> > > Looks like IRC Backdoor > check registry: > HKLM\Software\Microsoft\Windows\CurrentVersion\Run and delete > entry with regsvc32.exe > (such as Registration Service = "regsvc32.exe") > Do the same with > HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
the port 1025 is good used for binding the task schuduler, is this doing something with the task schuduler. there are plenty of naughty things to do there .... -aditya ________________________________________________________________________ Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
