backdoor.berbew.p virus

[Alex Potter]

Hi there,

I just finished recovering from this virus and am wondering if there is some
utility
out there that will show me the processes actually running on my computer;
while infected, Task Manager does not!!!

On article on how the virus accomplishes this would also be of interest...
The symantec site just says that it uses a "rootkit"...which to me is rather
vague


TIA

Alex

 

[David H. Lipman]

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Sysinternals has many utuiilities that can help from TCPVIEW.EXE to PSTools
http://www.sysinternals.com/ntw2k/utilities.shtml


This is a Password Stealing Trojan. I hope you CHANGED all account passwords !

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.berbew.p.html
http://vil.nai.com/vil/content/v_129610.htm

--
Dave




| Hi there,
|
| I just finished recovering from this virus and am wondering if there is some
| utility
| out there that will show me the processes actually running on my computer;
| while infected, Task Manager does not!!!
|
| On article on how the virus accomplishes this would also be of interest...
| The symantec site just says that it uses a "rootkit"...which to me is rather
| vague
|
|
| TIA
|
| Alex
|
|

 

[Steve Parry [MVP]]

Alex Potter fumbled, fiddled and fingered:

Hi there,

I just finished recovering from this virus and am wondering if there
is some utility
out there that will show me the processes actually running on my
computer; while infected, Task Manager does not!!!

On article on how the virus accomplishes this would also be of
interest... The symantec site just says that it uses a
"rootkit"...which to me is rather vague


TIA

Alex

Hopefully you'll find this useful

http://www.f-secure.com/v-descs/padodorw.shtml

 

[Alex Potter]

Yikes!!!

When you say ". I hope you CHANGED all account passwords !"
does that mean all user logons???

TIA

 

[David H. Lipman]

Yes. It is a password stealer. While I ma not acquainted with its methodology the purpose
of password stealers is to capture the logon name and password of accounts and send them to
a third party. The purpose is to then use the obtained information for nefarious reasons.

If the PC was infected that is the prudent course of action to take, changing passwords ASAP
!

--
Dave




| Yikes!!!
|
| When you say ". I hope you CHANGED all account passwords !"
| does that mean all user logons???
|
| TIA