Possible new Virus PWSteal.Netsnake?
11 June 2004, 04:24 PM
#1
Scooby Regular
Thread Starter
Join Date: Jun 2000
Posts: 4,413
Likes: 0
Received 0 Likes
on
0 Posts
Possible new Virus PWSteal.Netsnake?
Several of our Win2000 PCs have been getting strange error messges. I think the text may differ slightly but all show the words "bad image". We are still looking into this but found the following worked at removal (for now)
open regedit and find for "em_exeel" and delete every key.
See the name of that file and kill these process in task manager
find the file mpd.exe (or possibley pnp.exe) under "winnt" and delete that file
you may also need to delete the reg entries for "intranat.exe"
Symantec have the following. Not sure if this is all related.
PWSteal.Netsnake collects password information, creates its own mail message, and sends the information to the intruder. It copies itself to %windir%\Internat.exe. Please note that there is a legitimate Windows application called %windir%\system\Internat.exe. The Trojan file is 82.5 KB in length and uses a zip file icon. The "real" Internat.exe is generally about 20 KB in length with a "?" icon.
Has anyone else see this?
open regedit and find for "em_exeel" and delete every key.
See the name of that file and kill these process in task manager
find the file mpd.exe (or possibley pnp.exe) under "winnt" and delete that file
you may also need to delete the reg entries for "intranat.exe"
Symantec have the following. Not sure if this is all related.
PWSteal.Netsnake collects password information, creates its own mail message, and sends the information to the intruder. It copies itself to %windir%\Internat.exe. Please note that there is a legitimate Windows application called %windir%\system\Internat.exe. The Trojan file is 82.5 KB in length and uses a zip file icon. The "real" Internat.exe is generally about 20 KB in length with a "?" icon.
Has anyone else see this?
Thread
Thread Starter
Forum
Replies
Last Post