melan
August 18th, 2007, 01:17 PM
There is a new worm out there. AVG, Kaspersky, SOPHOS already detecting and deleting this worm form the USB drives. But NOD32 doesn't even detect this from its heuristic engine as a possible virus. I even sent a copy to nod32 lab. But no response whatsoever after 3 weeks i got infected by this.{QUOTE-> MntDrCore.exe is a worm. It spread via removable drives, including floppy drives and USB keys. It creates an autorun.inf which is designed to start the worm once the removable drive is connected to an uninfected computer. Disable auto run in your computers. Even though the autorun is disabled it can infect the computer by double clicking the drive icon or by opening the drive content using right click & open option. Hence it is advisable to right click and exploring the drive in order to mitigate the risk.
MntDrCore.exe copies it self to %systemroot%\system32 with a name of isass.exe. There is an original system file which is also with the name lsass.exe. But isass.exe is a fake one. You can see it in the task manager as system process. It is not recommend delete the file listed above manually as this malware can use the same name as the genuine file and you could accidentally delete the genuine one. <-QUOTE}I've got nod32 ver. 2.70.39 with virus signature ver. 2469 on 18/08/2007
MntDrCore.exe copies it self to %systemroot%\system32 with a name of isass.exe. There is an original system file which is also with the name lsass.exe. But isass.exe is a fake one. You can see it in the task manager as system process. It is not recommend delete the file listed above manually as this malware can use the same name as the genuine file and you could accidentally delete the genuine one. <-QUOTE}I've got nod32 ver. 2.70.39 with virus signature ver. 2469 on 18/08/2007