Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Trojan Clampi Issues

Updated: 21 May 2010 | 1 comment
kristopherjturner's picture
0 0 Votes
Login to vote

We are being hit pretty hard by Trojan Clampi. 

I have read that this Trojan tries to spread itself by using the PsExec process.  There was an article on Symantec's web site that even suggesting to block that process.  However, the MD5 hash they listed doesn't seem to work.  Keeps telling me the finger print isn't valid after trying to save it.  I have setup other Application Blocking rules and they all seem to work.  The MD5 has and the link to the support document is listed below.

http://www.symantec.com/security_response/writeup.jsp?docid=2008-011616-5036-99

0x9178451979c2192c71eb286de3e1b2f7

Comments

Thomas K's picture
28
Sep
2009
0 Votes 0
Login to vote

Kristopher, Try using these

Kristopher, Try using these two MD5 values.

PsExec

File Version: 1.70
Size: 131072 bytes
MD5: 8E913350BD169B96255313021DF01833
SHA1: E36F2070938BAF6332700B98FADF77CEB7361BF7
CRC32: 746C693D

File Version: 1.63
Size: 131072 bytes
MD5: FDE1439FFC78559851F6DF27CE8E1457
SHA1: 41BB8EF45FEA69AE183199DB652F8A2A9E3E0D05
CRC32: CF64AF7F

Let me know if this was helpful.

Thomas