Check out the following NIPC URL http://www.nipc.gov/warnings/advisories/2001/01-003.htm -----Original Message----- From: Nutcase_69 [mailto:nutcase_69@e-mailanywhere.com] Sent: Wednesday, January 09, 2002 10:30 AM To: incidentsat_private Cc: Nutcase_69@e-mailanywhere.com Subject: Name that Trojan We have an application server running NT 4.0. We found the file serv.exe on it and I know that this could be an indication of a Trojan. We deleteed the file and when we rebooted, the file re-appeared. I trying to find out if anybody know what Trojan might display this activity? I thaught it was freak but that seemed old and I didn''t think that it could regenerate the .exe Any Answers? Cheers, Eric ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Jan 09 2002 - 15:29:43 PST