Strange processes/windows popping up -- WinXP

Jeff Bollinger jeff01 at
Mon Jan 5 15:33:22 GMT 2004

Has anyone seen behavior as mentioned in the Google groups site below?

We've noticed an instance of this and have not been able to find anymore 
information.  The netstat output seems standard (no Fport report yet), 
The user has had Spybot installed and updated as well as SAV and its 
definitions (scans of both reveal nothing).  An Nmap of that host 
reveals nothing other than the standard Windows ports (137,139, etc.)

These are the names of the windows that popped up on the desktop:

MCI Command Handling window
ActiveMovie Window
Notification Wnd for RNAdmin
Scan (norton av, this was unscheduled)
Connections Tray
Media Event Sink Window
NetDDE Agent
XPCOM: Event Reciever

The windows look like Messenger windows, but we're filtering for that in 
numerous locations, and the service is not running on the user's host.

Any ideas?


Jeff Bollinger, CISSP
University of North Carolina
IT Security Analyst
105 Abernethy Hall
mailto: jeff @unc dot edu

More information about the unisog mailing list