Last night found a terminal windows showing an FTP connection to an IP address in Amsterdam. Event viewer showed a VNC connection that was established for about 1 minute. Also found 2 files in c:\windows\system32 that were created, one a svchost file and another called eq, not sure of the type. So far this is what I have done:
1) Closed VNC open ports on my router
2) Performed all Windows XP security updates
3) Install a software firewall
4) Removed VNC
5) Deleted both files that were created during the VNC connection
6) Scanned for viruses and spyware
So my question is should I now be safe? I’m not so worried about hackers getting in now but worried that maybe keyloggers or remote control software is now installed. Should I perform a format just to be safe? I cannot find any suspicious software on my computer.
Thanks for the help,
Grimmleafer
