MntDrCore.exe is Worm!

[chamithal]

MntDrCore.exe is a worm. It spread via removable drives, including floppy drives and USB keys. It creates an autorun.inf which is designed to start the worm once the removable drive is connected to an uninfected computer. Disable auto run in your computers. Even though the autorun is disabled it can infect the computer by double clicking the drive icon or by opening the drive content using right click & open option. Hence it is advisable to right click and exploring the drive in order to mitigate the risk.

MntDrCore.exe copies it self to %systemroot%\system32 with a name of isass.exe. There is an original system file which is also with the name lsass.exe. But isass.exe is a fake one. You can see it in the task manager as system process. It is not recommend delete the file listed above manually as this malware can use the same name as the genuine file and you could accidentally delete the genuine one.

You can use a tool or antivirus software to remove the file.

Symantec nam allanne na! If you want to try ur AV n post...

Download the virus... - unrar - password 123

 

[tckrockz]

ahh KIS 6 eken aluwa

 

[madurax86]

mntdrcore.exe is seen on abt 70% of SL's comps. It can be removed manually no need of anti virus software you can stop spreading all orms,trojans..etc that spread by autorun by doing the following,
1. load up cmd.exe
2. goto the removable's root
3. type "attrib"
4. just remove the unwanted attributes of unknown files(kill_vbs.vbs, ms32dll.dll.vbs,mntdrcore.exe,autorun.inf) by using "attrib <filename> -R -S -H"
5. now delete the file[its showing in the explorer now]

 

[chamithal]

ahh KIS 6 eken aluwa

kaspersky ne? mamath danna ona! 7 eka banna thanak nadda?

 

[chamithal]

mntdrcore.exe is seen on abt 70% of SL's comps. It can be removed manually no need of anti virus software you can stop spreading all orms,trojans..etc that spread by autorun by doing the following,
1. load up cmd.exe
2. goto the removable's root
3. type "attrib"
4. just remove the unwanted attributes of unknown files(kill_vbs.vbs, ms32dll.dll.vbs,mntdrcore.exe,autorun.inf) by using "attrib <filename> -R -S -H"
5. now delete the file[its showing in the explorer now]

thnx lolZ! but if the av takes care it's easier ne........

 

[chamithal]

AVG th allanawalu! eaka dala balanna ona! kaspersky dammama slow wenawa kiyala forum wala thiyenawa!

 

[tckrockz]

kaspersky ne? mamath danna ona! 7 eka banna thanak nadda?

ow ban 7 newi habi 6 eka

 

[Anusha]

ow ban 7 newi habi 6 eka

7 detected in my virtual pc.

 

[tckrockz]

7 detected in my virtual pc.

nod32 nt detected da

 

[fazaal24]

thx 4 the info

 

[Kasun007]

Symantec nam allanne na! If you want to try ur AV n post...

Download the virus... - unrar - password 123

I had NORTON IS 2006 and now using 2007.Virus detected in Both.

 

[fazaal24]

Avast hora wa alluwaaaaa..YIPPEEEEEEEE

 

[chamithal]

I had NORTON IS 2006 and now using 2007.Virus detected in Both.

really? oh! Symantec didn't detect! eventhough I right clicked on the virus file n scanned! AVG did! Thumbs up to it!

 

[Anusha]

Don't know

 

[tckrockz]

Avast hora wa alluwaaaaa..YIPPEEEEEEEE

athi yanthan

 

[anuja]

Mcafee tiyenne. up to date. meken ahuveida?

 

[fazaal24]

Mcafee tiyenne. up to date. meken ahuveida?

allala balanna ahuwenawada kiyala

 

[Kasun007]

really? oh! Symantec didn't detect! eventhough I right clicked on the virus file n scanned! AVG did! Thumbs up to it!

Details about virus in NORTON IS 2007.

 

[madurax86]

evry antivirus dat uses byte checkin libraries suk ! i knw dem evn da best fails wher they meet a new one they fail we're not that nutty to give sum dumb prog access da net n download its too nutty as i see it; nyway othrs think its da best way we hav n i say NO....use zonealarm i use it havnt met a btr prog for lock stuf up and the taskmanager at www.sysinternals.com its realli gud go there n see there're lots of utilities for removing viruses manually for me its fun but i use nod32 too jst incase

 

[hul2000]

AVG also detects this