Security Incidents mailing list archives

Name that Trojan


From: Nutcase_69 <nutcase_69 () e-mailanywhere com>
Date: Wed, 9 Jan 2002 08:30:12 -0800 (PST)

We have an application server running NT 4.0.  We found the file serv.exe on
it and I know that this could be an indication of a Trojan.  We deleteed the
file and when we rebooted, the file re-appeared.  I trying to find out if
anybody know what Trojan might display this activity?  I thaught it was
freak but that seemed old and I didn''t think that it could regenerate the
.exe  Any Answers?

Cheers,
Eric

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


Current thread: