What is this from firewall?

[George Rundy]

I started to get this popup from Kerio. It is persistent and I need to know
whether to allow it?
"Generic Host Process for Win32 Services, 65.163.23.142, Port 666"

[sponge]

On Sun, 5 Oct 2003 07:15:59 -0400, "George Rundy"
<Geo99RB@hotmail.com> wrote:

>I started to get this popup from Kerio. It is persistent and I need
to know
>whether to allow it?
>"Generic Host Process for Win32 Services, 65.163.23.142, Port 666"

Almost certainly the Satan's Backdoor trojan.

Forward a complaint with as much info as you can provide to:
abuse@sprintlink.net, security@sprintlink.net and abuse@austintx.com,
hostmaster@austintx.com (Virtual Global Communications). Preferably
two separate emails each. The top-tier hosting provider is Sprintlink,
and they will nuke the IP and investigate if VGC doesn't. You can also
call Sprintlink to follow up at 1-800-877-7330, possibly option 4 then
4 (don't know if that number or options are still current; I haven't
had to deal with Sprint in awhile, fortunately.)

Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 et yahoo dot com

[George Rundy]

I can do that, but how do I get rid of this? I have AdAware and Spybot and
have used them today.
AdAware did not find anything and Spybot did not find anything either. Can
I search through my registry or is there any other advice or suggestions?

"sponge" <yosponge@yahoo.com> wrote in message
news:8d76ec03.0310051650.72a3168f@posting.google.c om...
> On Sun, 5 Oct 2003 07:15:59 -0400, "George Rundy"
> <Geo99RB@hotmail.com> wrote:
>
> >I started to get this popup from Kerio. It is persistent and I need
> to know
> >whether to allow it?
> >"Generic Host Process for Win32 Services, 65.163.23.142, Port 666"
>
> Almost certainly the Satan's Backdoor trojan.
>
> Forward a complaint with as much info as you can provide to:
> abuse@sprintlink.net, security@sprintlink.net and abuse@austintx.com,
> hostmaster@austintx.com (Virtual Global Communications). Preferably
> two separate emails each. The top-tier hosting provider is Sprintlink,
> and they will nuke the IP and investigate if VGC doesn't. You can also
> call Sprintlink to follow up at 1-800-877-7330, possibly option 4 then
> 4 (don't know if that number or options are still current; I haven't
> had to deal with Sprint in awhile, fortunately.)
>
> Sponge
> Sponge's Secure Solutions
> www.geocities.com/yosponge
> My new email: yosponge2 et yahoo dot com

[Lou Rosse]

George Rundy wrote:

> I started to get this popup from Kerio. It is persistent and I need to know
> whether to allow it?
> "Generic Host Process for Win32 Services, 65.163.23.142, Port 666"

Maybe the Attack FTP trojan.
http://www.iss.net/security_center/a...TP/default.htm