Tmp_.exe <- Weird bug in Win NT and 98 (part2)

[Axel Pettinger]

Don't post binaries to alt.comp.virus!
When you think it's a virus then send the file to an anti virus company!

BTW, you *are* infected!!!

Report of NAI's BetaScan:

****************************
Scan v3.2.0A
Copyright (c) 1992-1998 Network Associates, Inc. All rights reserved.
(408) 988-3832 BETA COPY - Aug 27 1998

Loading virus patterns
Virus data file V3109 created 08/28/98 21:16:11
No viruses found in memory.
Scanning C:\CURIOUS\*.*
C:\CURIOUS\TMP_.EXE
Found the TCV3 virus
****************************************

AntiViral Toolkit Pro (AVP) reports it as "Win32.HLLP.DeTroie" ...

You can d/l Nai's BetaScan from ...
http://beta.nai.com/public/datafiles

You can d/l AVP from ...
http://www.avp.ch

Regards,
Axel Pettinger

Pollus Brodeur wrote:
>
> The program is actually copying itself and a program file to the windows
> temp directory each time i run a program. I sent a copy of the generated
> program in case some of you knows how to analyse it. I get it thru a lot of
> anti-virus software and niet! No virus!
>
> Pollus Brodeur
>
> Name: Tmp_.exe
> Tmp_.exe Type: unspecified type (application/octet-stream)
> Encoding: x-uuencode

[Marcel D....]

Axel Pettinger wrote in message
<35EA99EE...@stud-mailer.uni-marburgVIRUS.de>...

>Don't post binaries to alt.comp.virus!
>When you think it's a virus then send the file to an anti virus company!
>
>BTW, you *are* infected!!!

Yeah,

aren't you also wondering where NewsSniffer, VirusPatrol etc have gone to ?
There is also a Norton thingy doing some checking, don't know the name of
that one......

Marcel D - AV guy speaking entirely for myself !

This weeks free advise : It's better to disable Plug & Play in your BIOS.

See the faces of this newsgroup at http://members.aol.com/altcompvir/

[Mike Austin]

In article <gEqG1.288$Uu3.5...@weber.videotron.net>, Pollus Brodeur
<pol...@videotron.ca> writes

>The program is actually copying itself and a program file to the windows
>temp directory each time i run a program. I sent a copy of the generated
>program in case some of you knows how to analyse it. I get it thru a lot of
>anti-virus software and niet! No virus!
>
>Pollus Brodeur
>
>
>

>[ A UUEncoded file was included here. ]
>[ original filename, "Tmp_.exe" ]
>
Please don't send binaries to these newsgroups. It wastes time and
space. Look at the thread called INFO: A Guide to the Windows newsgroups
[FAQ]
--
Mike Austin

[Mike Austin]

In article <gEqG1.288$Uu3.5...@weber.videotron.net>, Pollus Brodeur
<pol...@videotron.ca> writes
>The program is actually copying itself and a program file to the windows
>temp directory each time i run a program. I sent a copy of the generated
>program in case some of you knows how to analyse it. I get it thru a lot of
>anti-virus software and niet! No virus!
>
>Pollus Brodeur
>
>

>[ A UUEncoded file (Tmp_.exe) was included here. ]