Re: 答复: Hacked again???

[Vijay Vikram <karpagamekapali () gmail com>]

More information on the "good" processess running in the computer -
DLLs and EXEs can be seen in

http://www.processlibrary.com/

If the process is not listed in here , we can also run the 

http://www.sysinternals.com/Utilities/ProcessExplorer.html

to find the veracity of the same. 

Finally as  Yu Haitao David pointed , a HijackFix scan will yeild
results to remove the "bad" stuff


regards
KKDU

On 6/16/05, Yu Haitao David <davidyu () tencent com> wrote:
> check via googling...
>
> winproc.exe   ---- from http://www.trojaner-board.de/showthread.php?t=2153,
> it must be a  brwoser hijacker, use spyware tools to remove it
>
> Rpcservice.exe    ------ no useful information, but from its name, must be
> a
> RPC server/client. mostly used in many trojans
>
> msnmsgr.exe  ------- if you are soure of that it is NOT from microsoft,
> then
> it IS the malicious process.
>
> what these three combination could do? hm, if they are really worked
> together, your PC might be trojaned or zombied, maybe totally controlled by
> someone else.
>
> you may solve this in the following steps:
>
> 1. using spyware removing tools, such as HijackThis, to check registry,
> delete obvious suspecious entry. especially in RUN;
> 2. reboot to Safe Mode, delete those files listed;
> 3. using some browser fixing tools, such as TweakUI, to restore your
> browser
> settings.
>
> hope it helped.
>
> -----邮件原件-----
> 发件人: Mauricio Fernandez [mailto:mfernandez () fdta-valles org] 
> 发送时间: 2005年6月15日 6:20
> 收件人: security-basics () securityfocus com
> 主题: Hacked again???
>
> Hi…
>
> I am not sure, but I think that I was hacked again.
>
> I have a w2k SP4 full patched box with KerioFirewall, and this morning I
> found three running process on it:
> Winproc.exe
> Rpcservice.exe
> Msnmsgr.exe
>
> The last one it is not the Messenger from Microsoft…
>
> I google those file names, but all I found was in Japanese/Hebrew or
> something...
>  
> Does anyone know some attack with this three files combination?
>
> TIA
>
>
>
> Mauricio Fernández S.
> IT Manager
> Tel. 591- 445-25160
> Fax. 591- 441-15056
> mfernandez () fdta-valles org
> www.fdta-valles.org
> Cochabamba - Bolivia