Start up Item

I have this worm that I can't seem to get rid of in my start up.
Item: Microsoft Updates. Command svehost.exe. I'm told it's added by the
W32/Rbot-GRW worm and IRC backdoor. I scanned and repaired with Spybot and
adaware then scanned with Avira in safe mode. While I fixed alot of stuff
that startup item is still there. I uncheck it, reboot and bam! there it is
checked again! Doesn't really seem to do any harm but who knows? Where's it
come from? What's it do? And can I get rid of it? Anyone?

Thank You

Beau

Beau wrote:
> I have this worm that I can't seem to get rid of in my start up.
> Item: Microsoft Updates. Command svehost.exe. I'm told it's added by the
> W32/Rbot-GRW worm and IRC backdoor. I scanned and repaired with Spybot and
> adaware then scanned with Avira in safe mode. While I fixed alot of stuff
> that startup item is still there. I uncheck it, reboot and bam! there it is
> checked again! Doesn't really seem to do any harm but who knows? Where's it
> come from? What's it do? And can I get rid of it? Anyone?

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/...moving_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to
do all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://www.pctipp.ch/downloads/siche...ning_tool.html
- download site

The site is in German but David's tool is in English so don't let that
worry you. Scroll all the way down to almost the bottom of the page and
you'll see a box titled "Infos Zum Download - Multi-AV Scanning Tool".
You'll see "Download von www pctipp.ch" and the live link to download
Multi_AV.

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the first link above (not here, please).

Not all tools used will work in Vista and you will need to run them
elevated. Since Vista is so new, it will be a while before removal
techniques and tools are developed. If you are unable to remove the
infection by following the general steps, register at one of the
HijackThis forums as suggested.

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may
be so infested that Windows will need to be clean-installed. Have all
your data backed up before you take the machine into a shop.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Disable System Restore first, then reboot into Safe Mode and run the scan a
couple more times.
--
Andre
Blog: http://adacosta.spaces.live.com
My Vista Quickstart Guide:
http://adacosta.spaces.live.com/blog...3DB!9709.entry
"Beau" <> wrote in message
news:9E510E89-FA3E-4053-A060-...
>I have this worm that I can't seem to get rid of in my start up.
> Item: Microsoft Updates. Command svehost.exe. I'm told it's added by the
> W32/Rbot-GRW worm and IRC backdoor. I scanned and repaired with Spybot and
> adaware then scanned with Avira in safe mode. While I fixed alot of stuff
> that startup item is still there. I uncheck it, reboot and bam! there it
> is
> checked again! Doesn't really seem to do any harm but who knows? Where's
> it
> come from? What's it do? And can I get rid of it? Anyone?
>
> Thank You
>
> Beau
>
>