full-disclosure - Possible Virus activity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <483387BD5310504F95897573FF3E350D1AAEB7@dpex.dpcorp.internal>
Date: Sat Apr 23 03:37:09 2005
From: jgrotegut at directpointe.com (Jonathan Grotegut)
Subject: Possible Virus activity

One of the things one of our techs has found is it is somehow related to Trend Office Scan, one of our techs killed all the services on one of the computer he could, he started them up one by one.  Once he started Trend Officescan service the System process spiked.  Possible update today on Trend that botched it?
 
Jonathan Grotegut

________________________________

From: Danny [mailto:nocmonkey@...il.com]
Sent: Fri 4/22/2005 8:25 PM
To: Benjamin Krueger
Cc: Jonathan Grotegut; full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Possible Virus activity



On 4/22/05, Benjamin Krueger <benjamin@...ttlefenix.net> wrote:
> You aren't alone. I'm fighting this bizzare problem on a network right now. 100% cpu usage
> on all affected machines. We don't see any unusual network traffic from these machines
> however. If the machine is rebooted, we can log back in but we never get to a useful
> desktop because the CPU is too busy doing other crap.

A detailed network sniff leads to nothing?

...D



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050422/cf891703/attachment.html