Something strange???

[jtk]

I have found files in my winnt\system32 map called something like sxe10.tmp-sxe11.tmp etc, and there are a lot seems to make new ones every time i start up,
i have about 200 file all named sxexx.tmp anybody know where they come from.jtk

[richardc2000]

I found this
_http://www.rescomp.berkeley.edu/resources/security/alerts/20020410/

[jtk]

Thanx richardc2000 this was usefull,but still need a way of stopping this.
What happens is every time i start or reboot it makes 2 new tmp files in winnt\system32 folder, starting with sxexx.tmp the xx part is different, feks sxe12.tmp - sxe13.tmp these files are 940kb and 180 kb,and they are in my zone alarm under programs with a ?.
Searching on the net for sxe it says it might be a trojan, i have scanned for trojans and virus no results,both with latest defs.
this i dont like maybe an IRC thing useing my PC as a server.please need help on this.jtk

[richardc2000]

Not sure what you did after reading the article

There was a link to Darkirc - Symantec says it can find it:

_http://securityresponse.symantec.com/avcenter/venc/data/backdoor.darkirc.html

but I am not sure whether this is what you have.

[jtk]

It seems it not this DarkIRC as there are no registery settings as described by symantic, i have sent symantic an email see what they say.jtk