Jump to content


Need Help. PhOtOShOp.exe

  • Please log in to reply
2 replies to this topic

#1 jkehler



  • Full Member
  • Pip
  • 12 posts

Posted 10 September 2004 - 01:15 PM

HI. My daughter and friend last weekend somehow "I don't know Dad" infected my computer with a couple of trojans and other evil things. After many hours and mult attempts I have managed to get all of them put except the PhOtOShOp.exe thing. Trojan hunter says that it is present. On the port scan it says:

Port 3001/TCP is open (MAtches AntiPC.100. Port being used by process PhOtOShOp.exe/PID 1260 and

Port 3001/TCP is open (matches Error32.100. Port being used by process PhOtOShOp.exe/Pid 1260

I have run norton, adware, spybot, and hijack this all in safe mode. Still can't get rid of this thing. Google search does not turn up anything. Symantec same.

Any ideas where this thing is hiding and hpw to get rid of it?

Thanks J

#2 Untouchable J

Untouchable J

    Advanced Member

  • Full Member
  • PipPipPip
  • 205 posts

Posted 10 September 2004 - 03:45 PM

Good Afternoon,

What is the location of this file? Do a seach with Windows Explorer to locate PhOtOShOp.exe. Make sure to have "Search hidden files and folders" and " Search subfolders" checked.

I would also advise to run some online scans:

Panda Activescan
Bitdefender free online scanner
Trend Micro free online scanner
Mcafee free online scanner

Clean/Delete anything it detects and post the results here.


Edited by Jrshaw62, 10 September 2004 - 03:45 PM.

#3 killer4prez



  • Full Member
  • Pip
  • 16 posts

Posted 12 September 2004 - 10:29 AM

Tell your daughter not to open suspicious mail

What is the location of this file?

It copys itself to many files.

C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Norton AntiVirus 2003.exe

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.HLLW.Bandie.

Member of UNITE
Support SpywareInfo Forum - click the button