Re: sndvol.exe

["Paul M. Cardon" <pmarc () cmg fcnbd com>]

You wrote:
: Has anyone noticed a Trojan horse called sndvol.exe that replaces the
: Win NT/9X sndvol.exe and then does a continuous port scan from inside a
: firewall to multiple outside addresses?  It created a denial of service
: by maxing out the sessions on our Pix.  We're trying to locate the
: source of the executable.

Looks like somebody has been through this already...

http://cs.wilpaterson.edu/~scottw/shebang/trojanhorse/

-paul