well i opened my computer and opened my hard drive today, and just as i was looking for program files folder, i noticed a very strange exe file. Under it (because im in tiles view it showed the company beklow the file name) it says Mooky Da KiD. as soon as i saw that weird name i googled it and all the results turned out to be botnet related things. I also found this myspace. I scanned the file with up-to-date AVG free and it turned out ok apparently. Here are more file information form the version tab when you right click t and select properties: Company: Mooky Da KiD File Version: 1.00 Internal Name: stub Language: English (United States) Original File Name: stub[Caution: ExecutableFile] Product Name: Stub Product Version: 1.00 heres a hijackthis log: [hide=Hijack this log]Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:27:32 PM, on 10/28/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss[Caution: ExecutableFile] C:\WINDOWS\system32\winlogon[Caution: ExecutableFile] C:\WINDOWS\system32\services[Caution: ExecutableFile] C:\WINDOWS\system32\lsass[Caution: ExecutableFile] C:\WINDOWS\system32\Ati2evxx[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: ExecutableFile] C:\WINDOWS\system32\Ati2evxx[Caution: ExecutableFile] C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService[Caution: ExecutableFile] C:\PROGRA~1\AVG\AVG8\avgwdsvc[Caution: ExecutableFile] C:\Program Files\Bonjour\mDNSResponder[Caution: ExecutableFile] C:\Program Files\COMODO\Firewall\cmdagent[Caution: ExecutableFile] C:\WINDOWS\eHome\ehRecvr[Caution: ExecutableFile] C:\WINDOWS\eHome\ehSched[Caution: ExecutableFile] C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm[Caution: ExecutableFile] C:\WINDOWS\system32\slserv[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\Program Files\Virtual CD v4 SDK\system\vcssecs[Caution: ExecutableFile] C:\Program Files\epgStream.net\wmcGuideServiceProxy\wmcGuideServiceProxyHost[Caution: ExecutableFile] C:\Program Files\epgStream.net\xmltvDownload\xmltvDownloadHost[Caution: ExecutableFile] C:\Program Files\epgStream.net\wmcGuideServiceProxy\wmcGuideServiceProxy[Caution: ExecutableFile] C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: ExecutableFile] C:\PROGRA~1\AVG\AVG8\avgrsx[Caution: ExecutableFile] C:\PROGRA~1\AVG\AVG8\avgemc[Caution: ExecutableFile] C:\WINDOWS\Explorer[Caution: ExecutableFile] C:\WINDOWS\system32\dllhost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\ehome\ehtray[Caution: ExecutableFile] C:\WINDOWS\eHome\ehmsas[Caution: ExecutableFile] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx[Caution: ExecutableFile] C:\WINDOWS\SOUNDMAN[Caution: ExecutableFile] C:\WINDOWS\ALCWZRD[Caution: ExecutableFile] C:\apps\ABoard\ABoard[Caution: ExecutableFile] C:\PROGRA~1\AVG\AVG8\avgtray[Caution: ExecutableFile] C:\Program Files\COMODO\Firewall\cfp[Caution: ExecutableFile] C:\apps\ABoard\AOSD[Caution: ExecutableFile] C:\Program Files\Microsoft Office\Office12\GrooveMonitor[Caution: ExecutableFile] C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl[Caution: ExecutableFile] C:\WINDOWS\system32\ctfmon[Caution: ExecutableFile] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: ExecutableFile] C:\WINDOWS\system32\uzcpgs[Caution: ExecutableFile] C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile] C:\Program Files\HP\Digital Imaging\bin\hpqtra08[Caution: ExecutableFile] C:\WINDOWS\system32\wuauclt[Caution: ExecutableFile] C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile] C:\Program Files\HP\Digital Imaging\bin\hpqSTE08[Caution: ExecutableFile] C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog[Caution: ExecutableFile] C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile] C:\Program Files\MSN Messenger\usnsvc[Caution: ExecutableFile] C:\Program Files\Trend Micro\HijackThis\HijackThis[Caution: ExecutableFile] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsupdate.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG[Caution: ExecutableFile]" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: ExecutableFile] /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: ExecutableFile] /IMEName O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray[Caution: ExecutableFile] O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut[Caution: ExecutableFile] O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx[Caution: ExecutableFile] O4 - HKLM\..\Run: [soundMan] SOUNDMAN[Caution: ExecutableFile] O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD[Caution: ExecutableFile] O4 - HKLM\..