Win32.Servu.60 Really a Trojan?

Eyz · Oct 13, 2007

I came home today and found this on my pc, last night zone alarm told me it had adjusted to my normal user settings and asked to be put on maximum security mode, which I did. Every since then my zone alarm has been really cautious and gives me a red pop-up on almost everything I open. Then, today I come home and find this pop-up stating that I have a trojan virus on my pc. The program is Serv-U (which I uninstalled the same day I installed it due to me not liking it.) Serv-U is basically an FTP server, so I'm wondering if maybe zone alarm thought that this activity showed as a trojan maybe confusing zone alarm.

Now the thing is this was showing a registry entry, as you can see in the image. Can you guys let me know if you think it is really a virus, and if so did it manage to do anything since I have ZA running and am behind a two firewalls and a router. The reason I ask is because I used paypal and ebay recently on this pc, I guess I better change my passwords.

Anyhow, I just want to know if you guys think that this is a real virus, or just my zone alarm being nuts.

Thanks. -Mark

http://img150.imageshack.us/my.php?image=win32servu60pf6.jpg

bjgarrick · Oct 14, 2007

Welcome to MajorGeeks.com!

I have used Serv-U FTP Server and never had any problems. I'm not exactly sure what this notification is about but just to be safe I would recommend running our initial cleaning steps and posting the requested logs.

http://www.majorgeeks.com/images/grenade.gif Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

http://www.majorgeeks.com/images/grenade.gif Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

http://www.majorgeeks.com/images/grenade.gifAfter doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..

http://www.majorgeeks.com/images/grenade.gifWhen you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy Log - only for Windows XP, 2K, & NT users

AVG Antispyware Log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users

Bitdefender Log - from step 6

Panda Scan Log - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis Log

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
Click to expand...

Log in or Sign up

Win32.Servu.60 Really a Trojan?

Eyz Private E-2

bjgarrick MajorGeeks Admin - Malware Expert