Msblasted

[Tacklebox]

Hi All,
I'm just getting over an msblast attack. I was able to
get rid of it, however when the PC boots up it takes an
unusually long time to load user profiles and I get a pop
up (cmd type) looking to run the svhost exe. I checked
the system32 folder against a machine that hadn't been
infected and the svhost is not in the clean pc. I tried
removing it from the system32 folder and rebooting, but
it still runs during startup.

Any Suggestions?

Thank You

TB
.

Also, the svchost is where it should be

[geoscomp]

Try using the symantec repair tool to clean things up

available here

[houseisland]

The repair utility works quite well. Just make sure you read the instructions and disable system restore before running it.

[Tacklebox]

Thanks- I'll try running that tonight and see what happens.

I tried deleting svhost from the registry and the system32 folder and rebooting, but it appears something is regenerating this file.

I'll let you know how I make out.

[NooNoo]

svchost is a windows file. It will regenerate it.

Did you follow the instructions - to the letter in Geoscomp's link?

[Tacklebox]

Does the svhost have the same characteristics as svchost enabling it to regenerate?

I'll try Geoscomp's suggestion this evening when I get home.

Thanks Noo

[Tacklebox]

I discovered that svhost file was planted in my all users startup file. I deleted it from there , system32, and cleaned it out of the registry and rebooted with no problems. So, if anybody else has this problem, this is how I corrected it.

[Matridom]

svhost.exe is a planted file, svchost.exe is the windows file. Glad you got it all sorted out.