svchost.exe - Dangerous
%windir%\svchost.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
svchost.exe is used to hide files, processes and registry.
svchost.exe is a user mode rootkit.
Rootkit injects itself into running process.
Rootkit contacts remote hacker server using HTTP session.
svchost.exe spreads by e-mail.
Related files:
%WinDir%\svchost.exe
%WinDir%\plugin1.dat
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msupdate
%WinDir%\svchost.exe
to the Windows startup registry keys.
Added to registry:
HKCU\Software\wget
Also, it may be Backdoor.XTS.
Related files:
%Windows%\Svchost.exe
%System%\Extapi.dll
%System%\Sysmsg.dll
%System%\Rascfg.dll
http://www.sarc.com/avcenter/venc/data/b...
Kill the process %WinDir%\svchost.exe and remove %WinDir%\svchost.exe from Windows startup.