Hi there!
I think my computer got infected by the backdoor.beast.205 trojan.
The suspicious file is being called "svchost.exe".

Can anybody help and tell me how to get rid of this pest?

Thanx a lot in advance!

Yes I can help you get rid of it..but there is a legitimate file called svchost.exe used by Windows XP and 2000 so having a file on your PC just by that name is not an indication you have the beast. Can you tell me more why you think you have this BEAST 2.05 ???

In any case, I suggest you follow these instructions at this link and then post you hijack this log so I can see what is running on your PC..

http://forum.gladiator-antivirus.com/index...showtopic=10517

:)

If you are that advanced and understand all about the Beast and that version, then you can also do these step to find and delete it from a PC


You have to follow these steps for Windows XP (NT):
1. Boot in Safe Mode
2. go to WinDir\msagent directory (usually C:\windows\msagent) and delete a file ms****.com (**** are random characters), which has ~28 KB or ~46 KB (according to the settings used).
3. go to SysDir (usually C:\windows\system32) and delete a file ms****.com, with a different name from previous, which has the same size as the previous file.
4. go to WinDir or SysDir (according to the settings used) and delete the dxdgns.dll file.

For Windows 9x you have to change "msagent" with "command" directory Remove Beast, problems



Also FYI...

It's in the Beast help file:
Boot in safe mode
Delete file "<Windows>\svchost.exe" (Or dxdgns.dll, or whatever you renamed it)
Delete file "<Windows>\system\ms****.com"
Delete file "<Windows>\command\ms****.com"
* defines a random letter


Please see this Link to understand the Beast

BEAST 2.05 TROJAN HORSE PROGRAM

http://www.nsclean.com/psc-bst.html

Backdoor.Beasty.H

Do not do these step above unless you know what you are doing. :)

Hello Hunter!
Thank you very much for the fast response.

I used all of the named programes before in order to get rid of different kinds of ad- and spyware.

I first noticed that there was something wrong, when I didn´t use the internet but there was some upstream traffic going from my computer to another ip.

I then utilized pestpatrol to look and see if there was anything wrong. It clearly identified svchost as backdoor.beast.205.......because I used the freeware version, I was not able to remove or qurantine any of the affected files.

I allready deleted the "svchost" program that was identified by pestpatrol as the trojan but I guess it was still persistent in memory and therefor came back after a few minutes.

I will now try to get a new pestpatrol log in order to deliver some new information on this matter.....

Again....thx a lot!


With regards,

Scipio