winsmc

[Ch1m3r4]

anyone having problems with this?

we've found it on several computers causing rapid scanning on port 445
this is after running a scan with updated mcafee enterprise 7.1, and the latest stinger from mcafee.

it's not in any database yet, google returns nothing. It causes some random problems like IE will work for the first 5 minutes and then get flaky, along with several other things.

the only way we've found to get rid of it is remove it from startup in msconfig, do a registry search for winsmc.exe, remove all instances, and there are a couple random filenames in the same areas that also need to be removed.

thoughts?

 

[SJConsultant]

Nope, but submitting the file to mcafee or symantec should yield some information on it.

 

[Ch1m3r4]

we submitted a sample to symantec last night, haven't heard anything yet

 

[The[H]uman]

I would go ahead and close down that port doesn't need to be open for anything

http://www.uksecurityonline.com/husdg/windows2000/close445.htm

 

[Ch1m3r4]

we're using DHCP and print sharing, so it looks like that's out of the question.

 

[Ch1m3r4]

winsmc.exe detected as an sdbot variant by norton and mcafee dat releases from today (aug 25)

thank you U of I...