MSapp.exe?!?!?

[Bill Unger]

I was auditing a client's server and found a running process called
MSApp.exe - I Googled it and found that it should be associated with a
trojan called RSBot. Now here's the confusing part: I have scanned the
file with 3 different scanning engines, including 2 free online scanners (
Housecall by Trend and Pandora's ) and McAfee with most recent sigs, and
nothing is detecting the file as a virus?!?! I have searched through both
standard web hits and groups and they all say the same thing - virus. But
nothing is detecting it as such. Any thoughts on what I am missing?!??!

tia,
Bill

 

[Eric McG]

Symantec's removal procedure, for this virus in Windows 2000, is to simply delete the foreign file and the value that was added to the registry. See this article for complete details:

Backdoor.Rsbot
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.rsbot.html

 

[Bill Unger]

I am more curious why absolutely NOTHING is detecting it??!


Symantec's removal procedure, for this virus in Windows 2000, is to simply
delete the foreign file and the value that was added to the registry. See
this article for complete details:

Backdoor.Rsbot
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.rsbot.html

 

[Steve Nielsen]

Symantec products with current definitions do detect it.

Steve

 

[George Hester]

me too

 

[Eric McG]

I think your question should be addressed to the people at McAfee, Trend and Pandora .