Educause Security Discussion mailing list archives

explorexp.exe

From: Shawn Kohrman <kohrman () GMAIL COM>
Date: Tue, 16 Nov 2004 12:50:56 -0800

We're seeing machines scanning on TCP 445 that have the file
explorexp.exe installed on them.  In certain cases we've also found a
file called "o" that contained an ftp script to download the
explorexp.exe file from other host with the same characteristics.  Is
anyone else seeing this?

Shawn

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.

Current thread:

explorexp.exe Shawn Kohrman (Nov 16)
- <Possible follow-ups>
- Re: explorexp.exe Borne, Chris (Nov 16)