Comments
-
The rustock fix does not find it. I downloaded GMER and ran it, it found Trojan.peed.hzv and lo and behold Bitdefender noticed it as soon as the scan finished. I guess GMER stopped it from protecting itself. The trojan does use services.exe as a spam server. Now I have to clean it out. Thanks for the help.
-
Well it reports nothing but still C:/windows/system32/services.exe has been opening lots of smtp connections. So I post it here. /applications/core/interface/file/attachment.php?id=357" data-fileid="357" rel="">services.zip
-
Thanks Niels, I knew about sys restore and the vault and was reassuring my friend over repeatedly finding files in those places. They were popping up in open space so were a legit worry. It was like one of those browser hijacks that have multiple restore systems so killing it was just not possible running an antivirus. But…
