Oh fuck.

Roke · Post by **Roke** » Thu Jul 17, 2003 1:05 am

Well, it seems that I have a virus on my computer labeled "SVCHOST". When Norton or any other virus scanner finds the virus, it deletes a necessary strand of code that allows your computer to boot up.

I have no idea what to do. Any suggestions?

Lyrs · Post by **Lyrs** » Thu Jul 17, 2003 1:10 am

quicker solution: Try googling for the answer. it may be that others have already found a solution.

/end

EarthCurrent · Post by **EarthCurrent** » Thu Jul 17, 2003 1:11 am

This site provided these instructions:
http://www.sophos.com/virusinfo/analyse ... reala.html

Recovery
Shutting down SVCHOST.EXE

First you must shut down SVCHOST.EXE, if it exists. Press the CTRL, ALT and DEL keys at the same time. Select 'Task Manager'. Click on the 'Processes' tab. Highlight the process 'SVCHOST.EXE' and click 'End Process'. Click 'Yes' to confirm.

Deleting the Trojan files

Then follow the instructions for removing Trojans.

Examine the folder <Windows>\System\System and see if it contains some or all of the files svchost.exe, explorer.exe, iw.dll, svchost.reg and several .INI files. Delete the folder and all of these files if so.

Reversing the registry changes

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\
mIRC DisplayName = "mIrc"

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\
mIRC UninstallString = "SVCHOST.EXE -uninstall"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run svchost = <path to dropped explorer.exe>

and delete them if they exist.

Close the registry editor and reboot your computer.

You should then uninstall and reinstall mIRC.

Roke · Post by **Roke** » Thu Jul 17, 2003 1:13 am

mIRC did this? Shit!

Anyway, I have FOUR OF THEM OPEN.

Tab. · Post by **Tab.** » Thu Jul 17, 2003 1:13 am

you sure that things a virus?

Lyrs · Post by **Lyrs** » Thu Jul 17, 2003 1:13 am

Ec's always on top of everything.

/end

Tab. · Post by **Tab.** » Thu Jul 17, 2003 1:14 am

oh.. so it is
shit..
I've had that sucker forever

Roke · Post by **Roke** » Thu Jul 17, 2003 1:14 am

Anyway, it's warning me not to close it like it's a required program. Should I do it anyway?

fyrtenheimer · Post by **fyrtenheimer** » Thu Jul 17, 2003 1:17 am

Tab. wrote:oh.. so it is
shit..
I've had that sucker forever

Ah ..good times.

I don't know what I'm talking about.

EarthCurrent · Post by **EarthCurrent** » Thu Jul 17, 2003 1:17 am

mIRC is one of the most evilest things in the whole wide world.
It's a window into your computer for any number of malicious attacks.
And I'd be quite surprised if this was the only virus it's given you.