McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → McAfee Labs → Threat Intelligence

PWS-NTSMB

This page shows details and results of our analysis on the malware PWS-NTSMB

Threat Detail

Malware Type: Trojan

Malware Sub-type: Password

Discovery Date: 2003-02-10

Next Steps:

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.


Minimum DAT

4247 (2003-02-12)

Updated DAT

4248 (2003-02-19)

 Minimum Engine

5.1.00

File Length

57344 bytes

Description Added

2003-02-10

Description Modified

2003-02-12

Malware Proliferation

Characteristics

This program is not really a trojan but may form part of some trojan "root-kits" designed to compromise network security. It usually has the name NTSMB.EXE and is 57,344 bytes in length.

The program is a Win32 console application, which is designed to probe one or more IP addresses using the SMB protocol to 'crack' administrator accounts on Windows Networks. It launches a dictionary based attack on the IPC$ share, using the usernames "administrator" and "admin". It uses a list of passwords obtained from text files called NTSMB.DIC and NTSMBCOMMON.DIC. (Note these names are hard coded in the program).

The connection requests made by this program use the string SOUP as the contents of the Primary Domain, Native O/S, and Native LAN Manager fields.

Successful login attempts are displayed on the screen along with the username and password.

This program does not attempt to send any account details over the Internet, not does it attempt to install itself into the system start-up sequence.

Symptoms

Presence of files NTSMB.EXE, NTSMB.DIC, or NTSMBCOMMON.DIC on system.

Excessive SMB traffic on network using Primary Domain, Native OS or Native LAN Manger values of SOUP.

Method of Infection

N/A This is a password-cracking tool, used during a dictionary style attack against a large number of systems.

Removal

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Additional Windows ME/XP removal considerations

Variants

United States - English