Part(I)
I was hacked by this application when I opened a web page in Internet Explorer.
Here is some information on hxdefdrv.sys (HACKERDEFENDER) and the removal instructions.
After noticing that something was wrong, I disconnected my pc off the Internet.
I noticed these changes to my system:
-There was a new shortcut in my desktop, with the name Start and this target:
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.casinopalazzo.com/index.php?sourceid=100455
-After searching for the files created today, I found these new files in C:\Winnt\
.23052004.exe <-- The name of this file is the date of tomorrow
.hxdefdrv.sys
.sezzbc.ig2
.vzcdaq.2nh
-The Internet Explorer Start Page was modified to
http://rjgzvd.outhost.info/
-When trying to execute RegEdit.exe, this application was closed almost immediately.
-I deleted the file hxdefdrv.sys. After restarting the PC, the file had been recreated.
-To avoid the creation of this file again, open a command prompt and execute NET STOP HACKERDEFENDER100
Notice that this is the name of the service in the winunins.ini file (See winunins.ini below)
If the service is in memory, about 45 seconds will pass and you will get a message "The service is not responding to the control function.
If the service is not in memory, you will be told so.
After removing the service from memory, the hxdefdrv.sys file does not appear again when restarting the PC. Nevertheless, the application is still in memory, so that doesn't solve the problem completely.
Please, note that this service is not listed in the Task Manager, because it hides itself, some other services and files.
-I restarted my PC in safe mode and found another file in C:\Winnt
.svhost.exe
.winunins.exe
.winunins.ini
