Re: Trojan.Proscks, I can't clean, quarantine, or delete



From: "JimmyD" <JimmyD@xxxxxxxxxxxxxxxxxxxxxxxxx>

| Hi, I've discovered my system has the Trojan.Proscks virus, and this has
| infected my c:\windows\system32\svchost.exe and \system32\proxy.dll files.
| My Norton A/V could not clean, quarantine the files, so it left them alone.
| I tried to delete the infected files (within the Norton progam), but was
| unable. I went to the Symantic web page and followed the removal
| instructions and still could not delete the files. System Recover disabled
| and running in SafeMode, I did another scan of the infected files, and got
| the same...could not clean, quarantine, or delete. I also tried to find the
| files and delete them from Windows Explorer and could not. Symantic listed
| the virus as LOW theat, so I put the issue on hold.

| Now, I've tried to install XP Service Pack 3, and it gets to the point where
| it wants to copy the \system32\svchost.exe file, and cannot. At this point I
| cancelled the install.

| Can anyone tell me how to clean the svchost.exe and proxy.dll file? Are
| these files essencial to XP? What's my next move?

| Thanks....

It is a Trojan and not a virus and it looks like the Trojan "trojanized" the legitimate
SVCHOST.EXE file.

That means the Trojans has added code (prepended, appended, etc) to the EXE file to make
SVCHOST.EXE do it bidding.

You have two options.

1. Follow Shenan Stanley's advice.

2. Load the WinXP Recovery Console and logon as "administrator" and replace
%windir%system32\svchost.exe with a legitimate copy.
The legit, file should be found in; %windir%\ServicePackFiles\i386\svchost.exe you can
tell if it is 14KB and 5.1.2600.5512 (SP3) dated; 04/14/2008

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


.



Relevant Pages

  • Re: Trojan Wont Go Away
    ... >>I recently got the Exploit URLSpoof.gen trojan. ... >>virus scan and delete the file, ... >>not seem to clean up the registry. ... merely deleting a program never cleans up the registry. ...
    (microsoft.public.win2000.general)
  • Trojan.Proscks, I cant clean, quarantine, or delete
    ... Hi, I've discovered my system has the Trojan.Proscks virus, and this has ... My Norton A/V could not clean, quarantine the files, so it left them alone. ...
    (microsoft.public.windowsxp.security_admin)
  • WIN.COM
    ... This Trojan portion of the virus will trash your hard ... How do I obtain a clean copy of this "WIN.COM" for Windows ... ME and then overwrite the one that was detected? ...
    (microsoft.public.security.virus)
  • RE: Trojan infecting update.exe?
    ... where do I get a clean copy. ... Yes this virus Trojan-Downloader.Win32 is on your system. ... this virus and here is the website that tells you about this virus. ... When I ask Kaspersky to show me more information on this trojan via their ...
    (microsoft.public.windowsupdate)
  • Re: Networking two XP Pro with ZoneAlarm?
    ... > Trojan horse IRC/BackDoor.SdBot.60.AV ... > To remove this virus, ... > and updated Trojan removers, ... recent (presumably clean) Restore Points by click the More Options tab ...
    (microsoft.public.windowsxp.network_web)