Posted 20 October 2010 - 11:31 AM
I've been working on my computer (windows XP) the last couple days after getting infected with Antivirus Action. I have run the entire removal process posted online. The oinly thing I can't seem to get rid of and free up my permissions is \\.\globalroot\device\svchost.exe\svchost.exe
Wheni run SAS it comes up detected as TrojanDropper.SVCHost-Fake; then when i go to remove it; it shuts SAS down and makes it unresponsive. So after using Inherit.exe to restore SAS; I am back to it being detected but I know for a fact as soon as I go to remove it; it will be wiped again.
I've tried renaming all my spyware programs like spybot, sas(only one able to detect it), malwarebytes, Combofix.
I'm on my way to work so sorry if this is a short notice post.
I've also replaced the hosts file and removed all the registry keys manually and still i'm at this roadblock.