I am running xp home edition. I am unable to launch most programs. The ones that I can open I have to right click the mouse and "run as" and uncheck the "protect the computer and data from activity" to get them to work. I also get a message at startup that Windows cannot find fservice.exe

What should I do?

Howdy:

You may be infected with the Backdoor.Prorat trojan..

http://securityresponse.symantec.com...or.prorat.html

Murray

I am unable to run regedit or any other things that I have found from doing searches on this problem. I have used spybot and Windows Registry Pro to correct all problems found. I get a clean scan when I run them now. I even found the fservice.exe in one of the files with the Registry Pro and deleted the file and I still get the message at startup. It is like the hard drive is not communitating with the desktop when I try to use programs. I can connect to the internet but when I try to open Explorer it goes into a loop and will not load. I'm not sure where my XP disk is so I have not been able to reformat the disk.

Any ideas?? DJ

Can you use your "search" option to check your drive for the following files?

Main.exe
Loader.exe
Msmsg.exe
Winserv.dll
Fservice.exe
Sservice.exe
Winlogon.exe
Wininv.dll
Winkey.dll

These could be located in the system or system32 folders

Murray

Murray, After doing the search of my C:drive I only found one of the files on the list- Winlog.exe was in the system32 folder


What next?

Go to the link I gave and follow the removal instructions for everything in there.. Make sure you follow them EXACTLY..

When finished, go to the following link and follow the AGBOT removal instructions as well..

http://www.sophos.com/virusinfo/anal...2agobotlf.html

Murray

Murray, I am unable to follow the instructions because I cannot get the "regedit" to open. It seems that most of the Windows commands do not work. I have tried to run from the SAFE MODE also. If I can locate the file by going through the control panel and opening the Windows folder would that get it deleted?


Am open to any suggestions,
DJ

As long as you can find that exact file, you can delete it..

Murray

Hi,
This might be a "dumb" answer or question, but have you done a scan with your Antivirus Program yet?
If you have an Antivirus Program, trying starting your computer in SafeMode, then run the Scan.
Best of luck,
fredg

Thanks for your suggestions, I think that I'm making progress. I've deleted the fservice.exe from where you said and I no longer get the error during start up. I'm still not able to launch most softwear. Should I reinstall the programs that are not opening? I also had some pictures saved from a digital camera that I can no longer locate on the hard drive. I was wondering if they were deleted with registry pro or spy bot or nortons was it possible to recover. I had Systems Works installed at least 2 months before all these problems occurred. I downloaded the pictures from the camera on the 8th of January but am not sure what date they disappeared.


DJ

If you know the name of the folder or the one of the pics, just do a search of your system for them and see what comes up..

As for the programs, if you have the install disks, a re-install wouldn't hurt anything..

Murray

Hello,
I've re-installed my softwear and located a backup cd of my pictures. The computer is running much better but I still have one problem, I cannot get the Internet Explorer to open any web pages. I'm connected to the internet, mostly I get that the page cannot be displayed or an error box that states that Internet Explorer could not open the search page and when I click OK I get the page cannot be displayed error again. I was wondering if you have any suggestions?

DJ

look. Just go to Start , than run , in run type : regedit , than click on edit , than go to "Find" , than type Shell and click Find next. If fservice virus is in your PC the value of Shell is : Explorer.exe c:\windows\system32\fservice.exe (something like this.. ) , just right click on shell and than "Modify" than change its value to : explorer.exe , and the problem will be fixed.