Newsgroup: it.comp.sicurezza.windows
Titolo: dllmnr.exe

Qualcuno sa che cosa sia. Non ho trovato informazioni con google.
Grazie

 Qualcuno sa che cosa sia. Non ho trovato informazioni con google.
Dal momento che google sembra non conoscerlo (sia web sia gruppi) prova a
fare dei controlli in direzione antispy ^
www.romanelmondo.com/sugg/spy.htm
 ^ e antivirus ^
www.romanelmondo.com/sugg/virus.htm
 ^ per essere sicuro che non dia
problemi.
-- 
Andy
~ : ~ : ~ : ~ : ~ : ~ : ~ : ~ : ~
 
http://www.inzona.com
~ : ~ : ~ : ~ : ~ : ~ : ~ : ~ : ~
Yahoo ID andrea26272

 ha scritto nel messaggio
news:2iam7uF...@uni-berlin.de...


We have that file load in the registry on all XP and W2k machine, this
program flood the network, we don't know were they come, we find this
file twice on each machine, one in c:\ and c:\winnt\system32
We have all Microsoft security patch, we scan with many type of
antivirus, we scan for malaware and spyware, we search on Internet and
your are the first guys we know that is have this file...  we found it
in three other compagny...
If you find somethings please respond me
Thanks

 Nessuno spy
Meglio cosě.
Prova per sicurezza anche il test antivirus.


in three other compagny...
Have you submitted the suspicious file to some  virus labs?
http://msmvps.com/harrywaldron/posts/5850.aspx
 
-- 
Tiziano "Lapalissiano" Marmiroli
Microsoft MVP - Office

 Grazie
Do you news about that!  We got the same problem in Montreal, Quebec, Canada
We find nothing about that
We Scan with many antivirus software, spyware
We have all critical microsoft patches
The problem it cause is flood the network...
We seen to be on ly 2 that they now that is an virus
I post the virus to trendmicro few hours ago!

Il giorno 4 Jun 2004 03:55:29 -0700, 
daniel...@hotmail.com
 (Dan)
ha inavvertitamente calpestato i tasti, producendo siffatto scritto:

Maybe it's the new worm Korgo, even if it looks strange to me. But,
with no other hints...
Let's try searching in the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and look _if_ the value "Disk Defragmenter"="%System%\dllmnr.exe"
is present.
If so, go to
http://securityresponse.symantec.com/avcenter/venc/data/w32.korgo.f.html
and look for the removal tool.
Bye,
Giovanni Cesaretti
-- 
"Non prenderei mai la tessera di un club
che mi accettasse tra i suoi soci"
Groucho Marx

 ha inavvertitamente calpestato i tasti, producendo siffatto scritto:


No Korgo found by the removal tool.
I'm using a W2000Pro fully patched machine.
There is neither a file called dllmnr.exe in my PC, nor a call to it
in my registry. 
Moreover, and much more important, google do not knows it.
So, why not to try removing the register call to dllmnr (AFTER
backupping the registry, of course)?
You have also to search ALL your register, to verify if the -let's
say- "strange" program is present in other keys.
Bye,
Giovanni Cesaretti
-- 
"La guerra e' pace
 La liberta' e' schiavitu'
 L'ignoranza e' forza"
George Orwell, 1984 

 ha scritto nel messaggio
news:t4v0c0ld3ql3k3830...@4ax.com...


Do you suggest to delete EXPLORE entries as well?
Not so sure....
My suggestion is "not to play with the registry" :-P
Since you've identified the problem, I think that your first attempt
should be in that direction (namely, dllmnr.exe).
Anyway, if you think it's a spyware problem, you can try also SpyBot
S&D (download, UPDATE and use it).
Giovanni Cesaretti
-- 
"Incompetent individuals, compared with their more competent peers,
will dramatically overestimate their ability and performance relative
to objective criteria." Justin Kruger and David Dunning, J. Person. &
Social Psychol., Vol. 77, No. 6, 1121-1134





So assai io, sei tu che posti in inglese....
Allora, ricominciamo :-P
Giovanni Cesaretti
-- 
..ma l'uomo del miracolo dalla televisione,
entrò in tutte le case stravolto d'emozione
"Ci ho già pensato io" disse
"È una grande occasione, pagate e vi sarà dato...
... un sole di cartone".
"Lo sciopero del sole", Bandabardo'

 ha scritto nel messaggio
news:p261c0917udd0u0gl...@4ax.com...


 "Microsoft DLL Manager"="dllmnr.exe"
Hai già visto, mi pare.
A questo punto, io staccherei il lazzaretto... ehmm, dicevo il disco,
e lo farei controllare a un antivirus (o meglio più di uno :-) ) montandolo
su un'altra macchina sicuramente pulita.
Bye, G.

 ha scritto nel messaggio
news:2ic2bbF...@uni-berlin.de...


 Thanks
-- 
questo articolo e` stato inviato via web dal servizio gratuito 
http://www.newsland.it/news
 segnala gli abusi ad 
ab...@newsland.it

 the name "Root On MSDEserver" with everyone, premissions.
-- 


 Thanks
We got it on an old NT 4.0/SP6a Workstation with all security patches
installed. 
This PC was infected between 06/03/2004 and 06/05/2004 and dllmnr.exe was
copied in C:\Winnt\System32\Spool\Drivers.
It was detected during whole disk analysis on 06/05/2004 as W32.Randex.Gen
with the 06/04/2004 update of Norton Antivirus.
Stephan


...
