Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

macro tini.b

0 views
Skip to first unread message

Pob

unread,
May 23, 2001, 2:16:34 AM5/23/01
to
Anyone know anything about this little lot? (InnoculateIT found them)

Started scanning: 08:36:30, 22/05/2001
Major dat file v1000
Minor dat file v1200
Macro dat file May 2 2001 (VMD Ver 1.6)

Scanning boot sectors...
C:\ Master Boot Record does not match template, is unknown but seems OK.
C:\ Partition Boot Record matches template, is OK: standard Win2000 (4).

Scanning file(s)...
C:\RECYCLED\Dc17.zip>tini.exe.file.exe.vir - Win32.Tiny.B trojan.
C:\RECYCLED\Dc17.zip contains infected files.
C:\RECYCLED\Dc62.exe - Win32.PornDial.5 trojan. Deleted.
C:\RECYCLED\Dc63.exe - Win32.PornDial.5 trojan. Deleted.
C:\RECYCLED\Dc39\teensex[1].exe - Win32.PornDial.5 trojan. Deleted.

Finished scanning: 08:49:03, 22/05/2001
Number of files scanned: 64269.
Number of archives containing infected files: 1
Number of infections: 4
Number of infected files deleted: 3
Number of infected files not cleaned/deleted/renamed: 1
C:\RECYCLED\Dc17.zip>tini.exe.file.exe.vir (Win32.Tiny.B trojan)


Nick FitzGerald

unread,
May 23, 2001, 7:43:07 AM5/23/01
to
Pob <inva...@invallid.net> wrote:

> Anyone know anything about this little lot? (InnoculateIT found them)

<<snip>>


> Scanning file(s)...
> C:\RECYCLED\Dc17.zip>tini.exe.file.exe.vir - Win32.Tiny.B trojan.
> C:\RECYCLED\Dc17.zip contains infected files.

From memory, this is a small backdoor that allows other remote access Trojans
(or anything else) to be sent to and installed on a machine running it.

> C:\RECYCLED\Dc62.exe - Win32.PornDial.5 trojan. Deleted.
> C:\RECYCLED\Dc63.exe - Win32.PornDial.5 trojan. Deleted.
> C:\RECYCLED\Dc39\teensex[1].exe - Win32.PornDial.5 trojan. Deleted.

These are fairly harmless, even if you run them. As explained at the URL
below,
they are classified as Trojans because they install themselves when run, even
though they seem to give the option of cancelling or aborting the
"installation".

http://www.cai.com/virusinfo/encyclopedia/descriptions/p/porndial.htm

If these were simply downloaded and deleted, you have nothing to worry about,
but you should flush your Recycle Bin.


--
Nick FitzGerald

Pob

unread,
May 23, 2001, 4:19:59 PM5/23/01
to
"Nick FitzGerald" <ni...@virus-l.demon.co.uk> wrote:

>Pob <inva...@invallid.net> wrote:
>
>> Anyone know anything about this little lot? (InnoculateIT found them)
><<snip>>
>> Scanning file(s)...
>> C:\RECYCLED\Dc17.zip>tini.exe.file.exe.vir - Win32.Tiny.B trojan.
>> C:\RECYCLED\Dc17.zip contains infected files.
>
>From memory, this is a small backdoor that allows other remote access Trojans
>(or anything else) to be sent to and installed on a machine running it.

gah, so there could be all sorts of nasties hiding on my drive if the right
person had access to it.

What should I do, a format?

>> C:\RECYCLED\Dc62.exe - Win32.PornDial.5 trojan. Deleted.
>> C:\RECYCLED\Dc63.exe - Win32.PornDial.5 trojan. Deleted.
>> C:\RECYCLED\Dc39\teensex[1].exe - Win32.PornDial.5 trojan. Deleted.
>
>These are fairly harmless, even if you run them. As explained at the URL
>below,
>they are classified as Trojans because they install themselves when run, even
>though they seem to give the option of cancelling or aborting the
>"installation".
>
> http://www.cai.com/virusinfo/encyclopedia/descriptions/p/porndial.htm
>
>If these were simply downloaded and deleted, you have nothing to worry about,
>but you should flush your Recycle Bin.

I havent a clue where they all come from, I dont use my computer for porno.

0 new messages