January 18th, 2005, 09:54 PM
Iknownot:
Exactly, the svchost in the windows folder was part of the trojan. The real svchost is in windows\system32. So when I deleted it, it happily died a painful death.
Also, yes i removed...
January 18th, 2005, 12:51 AM
Logfile of HijackThis v1.97.7
Scan saved at 12:09:36 PM, on 1/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:...
January 17th, 2005, 09:56 PM
tedob:
I started process explorer via hklm/s/m/w/cv/run and saw the process tree which was starting all the problems. Strangely, there was a windowsupdateXXXXXXX.exe (or something like that) being...
January 17th, 2005, 07:15 PM
Thanks for your replies before I head in to tackle this foe.
Nihil: I will try pest patrol, thanks for recomending it. I have run aaw and sb:sod (yep, updated and all that jazz) but there was no...
January 17th, 2005, 05:50 PM
So, there's a machine in the shop that was overrun with virii (350 instances of bagle, stuff like that). The machine is running xp home sp1 (not the latest updates, as you could guess). I have been...