Re: sndvol.exe

[Gordy Thompson <gordy () nytimes com>]

       This thing certainly seems to be making the rounds; we had a very 
similar experience with it about a week ago.

       It's well-documented at

< http://www.stanford.edu/group/itss-ccs/security/incidentinfo/ietrojan.html >

including its signature and a link to an "uninstaller" that Stanford IT 
cooked up.

At 04:33 PM 3/18/99 -0800, Randy Garbrick wrote:
> Has anyone noticed a Trojan horse called sndvol.exe that replaces the
> Win NT/9X sndvol.exe and then does a continuous port scan from inside a
> firewall to multiple outside addresses?  It created a denial of service
> by maxing out the sessions on our Pix.  We're trying to locate the
> source of the executable.
>
>
> Randy Garbrick
>
> Get Your Private, Free Email at http://www.hotmail.com


==========================================================================
Gordon T. Thompson                                      gordy () nytimes com
Manager, Internet Services                              212 556 1386
The New York Times                                      fax: 212 556 1636
 The Times and I have an arrangement: Neither of us speaks for the other.