I have seen on several of our W2K Servers instances of srvany.exe running several times. When I look in the services tab, there are services such as "Real Updater," "Version Manager" and "Secure Logon" that are running and their path is all the same: c:\winnt\system32\srvany.exe When you try to click on properties for them you get this message: Configuration Manager: The specified device instance handle does not correspond to a present device. Obviously these are some kind of worm or back door. Does anyone know what they are? I find they also come with a program called userinits.exe (instead of the standard userinit.exe that is part of windows) as well as a file named winlog.exe (userinits.exe is actually runh.exe in disguise). What is this and is there a removal tool?

I don't know about back door or worm. But if you want to see what processes are listening on which ports, download and install Active Ports. It will tell you what applications and processes are listening for connections, and what the file path is to that application.