BetaONE will rise again!

BetaONE will rise again! (http:\\b1.hcanet.com\forum/index.php)
-   Internet Security and Privacy (http:\\b1.hcanet.com\forum/forumdisplay.php?f=38)
-   -   Something strange??? (http:\\b1.hcanet.com\forum/showthread.php?t=8368)

jtk 7th Jun 03 07:18 AM

I have found files in my winnt\system32 map called something like sxe10.tmp-sxe11.tmp etc, and there are a lot seems to make new ones every time i start up,
i have about 200 file all named sxexx.tmp anybody know where they come from.jtk

richardc2000 7th Jun 03 07:32 AM

I found this
_http://www.rescomp.berkeley.edu/resources/security/alerts/20020410/

jtk 9th Jun 03 09:21 AM

Thanx richardc2000 this was usefull,but still need a way of stopping this.
What happens is every time i start or reboot it makes 2 new tmp files in winnt\system32 folder, starting with sxexx.tmp the xx part is different, feks sxe12.tmp - sxe13.tmp these files are 940kb and 180 kb,and they are in my zone alarm under programs with a ?.
Searching on the net for sxe it says it might be a trojan, i have scanned for trojans and virus no results,both with latest defs.
this i dont like maybe an IRC thing useing my PC as a server.please need help on this.jtk

richardc2000 9th Jun 03 10:02 AM

Not sure what you did after reading the article

There was a link to Darkirc - Symantec says it can find it:

_http://securityresponse.symantec.com/avcenter/venc/data/backdoor.darkirc.html

but I am not sure whether this is what you have.

jtk 9th Jun 03 10:42 PM

It seems it not this DarkIRC as there are no registery settings as described by symantic, i have sent symantic an email see what they say.jtk


All times are GMT +1. The time now is 02:43 AM.

Powered by vBulletin® Version 3.6.5
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.