Hello Everyone,

I had a problem with Hacktool on 2 machines, both had a file placed in the system32 directory named regsvcs.exe that was infected with hacktool, after a bunch of hair pulling and yelling at my monitor I was able to remove the file and the systems seem clean now, but removing the file caused other problems.

It looks like hacktool changed the way Server and Workstation services run, they're now dependent on regsvcs.exe and since it has now been removed these services (along with all the services dependent on them) won't start.

I'm at a loss on what to do to fix this. Both machines run Windows 2k Advanced Server for the OS.

Any help would be greatly appreciated!

Mike

Sorry it took us so long to help you, mikeach.

If you still need help, please post a HJT log in a reply here, according to the directions in this link, so I can examine your running services:
http://wiki.castlecops.com/Malware_Removal:_Reference_HijackThis_Log
No renaming of the HJT log is required though.

One of the hallmarks of malware is that it often tries to masqeurade as a legitimate system file.

If you are not using the .NET Framework Tools, that may be the case.

_________________
Negster22 - MS MVP - Consumer Security 2006-2008