Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: wintcpmod.exe Hear of it?
From: Michael Holstein <michael.holstein () csuohio edu>
Date: Fri, 06 May 2005 13:09:09 -0400

Probably a <flavor_of_the_month>bot variant. Run it by Norman's sandbox and see what shakes out.

http://sandbox.norman.no/live_4.html

Try to Un-[upx|rar|zip] it first .. Norman's website dosen't handle programs that are compressed multiple times so well (and bot-kiddies like to do just that to hide them/frustrate us).

Also .. check standard spots in the registry to see if it's set to run on startup (HKLM/Software/Microsoft/Windows/CurrentVersion/Run and RunServices).

As mentioned in another post, http://www.virustotal.com is another good spot to run it through.

Seeing the same file in those two places is fairly common bot behavior .. they want to ensure they get it at least one place that's in the $PATH.

If all else fails, a VMware guest (with Ethereal on the host O/S) is your friend.

Cheers,

Michael Holstein CISSP GCIA
Cleveland State Univeristy

Dan Bambach wrote:
I noticed today that a program wintcpmod.exe, located in two places on my hard drive, windows\system and windows\system32 was attempting to access port 53. My firewall blocked it and sent an alert. I am on the road, so I have not had time to fully investigate this yet, but a Google search produced very little about this program. It sets a registry key for local machine “run”, and can be seen on the process screen. It does not appear in the services list. I was able to kill it, but in my Google search, someone has claimed that they were unable to kill the process. I am running WinXP SPk2 fully patched, and Symantec AntiVirus, ZoneAlarmPro. Microsoft AntiSpyware does not report anything.

Has anyone else seen this program?

Dan Bambach

Dan () dbambach net <mailto:Dan () dbambach net>


------------------------------------------------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault