Re: wintbp.exe

Good points.  More data would help as would not guessing.


On 8/16/05 11:49 PM, "Nick FitzGerald" <[email protected]> wrote:

> From the incredible paucity of data posted, it certainly sounds as if
> it might be that...
> 
> BUT, the data posted does not rule out that it is, in fact, the next
> variant of that worm which may, for example, spawn a separate instance
> from a different, temporarily created copy of the main .EXE and might,
> for instance, trash the host's hard drive if it sees the main .EXE
> deleted.
> 
> All that could easily be done and not detected by your typical, and
> even quite advanced admin.  It would surely be missed by someone naïve
> enough to think that a filename alone is sufficient grounds for making
> a malware diagnosis...