Strange Service is showing up on PC's on our network

From: Knight, Jim (Jim.Knight_at_YUM.COM)
Date: 01/29/04

  • Next message: Russ: "Re: Strange Service is showing up on PC's on our network" 
    Date:         Thu, 29 Jan 2004 11:29:44 -0500
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    I wanted to find out if anyone has seen this in the last couple of days.

     

    I received a call from a Support Person saying that there is a process
    running on his system that he didn't recognize and after some
    investigation and some warnings from Cisco CSA about a process trying to
    drop itself on my computer I have the following information.

     

    Process file name is NTOSA32.EXE and it is listed on a computer with it
    running as Distributed File Controller. With a dependency to RPC. ALL
    of the systems that this has attacked are 100% patched and have virus
    Definitions of 1/28/2004.

     

    It seems to be linked to another file NTBKH32.DLL

     

    As I was investigating this I got several warnings from CSA telling me
    the File NTOSA32 was trying to capture keystrokes and right a file
    (RANDOMCHARACTERS.VDA)

     

    I also got information from our Network Services team saying that they
    had to block one of our links to Australia due to the fact it was
    slamming the router at 99%. This may have been where the original came
    from.

     

     

    Anyone seen anything or know of anything dealing with this? Searches on
    Google, MS and SARC reveal nothing.

     

    Thanks,

     

    Jim

     

     

    This communication is confidential and may be legally privileged. If you are not the intended recipient, (i) please do not read or disclose to others, (ii) please notify the sender by reply mail, and (iii) please delete this communication from your system. Failure to follow this process may be unlawful. Thank you for your cooperation.

    -----
    NTBugtraq Editor's Note:

    I'm looking for an event at which I can speak in Australia, specifically near Brisbane, as close to Christmas as possible. Anyone interested in flying me down under at that time, please contact me at Russ.Cooper@rc.on.ca
    -----

  • Next message: Russ: "Re: Strange Service is showing up on PC's on our network"

    Relevant Pages

    • Re: ADA To Change Thinking On Low Carb Diets?
      ... and Australia & Crime Statistics & do a comparison ... ... as they in locations within her country that she does not live. ... Americans are saying the problem not only exists but is much greater ... in some way USA vs Oz to anything about crime statistics. ...
      (alt.support.diabetes)
    • Re: Ubuntu 8.04 Is Ready to Take On Windows
      ... and crash his or her system. ... As for removing packages so as to rend the system unusable, ... without getting full flagged warnings. ... you could have a message saying that "beware! ...
      (Ubuntu)
    • Re: Remember the Dover Bronze Age boat discussion?
      ... They are still raising money and will do so for ... >>saying they brought them into the modern age. ... If anyone,country or people, deserve to be praised, ...
      (sci.archaeology)
    • Re: What happened to MFW?
      ... Curt wrote: ... and saying anything nice. ... He's from Australia. ... populated by criminals" thing. ...
      (misc.fitness.weights)
    • Re: Aussie Arrogance (or does it come with the territory?)
      ... He's saying that all the other ... Ponting (even though Ponting isn't actually arrogant, ... his detractors have this perception). ... He's the same guy who started the thread about Australia currently ...
      (rec.sport.cricket)