Author Topic: spyware/trojan x.exe DRIVING ME CRAZY !!!!  (Read 10075 times)

0 Members and 1 Guest are viewing this topic.

YoKenny

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #15 on: March 25, 2009, 07:31:35 AM »
grizz, notice the spelling of svhost.exe as this is a method of malware writers to confuse users as svchost.exe is a needed Windows service that does several things and I notice that you have HijackThis on your Desktop which is not a good place for it.

When you download HijackThis then run its installation application it creates a Folder where it should remain as that is where it stores its Log files to not clutter up the Desktop with its Log files.  

Un-install the old HijackThis in Add/Remove Programs and download a fresh copy and install it correctly and run it from the Shortcut created on the Desktop:
http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

End all browsers then run HijackThis then select the following then select Fix checked:
O23 - Service: Windows Telephony (WindowsTelephony) - Unknown owner - C:\WINDOWS\system\svhost.exe

Then reboot.

I recommend downloading Malwarebytes MBAM which is Free then install it then run it and update it with its built in Update function then run a Quick scan and have it remove all that it finds and a reboot may be required to remove locked files:
http://www.malwarebytes.org/mbam.php  

I find that Windows firewall is adequate as I am behind a hardware firewall and I monitor what is running on my system carefully with Windows Defender and WinPatrol.
« Last Edit: March 25, 2009, 07:33:13 AM by YoKenny »

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #16 on: March 26, 2009, 04:46:22 AM »
Turned windows firewall back on

Reinstalled HJT and did a scan to find the svhost (sorry bout wrong spelling before:P) wasnt there..

Scanned with MBAM and cleaned infected files. Didnt detect svhost but detected a few other backdoor.bot things. Will update on how everything looks a bit later :P thanks.