Temporary Processes Appear on IIS server

mep2D41.tmp.exe and its ilk

[IanTurner]

Has anyone any idea what is causing these temporary processes?

Are they just microsoft incompetance or have we got a trojan?

[DaveAtIFG]

Can any of you IIS gurus provide some insight on this? Help!!

[Dreamquick]

Personally I can't think of any valid reason for IIS to create temporary exe files - my initial thoughts were along the lines of the box having a security hole which is being exploited by someone or something.

If you google for "IIS .tmp.exe mep" you seem to find a whole heap of pages talking about Nimda infections and the files it creates. The most official / reliable link from the first page was;

www.ciac.org/ciac/bulletins/l-144.shtml

This explicitly mentions your mep*.tmp.exe files and strikes me as a very probable cause of those files being there.

Remember, google is your friend, even if you want help on obscure technical / security topics...

- Tony