Re: wintbp.exe
Ero Carrera <[email protected]>
| Newsgroups | gmane.comp.security.virus |
|---|---|
| Message-ID | <[email protected]> |
On Aug 16, 2005, at 12:00 PM, Schlegel, Justin wrote: > Hi, > > My company has recently been hit with some variety of virus that is > rebooting our machines. As far as I can tell the process causing the > problem is wintbp.exe. I have searched in google and all the major AV > vendors for this file with no luck. Does anyone have any > information on > this process as I do not know what virus I am up against? Nasty critter, we are checking it at F-Secure. Easy to notice, machine turns into a crawl. Uses PnP and LSASS vulns. Seems to be the one responsible for the CNN (et al.) out break. ~10KB TFTP transfer IRC Bot ... We'll follow the situation at: http://www.f-secure.com/weblog