fservice.exe?

[bothered]

Kids PC again guys.
Whenever my youngest logs on to his account he gets a download window popping up that says 'you are downloading the file fservice.exe from d:\windows\system32' save, cancel etc. Anybody got any idea what this is and what to do about it?
Thanks.

[t1rhino]

Looks like a trojan.
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.prorat.html

[bothered]

Thanks t1rhino, I couldn't see any mention of fservice on that link but followed the instructions and turned off system restore and ran a virus check (avast). It is now running a boot scan because it found one.
We'll see what happens when it's done.

[t1rhino]

Section 1 of the Technical Details.

Copies itself to the %System% or %Windir% folder. The following file names have been seen, however, it is possible that different variants use different file names:
%System%\Main.exe
%System%\Loader.exe
%System%\Msmsg.exe
%System%\Winserv.dll
%System%\Fservice.exe
%System%\Sservice.exe
%Windir%\Winlogon.exe

[bothered]

Thanks again t1rhino, Of course you're right, I wasn't looking hard enough. I followed the removal instructions and all the files it said may be there were.
Thanks again mate. :thumbsup:

[t1rhino]

np. Glad you got rid of it.