\Run: [Alcmtr] ALCMTR[Caution: ExecutableFile] O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard[Caution: ExecutableFile] O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray[Caution: ExecutableFile] O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp[Caution: ExecutableFile]" -h O4 - HKLM\..\Run: [Microsoft Update Machine] uzcpgs[Caution: ExecutableFile] O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor[Caution: ExecutableFile]" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl[Caution: ExecutableFile]" O4 - HKLM\..\RunServices: [Microsoft Update Machine] uzcpgs[Caution: ExecutableFile] O4 - HKCU\..\Run: [CTFMON[Caution: ExecutableFile]] C:\WINDOWS\system32\ctfmon[Caution: ExecutableFile] O4 - HKCU\..\Run: [Microsoft Update Machine] uzcpgs[Caution: ExecutableFile] O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: ExecutableFile] O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON[Caution: ExecutableFile]] C:\WINDOWS\system32\CTFMON[Caution: ExecutableFile] (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON[Caution: ExecutableFile]] C:\WINDOWS\system32\CTFMON[Caution: ExecutableFile] (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON[Caution: ExecutableFile]] C:\WINDOWS\system32\CTFMON[Caution: ExecutableFile] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON[Caution: ExecutableFile]] C:\WINDOWS\system32\CTFMON[Caution: ExecutableFile] (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08[Caution: ExecutableFile] O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL[Caution: ExecutableFile]/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: ExecutableFile] O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2558196265 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll C:\WINDOWS\system32\guard32.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: ExecutableFile] O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService[Caution: ExecutableFile] O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx[Caution: ExecutableFile] O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag[Caution: ExecutableFile] O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc[Caution: ExecutableFile] O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc[Caution: ExecutableFile] O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder[Caution: ExecutableFile] O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent[Caution: ExecutableFile] O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc[Caution: ExecutableFile] O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile] O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12[Caution: ExecutableFile] O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv[Caution: ExecutableFile] O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: ExecutableFile] O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs[Caution: ExecutableFile] O23 - Service: Windows Media Center Guide Service Proxy (wmcGuideServiceProxy) - epgStream.net - C:\Program Files\epgStream.net\wmcGuideServiceProxy\wmcGuideServiceProxyHost[Caution: ExecutableFile] O23 - Service: XMLTV Download Schedule Service (xmltvDownload) - epgStream.net - C:\Program Files\epgStream.net\xmltvDownload\xmltvDownloadHost[Caution: ExecutableFile] -- End of file - 9982 bytes[/hide] The name of the exe is 784hjdfhjsf[Caution: ExecutableFile] It was created/last modified on Friday, October 24th (4 days ago) It was last accessed today, but that might be because i accessed the properties of it The files icon is also a bit odd. it look likes a simple command prompt window, but is slopped down to the right, and the bar at the top is a light cyan/teal color. the centre of the window is white with no writing. Interesting there is also a rar file in my hard drives root, with a name hard to say here due to the censors. the first part is the common f word, in lower case, often used to refer to people reproducing immediately following that is 'l8o' with the ' bits and finally a dot and then exe I haven't touched either file yet, and ill put them in a zip file and then upload them somewhere incase anyone wants to look at the actual files. ---- anyway i want to know if my connection is being used to help perform ddos attacks (seeing as googling the files company name returned alot of botnet results), or if im sending spam mail to people or anything like that. thanks for all the help when it comes! EDIT: fixed a few typos