Svchost.exe

waddler_8

Dave_C wrote: »

A little off topic but if I type tasklist /svc in a command window I get 'tasklist' is not recognised... Windows XP SP3 up to date.

Any ideas?

It's not available on XP home. You can download it from here:

http://www.computerhope.com/download/winxp.htm

Save it to C:\windows

(assuming C: is the system drive.)

waddler_8

Just to add to what I said in post #30, ScriptIP-inf [Trj] & IFrame-Inf gives a clue as to the possible point of infection. You may have visited an infected website that had hidden code that pointed you at a domain serving exploits.

looking at your attach.txt from DDS you have outdated software that is vulnerable to exploit in this way.

Adobe Flash Player 10 ActiveX
Adobe Reader 8.2.0
Java(TM) 6 Update 17
Java(TM) 6 Update 7

Always keep your installed software up to date. You can check for vulnerable versions here:

http://secunia.com/vulnerability_scanning/online

Mrs_Chip

Thanks Waddler, will do, just working through everything now!

Mrs_Chip

I re-ran the boot scan and it only found 1 file Dropper-IYB which was deleted. I think the other files were previous quaratines as they all seemed to be in folders related to earlier AV software.

Mrs_Chip

Well everything is running fine and dandy, no resource hogging or redirecting. Not sorted the IP issue yet as everything is working fine with a static IP. I don't know what did the trick, but glad it's fixed. Thanks everyone!

waddler_8

The DDS log still shows problems. There's still signs of the zeroaccess (max++) rootkit - I would still backup & reinstall.

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWinNT%2fSirefef.C

closed

Dave C, it doesn't come with all xp versions,

use this instead http://live.sysinternals.com/procexp.exe