General discussion
August 1, 2003 at 01:45 AM
kevin at alexander group

Suspicious files

by kevin at alexander group . Updated 23 years, 2 months ago

On a routine check of a client’s Win2K Server, I found the following files in the root of C:.
superrofl.exe, info.exe, root.exe, shell.exe, and ftp.txt. The txt file contained the following text:
open ur momma
bye
get CDIR.txt c:\CDIR.txtI have removed the files from the system (but kept copies). I have found no information on any attack or exploit along these lines. I was interested if anyone had information or suggestions for any other checks I should do.

This discussion is locked

All Comments