InterviewSolution
Saved Bookmarks
InterviewSolution
| 1. |
Solve : Invisible hijacker?? |
|
Answer» I was in the school's computer lab doing some research for English I. (The PC is the exact one in GX1_Man's avatar) I had to use IE 6 SP1 and of course it was going slowly. I wanted to get Email, so I could get a link I Emailed myself. I try to go to hotmail.com. That's exactly what I type. However, it takes me to http://hotmail.com.org, which is NOT what I wanted. I think to myself, "browser hijacker". So, I pull out my binder and extract my HJT diskette* (yeah, floppies have a use), pop it in, and scan. I don't see anything out of the ordinary. In fact, I've never seen a cleaner log: C:\WINNT\Explorer.EXE I Google'd for a few .exe files (difficult) but found nothing. It appears clean, even the last one appeared to be OK. Typing in the http and all the rest RETURNS a 404 error (as it turns out, Email is blocked in the lab...). But at this point, my concern is ridding the PCs of the hijacker, because if that can get through, what else can? We only have Norton for protection there, and if a virus gets on there... well, we use floppies a lot in that lab... other PC's nearby were slow as well, but I didn't check for the hijacker there. So what's up? *I don't know if there is a rule about floppy programs or not, but I haven't heard one... Quote The PC is the exact one in GX1_Man's avatar<---------------- A fine machine indeed! DWRCST.exe could be Cptv.Windir.Malware, can you get the file byte size? Check the HOSTS file. I'll see about getting that as soon as I can. Dilbert... DWRCST.exe The dwrcs.exe is process required to allow other computers to connect to you computer using the DameWare remote control client. If you do not use DameWare remote administration software you should terminate this process. dwrcs.exe is an application that does NOT appear to be a security risk Given that nothing showed up in the scans , I would say its harmless. dl65 Malware Group Cptv.Windir.Malware Vendor DameWare Development Product DWRCST Tray Icon Version 5, 0, 1, 1 Path Name %WINDIR%\ SYSTEM32\ File Name DWRCST.exe Behaviour Modifies the hostsfile File Size 85504 Observed Behaviour - Cptv.Windir.Malware was first detected by Prevx1 on Jul 16 2005. Could use your PC to send mass mail using SMTP protocols. Modifies Internet Browser Settings:(HomePage). Creates multiple copies of the Malicious infection on your PC. Creates registry run keys to ensure it is restarted every time you boot your PC. Installs other malicious programs. Examines which processes are running on your PC allowing it to explore vulnerabilities in Windows and your antivirus and anti-spyware products. Modifies the HostsFile which could stop your antivirus or anti-spyware protection or PUT your personal information at risk. Connects with 3rd party computer systems and forwards data via the internet. Hijacks other processes. You will find out for sure when you check the file size. Check your HOSTS file for re-directs.OK. Soon as I can. I couldn't get into the computer lab today though; testing. :-/ |
|