RE: adun.exe

["Beauford, Jason" <jbeauford () EightInOnePet com>]

Try some nice tools like:  

SYSINTERNAL's "Strings" tool:
http://www.sysinternals.com/files/strings.zip or
SYSINTERNAL's "Streams" tool:
http://www.sysinternals.com/files/streams.zip or
FOUNDSTONE's "BINTEXT" tool:
http://www.foundstone.com/resources/termsofuse.htm?file=bintext.zip or 
HHD's "HEXEDITOR" tool (it's free)
http://www.hhdsoftware.com/Download/hexedfull.exe 

You can scan the file for certain strings or Alternate Data Streams to
gain more information on the file and what it does.

My $.02.

JMB

-----Original Message-----
From: Omar Khawaja [mailto:omarkhawaja () yahoo com] 
Sent: Tuesday, November 09, 2004 7:16 AM
To: security-basics () securityfocus com
Subject: RE: adun.exe


That's the thing - I've never installed Starcraft or Warcraft on this
machine. I'm thinking it might be the modem. I did a search for adun.exe
on the machine and there were no files found - which is what got me
suspicious to begin with. 

-----Original Message-----
From: Edmunds, Ron [mailto:ron.edmunds () dwd state wi us] 
Sent: Monday, November 08, 2004 2:11 PM
To: Omar Khawaja; security-basics () securityfocus com
Subject: RE: adun.exe

According to Yahoo search it has something to do with Starcraft TBL
files.

 -----Original Message-----
From:   Omar Khawaja [mailto:omarkhawaja () yahoo com] 
Sent:   Monday, November 08, 2004 7:43 AM
To:     security-basics () securityfocus com
Subject:        adun.exe

I have this process called "adun.exe" running on a Windows XP Home
laptop. Any idea what this process is for? Is it malicious? For the
first time ever, a Google search yielded no results. Any help would be
greatly appreciated.

__
Omar Khawaja