FYI: Avert Labs Dat Release Notification: 4828 Emergency Dat Files Release

[David H. Lipman]

"The 4828 dat files have been released early due to the IRC-Mocbot!MS06-040 threat.

The various 4828 dat file packages can be found at
http://www.mcafee.com/apps/downloads/security_updates/dat.asp

Best Regards,

McAfee Avert Labs - Come visit our Blog -
http://www.avertlabs.com/research/blog/ "

 

[John Smith]

"The 4828 dat files have been released early due to the
IRC-Mocbot!MS06-040 threat.
The various 4828 dat file packages can be found at
http://www.mcafee.com/apps/downloads/security_updates/dat.asp

Yes, McAfee removes the executables, but it doesn't fix the registry damage
done by this thing. Do you know what registry keys are modified?

On my win2k box, the administrative share C$ is gone after the infection.
I'm not sure how to get it back, or what other registry mischief may have
been done.

 

[Dustin]

Yes, McAfee removes the executables, but it doesn't fix the registry damage
done by this thing. Do you know what registry keys are modified?

On my win2k box, the administrative share C$ is gone after the infection.
I'm not sure how to get it back, or what other registry mischief may have
been done.

You could just goto grc.com and grab the letshare, noshare utilities.
letshare should restore it for you.

--
Dustin Cook
Author of BugHunter - MalWare Removal Tool
Version 1.9.2 Released August 15th, 2006
Last Pattern Update: August 15th, 2006
http://bughunter.it-mate.co.uk