svchost question

[J duncan]

I've had a rash of trojan virus - most recently
backdoor.nibu-b.

It seems to be cleaned up but I keep getting an error
message on startup that it can't find
windoes/system32/svohost.exe.

svchost.exe is running in task manager though (3-4 copies)

Any advice?

 

[Mike Bright MSP]

J,

Did you notice the slight difference?

SVCHOST.exe and SVOHOST.exe

SVCHost.exe is a valid Win32 Application used inside the operating system.
SVOHost is 99% likely to be a hang over in the registry from the Virus.

Follow the intsturctions on the SARC site for Nibu (ignore that it's for
NibuG same applies)

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.nibu.g.html

You need to look at the section entitled revrseing registry changes. Only
change exactly what it says as altering the registry can effect you machine.

Hope this helps

Mike Bright MCP, MSP

e:[email protected]