Strange processes/windows popping up -- WinXP

Jeff Bollinger jeff01 at email.unc.edu
Mon Jan 5 15:33:22 GMT 2004


Has anyone seen behavior as mentioned in the Google groups site below?

http://tinyurl.com/29f7f

We've noticed an instance of this and have not been able to find anymore 
information.  The netstat output seems standard (no Fport report yet), 
The user has had Spybot installed and updated as well as SAV and its 
definitions (scans of both reveal nothing).  An Nmap of that host 
reveals nothing other than the standard Windows ports (137,139, etc.)

These are the names of the windows that popped up on the desktop:

Action
MyTest
MCI Command Handling window
ActiveMovie Window
Notification Wnd for RNAdmin
Scan (norton av, this was unscheduled)
Connections Tray
Media Event Sink Window
NetDDE Agent
XPCOM: Event Reciever
VPIPCLINK

The windows look like Messenger windows, but we're filtering for that in 
numerous locations, and the service is not running on the user's host.

Any ideas?

Thanks,
Jeff

-- 
Jeff Bollinger, CISSP
University of North Carolina
IT Security Analyst
105 Abernethy Hall
mailto: jeff @unc dot edu



More information about the unisog mailing list