mailing list archives
Re: Hacked again???
From: Christoph 'knurd' Jeschke <christoph.jeschke () gmail com>
Date: Tue, 21 Jun 2005 00:43:51 +0200
Valentin Höbel schrieb:
so for the appearance of the process, he has to start the messenger
And the integrity of the msnmsgr.exe is important, too. Malware can
easily replace a existing msnmsgr.exe or simply create a new one at
another place (like Rbot did - especially if a user is over-privileged.
To be sure, the OP should take sysinternals Process Explorer.
If he did, then the problem in this way is solved, bit if he didn't,
there would still be an open question.
He should check very carefully every running process.
Re: Hacked again??? Christoph 'knurd' Jeschke (Jun 17)