for those with win2K,

check for size of svchost.exe in C:\WINNT\system32, if is 32k instade of 9k you get it!!

It had infected many of the exe of my hd, i think i get it through kazaa or some stuff like this...

No problem, just some hours lost to put all back to work.. :

1) clean (delete/quarantine) all infected files with a good antivirus like AVP :)
2) reboot in dos prompt and replace svchost with original one
3) delete a reference to svchost in a key of the registry like HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PowerManager\

but probably i'm the only stupid one ! :(
Posted on 2003-08-24 11:10:21 by Bit7