Re: identifying malware process
"Voytek Eymont" <[email protected]>
| Newsgroups | gmane.org.user-groups.slug.chat |
|---|---|
| Message-ID | <[email protected]> |
On Mon, November 17, 2008 8:58 am, Dave Kempe wrote: > Sounds like anti-virus 2009. > get malwarebytes. that fixes it Dave, thanks yes, it was, and, I did get malwarebytes what I'm curious, though, that I was not able to identify what was causing the pop up balloon to go up? when I clicked on the balloon, I could identify what was starting, and, source of traffic, but, I couldn't identify what sent the balloon up also, it cleaned up, BUT, I still get strange traffic on port 21260 to hosts all over the place, that I can not identify what it is > dave > > Voytek Eymont wrote: > >> I've got an XP with some sort of malware sending notification popup >> 'your >> computer is infected' >> >> I thought systeminternals 'process explorer' would show and help in >> identifying what process is the rogue process ? but, not having much >> luck >> >> clicking on balloon starts a process that tries to download stuff from >> remote server, and, that process I can identify in 'process explorer', >> and, from that, several related files >> >> but, I can not identify anything that makes the ballon come up, can >> that be running hidden in a 'normal' process >> >> what other tools are there for identifying that sort of stuff ? >> >> >> >> > -- Voytek -- SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html