Virus Warning!!!

[Ramblin Man]

Currently the company I support is battling a virus outbreak. It is a worm with an exicutable wintbp.exe as the running process. It also creates a bucnh of sequential named .exe files in the winnt\win32 directory and there is an entry in the registry which I don't have written down. Currently the problem is being worked with symantec.

If you are infected your pc will start rebooting and network traffic will be through the roof.

Just thought you'd like to know. If you see it you'll know whaats going on.

 

[radman]

The U of M here got it, got it bad. Very quickly, through some students wireless laptop. Infected 1500 pc's, got into the network so fast that it was all they could do to stay ahead of it.

 

[jbay]

This is the reason I have two hard drives , both 120 gig. Always keep one turned off. When the one I'm using gets a bad virus, I erase bad drive and copy good drive on to it. Hard drives are so cheap these days it just make sense to me.

 

[markjenn]

If one is "always turned off" how does it have any of the work you've done on it?

- Mark

 

[jbay]

Before I copy drives , I already have a good Idea what is not on the turned off drive . I will turn both drives on and copy and paste things to the once turned off drive. Things I copy and paste would be pictures, or any thing that is in My Briefcase ,where I download all my stuff or store new documents . All my bookmarks in Explorer . New music ,MP3 . I can open up the same file on each drive and put them side by side and compare them to see what needs to be moved.

I hope that makes sense .

 

[FatNakedGuy]

network traffic through the roof.... You sure they ain't runnin' EDonkey2000 sharing MP3 and porn files?

That's what happens at my work anyway.. bastards!

Interesting that Google doesn't show anything for "wintbp.exe"

Thanks for sharin' bro.

 

[Carnifex]

Most of what I've seen is that the virus is nowhere nearly as bad as CNN reported it, but they sprayed it all over everywhere because they got infected.

Any network admins to lived through Blaster and are still at risk for this virus should be fired. Immediately. To stupid to learn and continue working.

 

[FJRocket]

https://securityresponse.symantec.com/avcen...32.zotob.e.html

https://securityresponse.symantec.com/avcen...32.esbot.a.html

My box brought up this alert a couple minutes ago. Either of these what you're talking about? Discovered yesterday?

 

[radman]

Looks like it's exclusive to Win2000, network os of choice.