Infected with Trojan Horse

[oatman]

Apparently a number of different trojans use that file.
I notice Sygate has a troj scan
http://scan.sygate.com/pretrojanscan.html
Try a few others as well, here's one
http://www.trojanscan.com/

 

[wheezergeezer]

Clylbw, if you want to send me your private email address, I can send you some infomation I got from the symatic website regarding the virus,
can't figure out how to post it here !

 

[oatman]

Are these the instructions you used to delete it?

http://www.kephyr.com/spywarescanner/library/windir.svchost/index.phtml

 

[clylbw]

Are these the instructions you used to delete it?

http://www.kephyr.com/spywarescanner/library/windir.svchost/index.phtml

Yes.

 

[ChartMan]

Clylbw
Reminds me of the tech support question " where's the enter key? I don't have a key marked enter."....
You won't find %windir%...... that's just an expression that means the windows system directory, wherever it may be, and whatever it may be called. In win XP it SHOULD be C:\WINNT\SYSTEM32

On my system, it's size is 13Kb and dated 18/08/2001 12:00
I 'm not convinced you can just delete it.... I only have one occurrence of this file on my PC.
Can I suggest you just search for 'svchost' ..... see what turns up.
If you have only one occurance, then if you delete it, you'll have problems. What you will need to do is replace it with an uninfected version. I've attached a zipped up version for you.

 

[clylbw]

Hi Chartman,

I have two svchosts. One is also 13KB, last modified on 13/08/2001, and the other is 25KB, last modified on 07/04/2004. The second is also in the hidden folders/files.

I assume it is the second one that is infected? How can I replace with the clean one attached?

Thanks indeed.

 

[olwenh]

I've been having trouble this morning with my connection to some sites. Just off to run the symantec scanner. I've got Nortons antivirus software & firewall & never had any problems - but my pc the last few days just doesn't 'feel' right.

 

[wheezergeezer]

Olwenh, disconnected broadband connection, reboot your ststem and then run your Norton.........

 

[olwenh]

thanks wheezer, I'll give it a try after the symantec test has finished.

 

[wheezergeezer]

Olwenh, just check your symantec is up to date ? with so many virus's around if your'e not on automatic
update seriously think about doing it...............good luck

 

[olwenh]

Doesn't look like it's a virus.

Yes I'm on automatic update & I've never had a problem.

Just wonder what the problem is. Thanks anyway.