Intruder Alert: Defy Mix Axis.exe

[javan]

I keep getting an alert from my firewall every two minutes. [img]graemlins/1pissed.gif[/img]

It says "Sunbelt Kerio Firewall has detected and blocked an intrusion attempt of type Code injection. The technical details about the attack are provided in the window below."

It looks like this:



BTW I would appreciate if someone could point me to a site that hosts larger screenshots. Photobucket keeps shrinking my images to the point of unreadability.

Anyway, I try to delete the file but I get the message:



My C; drive is far from full and not write protected so the file must be in use somewhere…

How do I start Windows XP Pro in safe mode so I can get rid of this annoyance?

Thanking you in advance..

[shamrock_uk]

Ah, trusty Kerio, it is wonderful. My favourite firewall in fact.


To get to safe mode, just hit F8 before you get the Windows splash screen up (after restarting your computer). You may need to hit it a few times just to make sure.

Would also be worth doing:

start -> run and typing msconfig

Navigate to the startup tab and uncheck all dubious software that's starting up. It's not uncommon for there to be another process waiting to recreate the old one as soon as you delete it.

And I would be running some virus scans as it looks highly likely that you've executed some dodgy code on your computer somehow...

I hate to ask...but are you using Internet Explorer and/or Outlook Express?

[ 06-13-2006, 04:41 PM: Message edited by: shamrock_uk ]

[Albromor]

javan, I've got Kerio also. I've found Sunbelt's tech support (they purchased Kerio) fairly fast in response. I'd give them an email and explain the situation. Hope this helps.

[Dundee Slaytern]

You can set your PhotoBucket account to allow up a maximum of 1024kb-sized images.

Saving your images as .gif or .jpg will reduce a 1024x768 image to no more than 400kb or so. If you want to host .bmp though... you will need something else.

[javan]

Thank you for your responses. [img]smile.gif[/img]

Shamrock_uk: I learned about Kerio from following the links in your signature I am moving the day after tomorrow, but once I have the computer unpacked I will try your suggestions. I usually use Opera to browse the internet but my kids kids play a game (Maplestory) that requires IE (unfortunately). I have my antivirus set to scan on startup and update daily.

Albromor: I keep clicking the option to send the details to Kerio. Perhaps you are right in suggesting a more direct message may be more effective.

Dundee: Thanks for the suggestion. I will try different image formats in the future.

Thanks again everyone [img]smile.gif[/img]

[Bungleau]

You may need to hit it with a big hammer...

Turn off system restore, reboot into safe mode, run all your spyware and adware removers as well as anti-virus software (including HiJack This), clean the puppy up, and then reboot again normally. Once you've got a clean bill of health, turn system restore back on.

Depending on how nefarious the critter is, it may be masquerading as a system file so that when you delete it, Windows kindly puts it back with the next reboot... [img]graemlins/madhell.gif[/img]

And good luck on the move in between times! It's always fun and exciting... [img]smile.gif[/img]

[shamrock_uk]

Originally posted by javan: Shamrock_uk: I learned about Kerio from following the links in your signature

Wow, I didn't realise people still read that. I've been wondering about updating it actually, as it's getting old and the writing style is a bit unprofessional (I was angry when I did it! [img]graemlins/firedevil.gif[/img] )

I must admit to being cheap and not getting the latest version of Kerio - I tend to just get v4 from download.com. Do Sunbelt do it as free for personal use?

Oh, and as long as you don't go browsing random sites with IE, that's probably not the cause.

I've tried googling for this and it turned up nothing - if you ever get to the bottom of it I would be very interested!

[ 06-14-2006, 04:26 PM: Message edited by: shamrock_uk ]