Hi,
If you have already taken steps to erradicate the W32.Blaster.Worm to no effect chances are, its not that.
Here's a couple of things you could try:
Firstly, did you mean svchost.exe? If you did then this is a required file by windows to execute dll files and it WILL produce a similar dialogue box to the blaster.worm AND close down your pc, so don't terminate it.
Secondly, there is a similar file to the one you mentioned called svchost.eve
This is most likely a CWS hijack caused by using Microsoft's obsolete Java Virtual Machine. The hijack can be removed using the latest CWShredder:
www.spywareinfo.com/~merijn/downloads.html Thirdly there is a file called SVhost.exe, this is assocaiated with Backdoor.Socksbot
Backdoor.Socksbot is a backdoor Trojan that connects to IRC and allows a hacker to control your computer.
When Backdoor.Socksbot is executed, it does the following:
Copies itself as:
%System%\Svhost.exe.
C:\WINNT\System32\Proxyspam.exe.
C:\WINNT\System32\Socks8080.exe, which is a copy of Svhost.exe.
NOTE: The C:\WINNT\System32 paths are hard-coded in the Trojan.
Adds the values:
Svhost Loader Svhost.exe
Service C:\WINNT\SYSTEM32\SOCKS8080.EXE
to the registry key:
HKEY\LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adds the value:
Svhost Loader Svhost.exe
to the registry key:
HKEY\LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Attempts to connect to an IRC server and notify the hacker.
If your virus checker does not pick this up here is a manual method of ridding your pc...
Click Start, and then click Run. (The Run dialog box appears.)
Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:
Svhost Loader Svhost.exe
Service C:\WINNT\SYSTEM32\SOCKS8080.EXE
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
NOTE: This key does not exist on all the systems.
In the right pane, delete the value:
Svhost Loader Svhost.exe
Exit the Registry Editor.
In additon to this re-boot your pc into safe mode and run your ad-ware program to be sure. You should then defrage your pc by right clicking onto the icon of your hard drive in My Computer and choose 'properties' - 'tools'- defragmentation. This should be done regularly and can affect the speed of your pc. You can also follow the same process to clean up your disk space.
Hopefully one of these will work, if not let me know and I'll have another think.
Cheers
Graham.
