Just this morning, my department dean in college sends me a unusual intant message in yahoo messenger, from the first glance of the message I know it’s a virus. There’s no way my dean would speak in chinese or any funny sound language. Furtunately I’m aware of this situation so I did not click the link (which is attached in the message) which I believe could trigger the virus.
So what’s this virus all about?
Svhost.exe is a computer sytem element, this where other important system of your computer resides, the virus from the message on your yahoo messenger will replace the svhost.exe and it will take over the control of your registry.
Hot to get rid of it?
Svchost.exe file from clean pc should be used to replace the infected file brought about by thecoolpics.net spyware. Also svchost32.exe that may exist in windows/system32 folder must be removed. See http://www.file.net/process/svchost32.exe.html for description of what it does.
Also the ff may be helpful, in case certain changes were made by the said spyware:
1. To Unlock Registry:
Paste the line below to the command prompt (Start, all programs, accessories, command prompt) — >>
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
2. To Enable TaskMgr: Paste the line below to the command prompt — >>
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
3. To Unhide Run command: Paste the line below to the command prompt — >>
REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 0 /f
4. To Unhide Folder Options: Paste the line below to the command prompt — >>
REG add KLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f
Hope it helps