new worm/virus?

[Scot]

Can't find any info on this one.

Latest norton sigs aren't picking it up.

file is fensvr32.exe, taking up to 90% cpu and is scanning port 135. i can
remove the 2 entries that start it up from the registry.

there doesn't appear to be any info out there about this file, anyone have
any ideas?

thanks,

scott

 

[null]

Can't find any info on this one.

Latest norton sigs aren't picking it up.

file is fensvr32.exe, taking up to 90% cpu and is scanning port 135. i can
remove the 2 entries that start it up from the registry.

there doesn't appear to be any info out there about this file, anyone have
any ideas?

Sure. Scan it with other av scanners. If other scanners don't alert,
submit the file for analysis.


Art
http://www.epix.net/~artnpeg

 

[David H. Lipman]

Submit 'fensvr32.exe' to Virus Total which will test it against several AV vendor's
scanners.
http://www.virustotal.com/flash/index_en.html

Please post back your EXACT results.

Dave


"Scot"
| Can't find any info on this one.
|
| Latest norton sigs aren't picking it up.
|
| file is fensvr32.exe, taking up to 90% cpu and is scanning port 135. i can
| remove the 2 entries that start it up from the registry.
|
| there doesn't appear to be any info out there about this file, anyone have
| any ideas?
|
| thanks,
|
| scott
|
|

 

[Scot]

Here's what it ended up being:
http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.ccf.html

they put a new dat out that evening for it.

 

[Gabriele Neukam]

On that special day, Scot, ([email protected]) said...

Here's what it ended up being:
http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.ccf.html

Uhoh. A Randex turns your machine into a service for spammers - sending
mass mails by his command. I wonder if you can really get this out
without any residue...


Gabriele Neukam

(e-mail address removed)