The Planet Forums > hr.exe cl.exe

The Planet Forums > Security > General Security > Windows Security

seventech

May 25 2004, 05:50 AM

upon logging on to my server today (w2k3) the following cmd file ran, any odea what it is? Should I be concerned about it?

CODE

C:Documents and Settingsdeej>net start netlpt

System error 2 has occurred.

The system cannot find the file specified.

C:Documents and Settingsdeej>net start netcom

System error 2 has occurred.

The system cannot find the file specified.

C:Documents and Settingsdeej>sleep.exe 3

'sleep.exe' is not recognized as an internal or external command,

operable program or batch file.

C:Documents and Settingsdeej>hr.exe cl.exe 127.0.0.1 -sys

[/code]

Lunch[box]

May 25 2004, 04:07 PM

Haven't seen anything exactly like that before, but I would be rather worried right now.

If your not running a firewall I would suggest setting one up immediatly and going through the system looking for anything else suspicious.

CyberBabe

May 25 2004, 04:46 PM

Try running an online virus scanner. This one is free and works on windows 2003. Go to this address from your server :

http://housecall.trendmicro.com/

Cope

May 25 2004, 05:21 PM

QUOTE

net start netlpt

Network start internet printer ports?

All serious here, I have never heard of any of those.

Google usually lends a hand, but nothing strange showed up.
Only thing I could see hr.exe appears it has something to do with a virus, the cl.exe is part of Visual C++,

Im at a loss as to what it might be...

eddy2099

May 25 2004, 05:25 PM

Did you create the user 'deej' and if not, find out who that is and how they got access to your machine. Those listed there does seems strange and it does look like some kind of undesirables on your machine. Best to remove them, do a virus scan and check to see how your server security is breached.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.