error windows cannot open this file TFTP3124

[Cris Anderson]

I have a user that recieves this message when Windows XP
is starting to load. There's actually 4 of them
TFTP3124
TFTP2160
TFTP1564
TFTP3696
Has anyone seen this before?

[Rich Barry]

a.. TFTP [port 69] = Trivial File Transfer Protocol used for uploading and
downloading files to and from TFTP host servers, which do not restrict
access. Block only for outbound (outgoing).

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xf4da506d69a7d711abdc0090277
a778c,00.html

"Cris Anderson" > wrote in message
...
> I have a user that recieves this message when Windows XP
> is starting to load. There's actually 4 of them
> TFTP3124
> TFTP2160
> TFTP1564
> TFTP3696
> Has anyone seen this before?

[Kent W. England [MVP]]

This is evidence of what is called an "autorooter" trojan. It probably
came in through your RPC ports. This attack has already been seen
against the vulnerability described in MS03-026.

You need to run your anti-virus and anti-spyware programs to identify
this trojan and begin to remove it. But disconnect from the Internet
immediately to prevent the hacker from accessing your machine from the
Internet and possibly installing other trojans and malware. Once they
are in and your machine "phones home", the game is up, so move quickly.

Worst case, you have to do a clean reinstall to rid all vestiges of
programs that compromise your system security.

--
Kent W. England, Microsoft MVP for Windows



"Cris Anderson" > wrote in
message ...

> I have a user that recieves this message when Windows XP
> is starting to load. There's actually 4 of them
> TFTP3124
> TFTP2160
> TFTP1564
> TFTP3696
> Has anyone seen this before?