RE: Survey.exe

["Merunka, Steffen" <Steffen.Merunka () compaq com>]

Hi,
if this is a Compaq box, this might be the survey utility, which is used to
inspect
and report system configuration for support purposes. It gathers hardware
and software 
information and saves it as a history of multiple sessions in a single
configuration 
history file.

If installed through the SmartStart server setup process, by default it
gathers information 
every Wednesday at noon, and at every power-on. If installed from the Compaq
Integration 
Maintenance Utility or the Compaq Management CD and no additional command
line parameters 
were added, by default it gathers information every Sunday at midnight and
at every 
power-on. 

Check for a file survey.txt, default in c:\compaq\survey, which contains the
report.
You might as well have the web agents enebled, accessible via
http://localhost:2301/

steffen


-----Original Message-----
From: Ken Fox [mailto:kenfox () starlinx com]
Sent: Sunday, May 30, 1999 7:39 PM
To: 'firewall-wizards () nfr net'
Subject: Survey.exe




        Folks --        

        Anyone running an NT box seen a program called Survey.exe in thier
task manager window? This puppy was sucking up 100% of  the CPU ...   I
hadn't recalled ruinning anything that would generate such a program ;
however, I was online at Microsoft's web site at the time (patches /
downloads / etc) ... when I killed the process (not a terribly smart idea in
WIndows, I noticed aa red Icon dropped out of the systray, kinda looked like
a wizard or a mutated AOL icon) Assuming this is a hacker poking around ,
has anyone seen this before. Specifically, I killed him rather than let him
play -- OTOH I am planning on a dedicated hook-up with a firewall rather
than Dial up ... (turns out I moved in to an area with 7.1Meg ADSL
available.... 

         I hadn''t gotten to installing / downloading BOF yet (it is now) --
Specifically though, if anyone has seen this program before, what ports & so
forth is it using and therefore what would we look for in a IDS or block
with a firewall?

        I searched bugtraq for survey.exe under the assumption that it was
malicious and/or had been seen before.

Thanks< ken