Something loading invisible copy of iexplorer

[egims]

I used to have RealVNC installed. Somehow an outside user obtained the password and got in. I watched them explore my desktop!! I changed the RealVNC password (offline) to something very obscure. Within two days they had it again. I am behind two firewalls (our router, and Sygate Personal Firewall) installed on the computer. I use all the best spyware and adware software and they come up clean. But I think there must be some undetected software on my computer passing out information.

One clue...my Sygate Personal Firewall shows IExplorer.exe loading each time my computer starts! Yet it shows nowhere else, not even in the Windows task manager. I've used sysedit and examined everything there, but can't find anything loading it. I've searched the registry, but can't find anything loading it. I'm stumped, but feel sure this is tied to the security leak.

Any thoughts are GREATLY APPRECIATED!

 

[erikhertzel]

I would look at a rootkit at this point.

http://www.sysinternals.com/Utilities/RootkitRevealer.html

You also need to terminate any processes that are being used against you.

Also, are you sure they are using the VNC? If so, it lights up black and you can right click on it and disconnect the user.

Also, have you checked your Event Viewer Application, Security, etc...logs?

Erik