RE: Name that Trojan

["Kester, Kelly" <KesterK () scott disa mil>]

Check out the following NIPC URL

http://www.nipc.gov/warnings/advisories/2001/01-003.htm


-----Original Message-----
From: Nutcase_69 [mailto:nutcase_69 () e-mailanywhere com]
Sent: Wednesday, January 09, 2002 10:30 AM
To: incidents () securityfocus com
Cc: Nutcase_69 () e-mailanywhere com
Subject: Name that Trojan

We have an application server running NT 4.0.  We found the file serv.exe on
it and I know that this could be an indication of a Trojan.  We deleteed the
file and when we rebooted, the file re-appeared.  I trying to find out if
anybody know what Trojan might display this activity?  I thaught it was
freak but that seemed old and I didn''t think that it could regenerate the
.exe  Any Answers?

Cheers,
Eric

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com