drocket2
March 18th, 2004, 08:42 PM
i origionally did a scan and got a log like this:
Scan Control Dumped @ 18:15:42 17-03-04
RegVal Trace: Suspicious: HKEY_LOCAL_MACHINE
File: SOFTWARE\Microsoft\Windows\CurrentVersion\Run [rundll=rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load]
RegVal Trace: RAT.Netbus 1.70 (Dropper.Memory): HKEY_LOCAL_MACHINE
File: SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SYSTRAY=C:\WINDOWS\System32\a.exe]
Positive identification <Adv>: Possible WebDownloader
File: c:\documents and settings\derek mcdonnell\local settings\temp\bridge.exe
Positive identification <Adv>: Suspicious: Microsoft-tagged exe built with Borland compiler
File: c:\documents and settings\derek mcdonnell\local settings\temp\installer2.exe
Positive identification <Adv> (in archive): Suspicious: Microsoft-tagged exe built with Borland compiler
File: installer2.exe (In c:\my shared folder\deadaim.4.5-snd.rar)
Positive identification <Adv> (in archive): Suspicious: Microsoft-tagged exe built with Borland compiler
File: unstsa2.exe (In c:\my shared folder\deadaim.4.5-snd.rar)
Positive identification: RAT.Iroffer 1.2b13a
File: c:\recycler\s-1-5-21-725345543-688789844-854245398-1004\dc3.exe
Positive identification <Adv>: Suspicious: Microsoft-tagged exe built with Borland compiler
File: c:\windows\unstsa2.exe
I posted it on another website to get their analysis so i opened it again and scaned again to get those files up to delete them and it came up with finding that unstsa2.exe file appearing in a tds-3 folder C:\Program Files\TDS3\xDynamic\unstsa2.exe im afraid to delete since it may be part of tds but im not sure if that is a quarantine folder or what.
Scan Control Dumped @ 18:15:42 17-03-04
RegVal Trace: Suspicious: HKEY_LOCAL_MACHINE
File: SOFTWARE\Microsoft\Windows\CurrentVersion\Run [rundll=rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load]
RegVal Trace: RAT.Netbus 1.70 (Dropper.Memory): HKEY_LOCAL_MACHINE
File: SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SYSTRAY=C:\WINDOWS\System32\a.exe]
Positive identification <Adv>: Possible WebDownloader
File: c:\documents and settings\derek mcdonnell\local settings\temp\bridge.exe
Positive identification <Adv>: Suspicious: Microsoft-tagged exe built with Borland compiler
File: c:\documents and settings\derek mcdonnell\local settings\temp\installer2.exe
Positive identification <Adv> (in archive): Suspicious: Microsoft-tagged exe built with Borland compiler
File: installer2.exe (In c:\my shared folder\deadaim.4.5-snd.rar)
Positive identification <Adv> (in archive): Suspicious: Microsoft-tagged exe built with Borland compiler
File: unstsa2.exe (In c:\my shared folder\deadaim.4.5-snd.rar)
Positive identification: RAT.Iroffer 1.2b13a
File: c:\recycler\s-1-5-21-725345543-688789844-854245398-1004\dc3.exe
Positive identification <Adv>: Suspicious: Microsoft-tagged exe built with Borland compiler
File: c:\windows\unstsa2.exe
I posted it on another website to get their analysis so i opened it again and scaned again to get those files up to delete them and it came up with finding that unstsa2.exe file appearing in a tds-3 folder C:\Program Files\TDS3\xDynamic\unstsa2.exe im afraid to delete since it may be part of tds but im not sure if that is a quarantine folder or what.