Help!!! I think someone has hijacked my system:
I noticed a new login account from my control panel today named: alg.exe on Machine A....it was a password login. It did not appear on my normal login screen. I deleted the account, however it is running in my task manager as alg.exe, anyone know what that is??????????
Also, I have noticed that when I log into my forum (I am the owner) as soon as I log into the admin features, a guest IP appears. I have blocked that IP from the forum but it appears to happen everytime I go into the admin features.
Additionaly, my website was attacked earlier this week and while I'm pretty sure I know who it was I cannot imagine how this person got the password (not that I'm going to use it again but it was .@$Gc(7Tn ) pretty dang hard to crack I would imagine. Any ideas??????????????

Thanks Nick

system:
windows xp home, sp 2, with all the updates

Hi there ltnick2k6 , welcome to PCHF.


That you have an alg.exe showing in youre taskmanager is probebly normal , check if the location of the file is ok:

http://process.networktechs.com/alg.exe.php

But an user account named alg.exe on startup.. no , that indeed doesn't sound normal.

Lets have a look if there is some malware on youre pc , if you click on the "Prework" link below in my sig , follow the instructions there and post back with the 2 log files we'll have a look at that.

Help!!! I think someone has hijacked my system:
I noticed a new login account from my control panel today named: alg.exe on Machine A....it was a password login. It did not appear on my normal login screen. I deleted the account, however it is running in my task manager as alg.exe, anyone know what that is??????????
Also, I have noticed that when I log into my forum (I am the owner) as soon as I log into the admin features, a guest IP appears. I have blocked that IP from the forum but it appears to happen everytime I go into the admin features.
Additionaly, my website was attacked earlier this week and while I'm pretty sure I know who it was I cannot imagine how this person got the password (not that I'm going to use it again but it was .@$Gc(7Tn ) pretty dang hard to crack I would imagine. Any ideas?????????????? I have run spybot and found nothing.

Thanks Nick

system:
windows xp home, sp 2, with all the updates

Hya ltnick2k6 , ive merged youre 2 threads now but please stick to one thread.

I dont see anything wrong in youre hjt log. Did you also do the Ewido scan? Can you post the log from that aswell?

Do to lack of feedback, and seeing as the pc is clean, marked as Fixed.


Now that you are clean I would like to direct you to the Now That You Are All Clean / Malware Prevention , AKA "Afterwork" to try to limit the change of a reinfection as much as possible.