virus.
anubis is down, so virustotal:
[Only registered and activated users can see links. Click Here To Register...]
several typical registry keys:
Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon
Software\\Microsoft\\Windows\\CurrentVersion\\Run
paths:
drivers\\etc\\hosts
100% infected, you should reinstall.
Quote:
Opened files...
\\.\PIPE\lsarpc (successful)
C:\2a6b41e6a7c612f597955a080ddf87bd98b167a3d331522 5e63472f2e006b29f (successful)
C:\Documents and Settings\<USER>\My Documents\MSDCSC\msdcsc.exe (successful)
Read files...
C:\2a6b41e6a7c612f597955a080ddf87bd98b167a3d331522 5e63472f2e006b29f (successful)
Copied files...
SRC: C:\2a6b41e6a7c612f597955a080ddf87bd98b167a3d331522 5e63472f2e006b29f
DST: C:\Documents and Settings\<USER>\My Documents\MSDCSC\msdcsc.exe (successful)
Registry activity
Set keys...
KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\MicroUpdate
TYPE: REG_SZ
VALUE: C:\Documents and Settings\<USER>\My Documents\MSDCSC\msdcsc.exe (successful)
KEY: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit
TYPE: REG_SZ
VALUE: C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\<USER>\My Documents\MSDCSC\msdcsc.exe (successful)
|