Script being executed on my NT Server

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

bnmohan

Thread Starter
Joined
Jan 9, 2006
Messages
26
Hi! 9 Jan 2006

On Thursday last, a command prompt window suddenly popped up on the server : it was trying to execute Explore.exe with c:\//http:passthewebring.... (EXPLORE.EXE). The command fails, and on OK, the window closes.
Mcafee is uptodate on the server.
I have a broadband connection. (And no firewall :-( )
There are about 20 pcs on the LAN, and I try my best to keep them uptodate with McAfee/Norton.
I do not exactly remember the sequence of the attempted executes on the server, (it has happened twice)
I posted the HJT log at hijackthis.de and I got the analysis, which says IRCSERV.EXE is running, and it says it is an unknown process. There is nor Relay chat faclility I provide.
It also complained about 'Findthewebsiteyouneed' entries in HKLM\sw\ms\ie\main,search page=, which are I think remnants of some earlier search assistant.
I post the log here, and hopefully it will make sense to someone.

Mohan

UPDATE : The command window popped up again today : the commands that were shown were:
c:\>iexplorer c:\winnt\system32\cmd.exe
(The name specified is not recognized......)
c:\>explorer.exe "http://www.passwebring.com\cgi-bin/auto/rankem.cgi?id=securex"
(the path "c:\http://www.passwebring.com/.... does not exist or is not a directory)

When I click on OK, the command window vanishes, but it reappeared a few minutes later.

Pl help!

Mohan
 

Attachments

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top