missing mdm.exe

[PPC2k]

HI all,

Our Win2k Server was hacked by IRC.Flood trojan, while repairing I had to delete mdm.exe in \System32 folder. How do I get this file. There are DCOM errors in the event log saying that:
Unable to start DCOM Server: {E367E1A1-E917-11d0-AF5F-00A02448799A} as/. The error: "The System cannot find the File specified" - Happened when starting this command:
C:\WINNT\System32\mdm.exe-Embedding

I could not find this file on Windows 2000 Server CD to copy. I also get other DCOM errors in event log which might be of this problem.

Thanks,
ppc2k

 

[GlenJohnson]

Check this out.

http://www.cexx.org/rpcss.htm

http://support.microsoft.com/default.aspx?scid=KB;en-us;q221438

Glen A. Johnson
Johnson Computer Consulting
MCP W2K
glen@johnsoncomputers.us



"What really happens is trivial in comparison to what could occur."
Robert von Musil (1880-1942); Austrian author.

 

[PPC2k]

Thanks Glen..

Do I need to have it on server or not have it. Please let me know if server needs mdm.exe

Thanks,
ppc2k

 

[GlenJohnson]

Per microsoft

SYMPTOMS
After you install Office 2000, you may notice files whose name begins with "fff" appearing in your Windows folder. For example, the file name may be similar to "fffeeecf_{44BE8B61-235B-11D2-8E66-D59A4E66D32D}.tmp". Also, every time you restart your computer, two more files beginning with "fff" appear in your Windows folder.
CAUSE
When you install the Microsoft Script Editor, a program called Mdm.exe (Machine Debug Manager, which is used to provide application debugging) is also installed.

You don't typically run office 2000 on a server, so I'd guess no. Glen A. Johnson
Johnson Computer Consulting
MCP W2K
glen@johnsoncomputers.us



"What really happens is trivial in comparison to what could occur."
Robert von Musil (1880-1942); Austrian author.

 

[PPC2k]

Thanks Glen,
There are no fff*.* files on the server now. Server crashes after reboot saying that DCOM server could not started as mdm.exe is not found. So, I was wondering if we need to have this file on server or forget about it.

Thanks very much

ppc2k