Strange exe. wanting internet access

Anyone know what this is- dfdkihsn.exe
It first showed up about a month ago via firewall report.
I allow my firewall to keep reminding me to do something
about it. Everything runs fine w/ its access denided. I
have not given it permission. Thanks.

Sandi
Fri Jan 09 05:59:47 CST 2004

It is essential to check for spyware/hijackware/foistware.
Go to IE tools, internet options, general tab. Click on the cache settings
button and then 'view objects'. Delete anything you don't recognise. If you
are unsure, or no objects appear, for diagnosis purposes I REALLY like
BHODemon, available at http://www.definitivesolutions.com/bhodemon.htm. It
does not need installing - simply unzip and run the EXE programme. It is
very easy to use.
I find this programme is a better option than IE6's ability to turn off
"Enable third-party browser extensions (requires restart)". This disables
*all* plug-ins and makes troubleshooting very difficult.
Many people like AdAware, available at www.lavasoft.de . Make sure you keep
the signature files up to date and remember, AdAware may only remove the
current installation of spyware; it may not do anything about software that
reinstalls itself, so unless you want to get stuck in an endless loop of
hijack/cleanout/hijack/cleanout make sure you get rid of whatever is
installing the junk. See my Troubleshooting advice for information about
how to track down and get rid of spyware completely.
http://www.mvps.org/inetexplorer/Darnit.htm#tshoot
An excellent replacement for AdAware, if you are experienced with computers,
is Spybot. Again, it is a free programme which can be downloaded from:
http://spybot.eon.net.au/
NOTE: Spybot S&D can damage your system if not used properly, if you are
inexperienced GET ADVICE before making any changes recommended by the
programme.
If you are unable to access the internet after using SPYBOT (or other
anti-spyware software) LSPFIX may help:
http://www.cexx.org/lspfix.htm

--
_______________________________________
Sandi - Microsoft MVP since 1999 (IE/OE)
http://www.mvps.org/inetexplorer

"jon" <anonymous@discussions.microsoft.com> wrote in message
news:079801c3d694$542bb400$a601280a@phx.gbl...
> Anyone know what this is- dfdkihsn.exe
> It first showed up about a month ago via firewall report.
> I allow my firewall to keep reminding me to do something
> about it. Everything runs fine w/ its access denided. I
> have not given it permission. Thanks.

anonymous
Fri Jan 09 22:31:08 CST 2004

Sandi
Thanks. I run Ad-aware and Spybot along with an anti-virus. None pick up on it. Also nothing looks out of place in my cache. This is why I have gone looking for help. Xp will not allow me to delete it. That is strange. If it wasn't for my firewall, I would not know about it.

Sandi
Sat Jan 10 00:19:48 CST 2004

Also watch out for style sheets.

Have you serached for the *.exe in question? Where is it stored? Rename it.
Also, what *is* its name?

--
_______________________________________
Sandi - Microsoft MVP since 1999 (IE/OE)
http://www.mvps.org/inetexplorer

"Jon" <anonymous@discussions.microsoft.com> wrote in message
news:AF959CF0-D155-4C93-9F6E-A9A3111C8792@microsoft.com...
> Sandi,
> Thanks. I run Ad-aware and Spybot along with an anti-virus. None pick up
> on it. Also nothing looks out of place in my cache. This is why I have
> gone looking for help. Xp will not allow me to delete it. That is
> strange. If it wasn't for my firewall, I would not know about it.
>

Mike
Sat Jan 10 03:16:50 CST 2004

jon,
A lot of these new style trojans use random generated file names.

Go to: http://www.tomcoyote.org/hjt/
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste hijackthis.log into your new message.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 01-08-04]
Please post replies to this Newsgroup, email address is invalid
--

"jon" <anonymous@discussions.microsoft.com> wrote in message
news:079801c3d694$542bb400$a601280a@phx.gbl...
> Anyone know what this is- dfdkihsn.exe
> It first showed up about a month ago via firewall report.
> I allow my firewall to keep reminding me to do something
> about it. Everything runs fine w/ its access denided. I
> have not given it permission. Thanks.

Bill
Sat Jan 10 20:21:42 CST 2004

I recommend Mike Burgess' advice on this one.

This bug has a random name. It is active on your system, hence the
difficulty deleting or renaming it--you would probably find that you could
do that in safe mode, if you want to try that, but collect Mike's data
first.

Nobody can ID via the name, but you could also try some of the online
antivirus scans from the better vendors--some of those might spot it when
your own (unnamed!) antivirus hasn't.

"jon" <anonymous@discussions.microsoft.com> wrote in message
news:079801c3d694$542bb400$a601280a@phx.gbl...
> Anyone know what this is- dfdkihsn.exe
> It first showed up about a month ago via firewall report.
> I allow my firewall to keep reminding me to do something
> about it. Everything runs fine w/ its access denided. I
> have not given it permission. Thanks.

charlie
Mon Jan 12 12:33:31 CST 2004

I believe I saw a post about this on the ZoneLabs User Forum. You
could search for it there. charlie R


"jon" <anonymous@discussions.microsoft.com> wrote in message
news:079801c3d694$542bb400$a601280a@phx.gbl...
> Anyone know what this is- dfdkihsn.exe
> It first showed up about a month ago via firewall report.
> I allow my firewall to keep reminding me to do something
> about it. Everything runs fine w/ its access denided. I
> have not given it permission. Thanks.