Need Help. PhOtOShOp.exe
Posted 10 September 2004 - 01:15 PM
Port 3001/TCP is open (MAtches AntiPC.100. Port being used by process PhOtOShOp.exe/PID 1260 and
Port 3001/TCP is open (matches Error32.100. Port being used by process PhOtOShOp.exe/Pid 1260
I have run norton, adware, spybot, and hijack this all in safe mode. Still can't get rid of this thing. Google search does not turn up anything. Symantec same.
Any ideas where this thing is hiding and hpw to get rid of it?
Posted 10 September 2004 - 03:45 PM
What is the location of this file? Do a seach with Windows Explorer to locate PhOtOShOp.exe. Make sure to have "Search hidden files and folders" and " Search subfolders" checked.
I would also advise to run some online scans:
Bitdefender free online scanner
Trend Micro free online scanner
Mcafee free online scanner
Clean/Delete anything it detects and post the results here.
Edited by Jrshaw62, 10 September 2004 - 03:45 PM.
Posted 12 September 2004 - 10:29 AM
It copys itself to many files.
What is the location of this file?
C:\Program Files\Internet Explorer\iexplore.exe
C:\Norton AntiVirus 2003.exe
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":
Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.HLLW.Bandie.