iis and w32.nimda.A@mm (dr)

From: alec pringle (apringle_at_itsupportsolutions.com)
Date: 07/12/03 

Date: Fri, 11 Jul 2003 18:31:52 -0700

I need some help please. After I reinstalled iis there is
a process that creates files (tftpxxxx, where x is a
random number). As these file are created Norton detects
them and deletes them with a warning message for each
(probably 100 times a day). This process kicks off
ramdomely as far as I can tell. The files are created
in /Inetpub/Scripts/.

I can see the process (tftp.exe) start using Task
Manager. Sometimes there will be 7 or 8 of these
processes running, each creating a new file that Norton
flags. I have deleted tftp.exe from /winnt/system32, but
each time I reboot, it is recreated somehow.

I downloaded a tool from Norton to remove this virus, but
it only remove the infected fttpxxxx file, not WHATEVER IS
CREATING THEM.

If I remove IIS, it goes away, but I need it.
ANY SUGGESTIONS?

Thanks

Quantcast