DHCP-Client000000 ?

[USMC1775]

I have a 2000 Advanced Server. In re-checking services I found an odd item.

Item is called "DHCP-Client000000".
It was set in startup as automatic. The service was stopped. I made it disabled. It had no dependencies.

It is described as, "Provides FTP services and allows remote FTP clients to connect to this computer"

The file name it wants to run is "WINNT\repair\rundll32new.exe".

A search shows this file not on any drive of this server. A web check via Google search found nothing on the service name or filename.

The unit has been coprimised before by Warez. I have already moved my valuable files and am just curious about this.

 

[viol8ion]

Run Hijack this (link provided on my page of free downloads)

http://www.wuli.com/free.shtml

I would suspect a trojan or zombie, if you were cpompromised by warez perhaps someone has you set up as a warez ftp site....



When in doubt, deny all terms and defnitions.

http://www.wuli.com

 

[USMC1775]

Thanks viol8ion,

I ran Hijak when I first became concerned at the beginning of the year. I killed the known items Hijack pointed out and also those I could find. Mostly Dameware and Serv-U. You are correct that I had a Warex FTP going on. Those also have been deleted. Thankfully this unit was not storing "real" data. It just had not been taken offline yet.

This was one item (DHCP-Client000000) that I had not seen in Hijack or any other Trojan info areas.

thanks again.