TROJAN HORSE

Hi There I am new to computers so please bear with me.I am using Norton internet security 2003 on my xp system with updated definitions.The auto-protect feature is picking up a trojan horse at C:\windows\svchos1at.exe and now today C:\windows\svciohos1at.exe C:\windows\svchoms1at.exe In the log viewer the action taken is file repair failed and access denied My computer appears to be running ok and i can still use internet etc o.k but i assume i am infected by virus. I have done full system scan and nothing shows up,please advise what you think i should do next. Your help would be greatly appreciated Cheers Franmac

Welcome to TomCoyote.org!

You seem to have some malware on your machine. Although you only mention one particular file, there may be others that your resident scans are not detecting.

If you want your machine checked by someone experienced in these matters, please do this:

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Download HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

Links to Hijack This! v 1.99.1:

http://tools.radiosplace.com/HijackThis.exe
http://spywarewarrior.com/files/HijackThis.exe
http://tomcoyote.org/hjt/HijackThis.exe

Run it from that folder.

Click "Do a system scan and save a log file".

DO NOT "FIX" ANYTHING WITH IT YET!!!
FIXING THE WRONG THING COULD RENDER YOUR SYSTEM INOPERABLE!!!


Start a new topic here:

HijackThis Logs and Spyware/Malware Removal

"Copy/paste" the ENTIRE CONTENTS of the log file into the thread, and it will be checked for malware.

I met this Trojan for the first time on a customer's WinXP PC yesterday.

svciohos1at.exe appears to be a decoy transient which deletes itself while you spend time hunting for it.

I used WinPatrol to find and kill the Trojan.

The WinPatrol 'Startup Programs' listing showed an executable 'comm.exe /i' disguised under the title 'Firewall'. I selected it, hit the 'Remove' button and the problems disappeared.

WinPatrol can be downloaded from:

http://www.winpatrol.com/

Hope this helps.