Home page logo

basics logo Security Basics mailing list archives

Re: Hacked again???
From: Christoph 'knurd' Jeschke <christoph.jeschke () gmail com>
Date: Tue, 21 Jun 2005 00:43:51 +0200

Valentin Höbel schrieb:

so for the appearance of the process, he has to start the messenger
one time.

And the integrity of the msnmsgr.exe is important, too. Malware can
easily replace a existing msnmsgr.exe or simply create a new one at
another place (like Rbot did - especially if a user is over-privileged.

To be sure, the OP should take sysinternals Process Explorer.

If he did, then the problem in this way is solved, bit if he didn't,
there would still be an open question.

He should check very carefully every running process.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]