Name that Trojan

From: Nutcase_69 (nutcase_69@e-mailanywhere.com)
Date: Wed Jan 09 2002 - 08:30:12 PST

Next message: Katherine Ogden: "Think I've got trouble"

Previous message: Eric Landuyt: "Re: Large ICMP Packets with strange payload"
Next in thread: Hugo van der Kooij: "Re: Name that Trojan"
Reply: Hugo van der Kooij: "Re: Name that Trojan"
Reply: Blake Frantz: "Re: Name that Trojan"
Reply: Kester, Kelly: "RE: Name that Trojan"
Reply: Michael Ward: "RE: Name that Trojan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

We have an application server running NT 4.0.  We found the file serv.exe on
it and I know that this could be an indication of a Trojan.  We deleteed the
file and when we rebooted, the file re-appeared.  I trying to find out if
anybody know what Trojan might display this activity?  I thaught it was
freak but that seemed old and I didn''t think that it could regenerate the
.exe  Any Answers?

Cheers,
Eric

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Katherine Ogden: "Think I've got trouble"
Previous message: Eric Landuyt: "Re: Large ICMP Packets with strange payload"
Next in thread: Hugo van der Kooij: "Re: Name that Trojan"
Reply: Hugo van der Kooij: "Re: Name that Trojan"
Reply: Blake Frantz: "Re: Name that Trojan"
Reply: Kester, Kelly: "RE: Name that Trojan"
Reply: Michael Ward: "RE: Name that Trojan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Jan 09 2002 - 13:35:06 PST