/IP protocol and networking started to work again but it lasted a few hours
My corporate Norton AV detected a couple of viruses in these two computers w32.bropia.j and w32.spybot, I quarantined them and deleted them.
Also, I found the file winampa.exe running on the task manager, since I do not have winamp I stopped, cleared all entries from the registry, but I was unable to find the exe file, neither in the winnt folder nor the system32 nor the entire system.
The virus is propagating all over the network and I have been unable to detect it. The norton scans return nothing.

Does anybody know something about this kind of behavior


thanks,

Rick

 

[LloydSev]

yeah.. definately sounds like a virus.

Added by the SPYBOT-BR WORM! Note - this is NOT the popular Winamp media player which has the same filename

http://www.pcreview.co.uk/startup/winampa.exe.php

Computer/Network Technician
CCNA

 

[rwong]

Thanks Lloyd


Since last week, I am still struggling to get rid of this virus. I decided to isolate one computer and format the other one reinstalling all applications. In just a few hours the winampa.exe file reappared an also I notice a tcp connection to the ip no. 70.84.64.74 port 5190. The norton antivirus (with the latest update) still not detects anything, neither the stinger from mcafee.
I have also detected files like exe.exe and important.exe in my c: drive.

Does anybody have a clue about this virus?

thanks,

Rick

 

[LloydSev]

try using online virus scanners such as Housecall

http://housecall.trendmicro.com/

or Panda Antivirus

http://www.pandasoft.com/

RAV Antivirus is a good online scanner too..

http://www.ravantivirus.com/

Computer/Network Technician
CCNA