Re: W2K Compromise - PipeCmdSrv

[Corey Coblentz <burts_tacopalace () hotmail com>]

In-Reply-To: <20021021121930.70633.qmail () web20504 mail yahoo com>

I got nailed by this, and managed to get rid of it by killing the 
systask.exe process it seems to hide behind and just remove mIRC via 
add/remove.
It seemed to get the LEGACY_PIPECMDSRV registry entry, and I couldn't find 
it on my system (not to say it's not still there).

Gotta stop being as lazy about security...

----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";> http://www.securityfocus.com/stillsecure </A>