svchost.exe Backdoor trojan

Tomas2000 · Cadet Joined: Apr 30, 2004 Posts: 2 Location: USA

Hi-

Not sure if this is the appropriate venue, but here's my question-

I have Norton SystemWorks 2004, and I had an infection with the Gaobot worm that prevented me from using it. My IT adminstrator at work helped me rid myself of the worm, but I'm still having a problem with one remaining virus.

The NAV scan lists "svchost.exe" as a backdoor Trojan, and attempts to quarantine or delete it are met without success. In addition, I am unable to access the symantec website, despite the fact that my internet connection is working, and I can go to any other website that I like.

My brief and uneducated reading of the microsoft website made me think that I have the mydoom virus, but downloading and running their detection tool yielded no virus.

Any suggestions?

Thanks-
Tom

qwiyet1 · Private Joined: Mar 12, 2004 Posts: 41 Location: USA

When trying to run your NAV are you in "safe mode"? Try booting you pc in safe mode and running the NAV again - may allow you to remove it when run in safe mode.
Try connceting to other anti-virus sites that offer a free network based virus check - may not remove the virus (unless you purchase their product) but may help determine exactly which virus you have. I'm not aware of any other than Norton (sorry) but searching the forums here may point out a few.

qwiyet1 · Private Joined: Mar 12, 2004 Posts: 41 Location: USA

You probably can't reach the symantec website due to a BHO (Browser Helper Object) that won't let you get to it and will redirect you. I recently ran 'hijackthis' and removed several BHO's. One of which wouldn't allow me to connect to the sysinfo.org site - which tells you of known BHO's!


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 1541 pages served in previous 5 minutes. Page Rendered: 0.427 seconds.