Re: wintbp.exe

On Tue, 16 Aug 2005, Jacob Bresciani wrote:

-> Was this being started up in the registry?
-> HKLM\Software\Microsoft\Windows\Current Version\Run....
-> or somewhere else?

HKLM, like usual, is what I heard. Run, I'd check RunOnce, RunServices, 
etc... In other words, don't count to much on where this *one* varient is 
auto-starting from, but rather know where to look to find any of them, if 
some time in the future there are more (which there will most likely be).

 
-> if it was in the registry what was the key named?

This parameter is usually settable in the source code of these types of 
malware, so I wouldn't rely on that. Besides, how many things DO you have 
in HKLM Run/RunOnce/RunServices ?


-- 
I still want to know what dim bulb thought that UPnP was
a good idea. I mean, c'mon.  A defined API so malware can
send a "Pants Down!" command to the firewall?
What were they *thinking*?  -Valdis Kletnieks