cnorton
Topic Starter
Hello -
My Symantec anti-virus has detected a Backdoor.Trojan issue. (service.exe file).
I've attempted (unsuccessfully) to follow Symantec's instructions for removal. The scan process quarantines it, but it just keeps coming back.
After researching this to the best of my ability ad comparing files to my laptop (which is not infected) files, there is a new directory under my windows system32 drivers directory called imonagent. My other computer does not have this directory at all:
C:\WINDOWS\system32\drivers\imonagent
The contents of this directory contain several files (exe's and dlls). I tried attached the printscreen of the directory - but it is too big. The service.exe file gets removed with antivirus, but when I re-connect to the internet - it gets re-added. I can remove all of the the files in this directory with the exception of the netconfig.dll file. However, I can move the entire contents of the directory to another directory and then delete the directory. When I do this, everything boots up OK, but when I open my browser (either Iexplorer or Firefox) it is unable to load any URLs at all ???????
I've run combofix, and have attached the log.
Any help, advice, or assistance would be much appreciated.
Thanks !
Carter