CR2 Incident - root.exe present, but explorer.exe process not?

From: Bartel, Matt (Matt.Bartelat_private)
Date: Tue Aug 07 2001 - 12:40:59 PDT

Next message: Kyle Maus: "UDP scans from CodeRed-infected hosts"

Previous message: Marc Maiffret: "RE: more Code Red analysis"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Has anyone experienced a CR2 instance where root.exe was present in the
directories it typically is in, but the explorer.exe process is not running?

Thank you.
-Matt

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Kyle Maus: "UDP scans from CodeRed-infected hosts"
Previous message: Marc Maiffret: "RE: more Code Red analysis"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Aug 07 2001 - 15:08:06 PDT