Fuzz 2

My uncle's has gone and opened a pif document (on his own pc )
and AVG has picked it up in a scan as I-Worm/Mutubu.A
Now I've checked Grisoft site, McAfee site and Norton site and no one seems to have this worm listed.
Is it new...?
What can I do about it as AVG just says "still infected" although it has now removed the e-mail...

Fecking wrinklies.. how many times I have said not to open stuff you know nothing about, wasn't even fecking addressed to him.


Anyway, any help appreciated.


Andy

JackClark

Try http://uk.mcafee.com/root/mfs let us know the results.

Redkop

I am assuming that you spelt it incorrectly...


W32/Mabutu-A is an email worm and IRC backdoor Trojan.

W32/Mabutu-A copies itself to the Windows folder using a random filename with an EXE extension, generating the random name by searching for a file with a DLL extension in the Windows folder and prepending a random character. W32/Mabutu-A also drops a file with a DLL extension using the same random name generation and the dropped DLL is also detected as W32/Mabutu-A.

W32/Mabutu-A sets the following registry entry so as to run the dropped DLL on system startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run \
winupdt = "RUNDLL32.EXE <Dropped Dll Name>,_mainRD"

W32/Mabutu-A creates a log file CFG.DAT in the Windows folder.

W32/Mabutu-A may set the following registry entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\
enableautodial = 1

W32/Mabutu-A harvests email addresses from files on the host computer with the following extensions:

WAB
HTM
HTML
TXT

W32/Mabutu-A ignores addresses containing the following strings:

kaspers
avp
virus
syman
panda
sopho
bitdef
trendmicro
nai.c
eeye
neohapsis
secur
ntbugtraq
secunia
microsoft
spam
where
admin
webmaster
mailer
mailing
postmaster
someone
somebody
noone
nobody
anyone
nothing
info
abuse
contact
service
support
secur
spam
register
news
subscription
confirm
.edu

W32/Mabutu-A sends itself as an attachment to an email with a ZIP or SCR extension.

W32/Mabutu-A attempts to gather information related to MSN Messenger from the infected computer.

W32/Mabutu-A also attempts to send gathered information to remote users via IRC channels. W32/Mabutu-A may download a file from a remote location to C:\UPDATE.DLL

Fuzz 2

Thanks for the link Jack, sent the link to my uncle for him to try...
Will go from there.

Cheers so far
Andy

_Meridian_

iTrader: (1)

It doesn't help that each company tends to call each virus a different name....


M

JackClark

Yup, it's a complete pain in the ****. Most vendors stick to the CARO naming convention, but things are so fast now that it's difficult.

Nicks VR4

Jack has hit it right on the head
Monday's outbreak for instance
W32/Bagle.ag@MM Computer Associates
WORM_BAGLE.AC Trend
Bagle.al F-Secure
W32/Bagle.aq@MM McAfee
W32/Bagle-AQ Sophos

The list goes on I deal with this everyday

Nicks VR4

Sorry mate I was reading to fast

Fuzz 2

Update:

Uncle has now done the free scan.
Results as written by him;

w32 Mabatu.a@MM!zip

No further advise was offered on the free scan

Some other info he wrote down was,
Files, \k7q76zsp\thumbs(1)zip
zr4tab1j\thumbs(1)zip

Cheers for any further help here.


Andy

JackClark

Get him to change brands. McAfee can remove that puppy for you, but I'm biased. There are probably some free Antivirus products that could do the job also.