(Msg. 1) Posted: Wed Jul 30, 2008 8:44 am
Post subject: Trojan.Proscks, I can't clean, quarantine, or delete Add to elertz Archived from groups: microsoft>public>windowsxp>security_admin (more info?)
Hi, I've discovered my system has the Trojan.Proscks virus, and this has
infected my c:\windows\system32\svchost.exe and \system32\proxy.dll files.
My Norton A/V could not clean, quarantine the files, so it left them alone.
I tried to delete the infected files (within the Norton progam), but was
unable. I went to the Symantic web page and followed the removal
instructions and still could not delete the files. System Recover disabled
and running in SafeMode, I did another scan of the infected files, and got
the same...could not clean, quarantine, or delete. I also tried to find the
files and delete them from Windows Explorer and could not. Symantic listed
the virus as LOW theat, so I put the issue on hold.
Now, I've tried to install XP Service Pack 3, and it gets to the point where
it wants to copy the \system32\svchost.exe file, and cannot. At this point I
cancelled the install.
Can anyone tell me how to clean the svchost.exe and proxy.dll file? Are
these files essencial to XP? What's my next move?
(Msg. 2) Posted: Wed Jul 30, 2008 11:19 am
Post subject: Re: Trojan.Proscks, I can't clean, quarantine, or delete Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
JimmyD wrote:
> Hi, I've discovered my system has the Trojan.Proscks virus, and
> this has infected my c:\windows\system32\svchost.exe and
> \system32\proxy.dll files. My Norton A/V could not clean,
> quarantine the files, so it left them alone. I tried to delete the
> infected files (within the Norton progam), but was unable. I went
> to the Symantic web page and followed the removal instructions and
> still could not delete the files. System Recover disabled and
> running in SafeMode, I did another scan of the infected files, and
> got the same...could not clean, quarantine, or delete. I also
> tried to find the files and delete them from Windows Explorer and
> could not. Symantic listed the virus as LOW theat, so I put the
> issue on hold.
>
> Now, I've tried to install XP Service Pack 3, and it gets to the
> point where it wants to copy the \system32\svchost.exe file, and
> cannot. At this point I cancelled the install.
>
> Can anyone tell me how to clean the svchost.exe and proxy.dll file?
> Are these files essencial to XP? What's my next move?
Format and use your backups to restore your personal data after you cleanly
install.
(Msg. 3) Posted: Wed Jul 30, 2008 3:42 pm
Post subject: Re: Trojan.Proscks, I can't clean, quarantine, or delete Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
"Shenan Stanley" <newshelper DeleteThis @gmail.com> wrote in message
news:egXnXAm8IHA.616@TK2MSFTNGP02.phx.gbl...
> JimmyD wrote:
>> Hi, I've discovered my system has the Trojan.Proscks virus, and
>> this has infected my c:\windows\system32\svchost.exe and
>> \system32\proxy.dll files. My Norton A/V could not clean,
>> quarantine the files, so it left them alone. I tried to delete the
>> infected files (within the Norton progam), but was unable. I went
>> to the Symantic web page and followed the removal instructions and
>> still could not delete the files. System Recover disabled and
>> running in SafeMode, I did another scan of the infected files, and
>> got the same...could not clean, quarantine, or delete. I also
>> tried to find the files and delete them from Windows Explorer and
>> could not. Symantic listed the virus as LOW theat, so I put the
>> issue on hold.
>>
>> Now, I've tried to install XP Service Pack 3, and it gets to the
>> point where it wants to copy the \system32\svchost.exe file, and
>> cannot. At this point I cancelled the install.
>>
>> Can anyone tell me how to clean the svchost.exe and proxy.dll file?
>> Are these files essencial to XP? What's my next move?
>
> Format and use your backups to restore your personal data after you
> cleanly install.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html >
Also, never install a service pack in the hope that it will solve your
problem. The most likely
outcome would be even more problems.
Jim
(Msg. 4) Posted: Wed Jul 30, 2008 4:50 pm
Post subject: Re: Trojan.Proscks, I can't clean, quarantine, or delete Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
| Hi, I've discovered my system has the Trojan.Proscks virus, and this has
| infected my c:\windows\system32\svchost.exe and \system32\proxy.dll files.
| My Norton A/V could not clean, quarantine the files, so it left them alone.
| I tried to delete the infected files (within the Norton progam), but was
| unable. I went to the Symantic web page and followed the removal
| instructions and still could not delete the files. System Recover disabled
| and running in SafeMode, I did another scan of the infected files, and got
| the same...could not clean, quarantine, or delete. I also tried to find the
| files and delete them from Windows Explorer and could not. Symantic listed
| the virus as LOW theat, so I put the issue on hold.
| Now, I've tried to install XP Service Pack 3, and it gets to the point where
| it wants to copy the \system32\svchost.exe file, and cannot. At this point I
| cancelled the install.
| Can anyone tell me how to clean the svchost.exe and proxy.dll file? Are
| these files essencial to XP? What's my next move?
| Thanks....
It is a Trojan and not a virus and it looks like the Trojan "trojanized" the legitimate
SVCHOST.EXE file.
That means the Trojans has added code (prepended, appended, etc) to the EXE file to make
SVCHOST.EXE do it bidding.
You have two options.
1. Follow Shenan Stanley's advice.
2. Load the WinXP Recovery Console and logon as "administrator" and replace
%windir%system32\svchost.exe with a legitimate copy.
The legit, file should be found in; %windir%\ServicePackFiles\i386\svchost.exe you can
tell if it is 14KB and 5.1.2600.5512 (SP3) dated; 04/14/2008
(Msg. 5) Posted: Mon Aug 04, 2008 8:11 am
Post subject: Re: Trojan.Proscks, I can't clean, quarantine, or delete Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
Actually , doing Windows XP Recovery Console is first thing to do.
So , I prefer the option two of David H . Lipman . Good luck !
All times are: Eastern Time (US & Canada) (change)
Page 1 of 1
You can post new topics in this forum You can reply to topics in this forum You can edit your posts in this forum You can delete your posts in this forum You can vote in polls in this forum
Home
Forums
Home
FAQ
Search
Profile
Private Messages
Log in/Register/Password
Windows XP