svchost.exe trojan

[duragezic]

Kaspersky 6 (and its online scanner) both indicated the Backdoor.Win32.Agent.wo trojan was present in c:\windows\svchost.exe and it can't be disinfected. So I can skip or delete.

What can I do?? Svchost.exe runs a lot of the Windows Services I thought. In my running processes I have about 4 of them running. One is a LOCAL service, one NETWORK, and two SYSTEM. So I don't know how I can get rid of the backdoor without messing with windows services! 🙁

 

[John]

The legit svchost.exe is located in c:\windows\system32

Delete the bogus file(s)

 

[Zugzwang152]

boot safe mode and delete it, or boot from the windows cd and delete it.

 

[Mem]

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started.

Quite normal to have more then one running ,as John as stated more important is to where there are located in your OS,FYI I have 5 in task manager and yes been virus scanned with Bitdefender and Kaspersky.

More info here.

 

[duragezic]

Damn, I dont know how I missed that it wasn't in /system32/! I've been around long enough to know they pull that kind of ****** with virii and spyware.

So yeah, I deleted the fvcker.