hrm... Server.exe? spyware/trojan/worm?

[Nospam9212]

On 9/12/03 3:59 PM Eastern Daylight Time, "|3iff //ullins"
biff_mullins3@3premeditatedfun.com wrote...

>i run windoze xp pro and have just noticed a "Server.exe" in my
>tasklist. it seems to be a 'system' process and it consumes around 2Mb
>of ram. i can't seem to locate the file "Server.exe" anywhere on my
>hard drives or in the msconfig startup list.
>
>anyone know what the h e double-toothpicks this is?
>
>thanks in advance.

Assuming you have quality anti-virus software installed... update the pattern
file and scan your whole hard-drive.

Get this piece of freeware...

http://www.xmlsp.com/pview/prcview.htm

....one of it's features is to show the entire process thread.


-= Francis Yarra =-
fyarraATjunoDOTcom
http://members.aol.com/fyarra001/ads - My drywall website
http://members.aol.com/fyarra001 - My C64 website
http://members.aol.com/prsnl99 - My personal website

[|3iff //ullins]

lucat bene, der nospam9212@aol.commune (Nospam9212) goh, a hunnert
truxx inero, sumwit kowz n' sumwit duxx on 15 Sep 2003 06:31:34 GMT:

>On 9/12/03 3:59 PM Eastern Daylight Time, "|3iff //ullins"
>biff_mullins3@3premeditatedfun.com wrote...
>
>>i run windoze xp pro and have just noticed a "Server.exe" in my
>>tasklist. it seems to be a 'system' process and it consumes around 2Mb
>>of ram. i can't seem to locate the file "Server.exe" anywhere on my
>>hard drives or in the msconfig startup list.
>>
>>anyone know what the h e double-toothpicks this is?
>>
>>thanks in advance.
>
>Assuming you have quality anti-virus software installed... update the pattern
>file and scan your whole hard-drive.
>
i figured it out. it was a ftp server i installed which installed
itself as a system service even though i oped out of that option. the
server has been uninstalled.

>Get this piece of freeware...
>
>http://www.xmlsp.com/pview/prcview.htm
>
>...one of it's features is to show the entire process thread.
>
that is an awesome piece of software. thanks for the link!

--
fruit flies when you're having fun.

[Randall Bart]

'Twas 15 Sep 2003 06:31:34 GMT when all alt.privacy.spyware stood in awe
as nospam9212@aol.commune (Nospam9212) uttered:

>Get this piece of freeware...
>http://www.xmlsp.com/pview/prcview.htm
>...one of it's features is to show the entire process thread.

Thank you, that's a real eye opener. That will be a great tool for
studying the system, but there sure is a load of crap just in the stuff I
want to run. Mozilla has 25 threads and there is only one window open.
Eudora has 11 threads. Agent has "only" four.

DirectCD has four threads and I never use it. Why do I have five svchost
processes, one of them with about 50 threads? What is alg.exe? What is
MUPOTL.exe? Why is SSCrdy.exe running when the camera is off? What is
all this crap?

--
RB |\ © Randall Bart
aa |/ admin@RandallBart.spam.com Barticus@att.spam.net
nr |\ Please reply without spam I LOVE YOU 1-917-715-0831
dt ||\ http://RandallBart.com/ Ånåheim Ångels 2002 World Chåmps!
a |/ Multiple sclerosis: http://www.cbc.ca/webone/alison/
l |\ DOT-HS-808-065 The Church Of The Unauthorized Truth:
l |/ MS^7=6/28/107 http://yg.cotut.com mailto:s@cotut.com

[|3iff //ullins]

lucat bene, der Randall Bart <Barticus@att.spam.net> goh, a hunnert
truxx inero, sumwit kowz n' sumwit duxx on Sun, 21 Sep 2003 21:13:55
GMT:

>'Twas 15 Sep 2003 06:31:34 GMT when all alt.privacy.spyware stood in awe
>as nospam9212@aol.commune (Nospam9212) uttered:
>
>>Get this piece of freeware...
>>http://www.xmlsp.com/pview/prcview.htm
>>...one of it's features is to show the entire process thread.
>
>What is alg.exe?
>
FILENAME: Alg.exe.
PROGRAM NAME: Application Layer Gateway.
DESCRIPTION: Part of Windows XP that provides support for ICS and
Internet Connection Firewall (ICF).
RECOMMENDED ACTION: If a third-party firewall warns you that ALG.exe
wants access, check to make sure you're not double-firewalled. If you
are, disable ICF. If you are using neither ICF nor ICS and are warned
that ALG.exe is trying to access the Net, deny it. A Trojan horse or
worm may be trying to use it as a backdoor.

>What is MUPOTL.exe?
>
found only one reference to it in google. it was on a chinese page, so
i can't tell ya what it is.

>Why is SSCrdy.exe running when the camera is off?
>
wild guess: its in your startup list? run msconfig and find out!

>What is all this crap?
>
a bunch of crap.

--
"Never write device drivers while on LSD!"
-MJ Dominus

[Randall Bart]

'Twas Mon, 22 Sep 2003 01:00:56 GMT when all alt.privacy.spyware stood in
awe as "|3iff //ullins" <biff.mullins3@3premeditatedfun.com> uttered:

>>What is MUPOTL.exe?
>>
>found only one reference to it in google. it was on a chinese page, so
>i can't tell ya what it is.

I hope the page you found was in Japanese not Chinese. This computer is
Sony Vaio PCG-C1MRX, a model only sold in Japan. The keyboard has been
replaced with a USA keyboard, but it still has Japanese Windows, running
in English language mode. I know that it slips into Japanese keyboard
mode sometimes. This program may have to do with mode changing.
--
RB |\ © Randall Bart
aa |/ admin@RandallBart.spam.com Barticus@att.spam.net
nr |\ Please reply without spam I LOVE YOU 1-917-715-0831
dt ||\ http://RandallBart.com/ Ånåheim Ångels 2002 World Chåmps!
a |/ Multiple sclerosis: http://www.cbc.ca/webone/alison/
l |\ DOT-HS-808-065 The Church Of The Unauthorized Truth:
l |/ MS^7=6/28/107 http://yg.cotut.com mailto:s@cotut.com