|
-
August 9th, 2004, 06:40 AM
#6
Please note: Any and all advice presented in this post is presented as is. I am in no way responsible if you should render your system disabled. I merely present this information as an effort to share knowledge I have accumulated from my own mishaps.
To know what services are launching svchost.exe, take a look at your services list in the administrative tools (start -> settings -> control Panel -> Administrative Tools -> Services). There will be a few things there that load that executable, most of them are rather innocuous. Not every one of the services listed will be using that file either. You will need to go through them one at a time and figure that out on your own. If you find one that you don't know about, research it and then disable it if you need to. If in doubt, you can always ask here.
Another thing you will want to look at is the run/ run once entries in registry. If the virii reappear even though you thought you had cleaned them, see what is loading on boot through your registry, check the "Last Modified" time of the listed executable. To begin this do the following :
1. Open Regedit (start -> run -> type in regedit -> Press Okay)
2. Back up the registry (file -> Export Registry File -> Set the range to all -> Choose your save in directory -> give the file a name -> click okay)
3. Take a look at the following Reg Key : HKEY_LOCALMACHINE/Software/Microsoft/Windows/CurrentVersion/Run
4. Examine the values associated with Run. These are the items loading on boot. If you don't know what it is, then Google it. Once you know what it is, then either leave it or delete it. Either way, take note of the location of the exe cause you will be looking at the properties later on.
5. Take a look at the following Reg Key : HKEY_LOCALMACHINE/Software/Microsoft/Windows/CurrentVersion/RunOnce
6. repeat step 4.
7. Take a look at the following Reg Key :
HKEY_LOCALMACHINE/Software/Microsoft/Windows/CurrentVersion/RunOnce
8. Repeat step 4.
9. Take a look at the following Reg Key :
HKEY_CURRENTUSER/Software/Microsoft/Windows/CurrentVersion/Run
10. Repeat step 4.
11. Take a look at the following Reg Key :
HKEY_CURRENTUSER/Software/Microsoft/Windows/CurrentVersion/RunOnce
12. Repeat Step 4.
13. Close your registry editor and start finding those executables you just took note of.
14. Once you locate the executables and examine the last modified times of them. If they are windows executables and the times don't correspond with you default install times, then you will probably want to re-extract them from your windows CD Learn how to extract files, or the i386 files if you have them. If the files are not Windows files, but distributed by some other company, perhaps an uninstall and verification of the removal of their exe is in order. Take a look at their install files and see if they provide you with a files/ time list.
You're kinda on your own from this point on as there is no simple answer that can be easily provided.
Hope this helps,
Chefer
\"I believe that you can reach the point where there is no longer any difference between developing the habit of pretending to believe and developing the habit of believing.\"
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|