Security Incidents: Re: wmon16.exe

[Peter Kosinar <goober () ksp sk>]

> - C:\winnt\system32\wmon16.exe appeared and began running (no idea what it 
> is or does)
> - hosts file was altered to redirect antivirus sites to 127.0.0.1 (similar 
> to Trojan.QHOST but nothing else matches
> - disables antivirus
> - creates lots of connections to network computers using microsoft-ds and 
> netbios ports
Might be a variant of Ago/Gao-bot. Could you provide the executable ?

Your sincerely,

Peter Kosinar



---------------------------------------------------------------------------
----------------------------------------------------------------------------