What happens when SVCHOST is removed from Windows 2003?

1LUV1T · Sep 4, 2009

Hi all, my network is infected with either a VUNDO variant or something equally as bad. I don't want to post the logs just yet, nor am I seeking advise for removal. I have already identified the main infected file to be SVCHOST.EXE which will be deleted after I restart my Win2k3 server. My question is, what happens after reboot? Does Windows get corrupted? Can it possibly function after SVCHOST is gone?

ComboFix does not seem to run on Win2003. All the other scanners/fixers (MBAM, F-Secure, Hitman Pro) need to remove SVCHOST because it is now an infected file (Trojan).

Thanks in advance.

Lemon13 · Sep 4, 2009

Can it possibly function after SVCHOST is gone?" no

i never would repair a server, use your last good-known backup or do a fresh install

M. Knorr

MCSE, MCTS, MCSA, CCNA

Zelandakh · Sep 4, 2009

Deleted when the server restarts? By what?

Chances are that server won't start...

GrimR · Sep 7, 2009

I've just had a similar situation on about 20 of my users PC's, do you have a file called sdra64.exe in windows\system32? If yes it gets loaded from

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit= C:\\WINDOWS\\SYSTEM32\\Userinit.exe,C:\\WINDOWS\\system32\\sdra64.exe,”

MCITP:EA/SA, MCSE, MCSA, MCDBA, MCTS, MCP+I, MCP

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

What happens when SVCHOST is removed from Windows 2003?

1LUV1T

IS-IT--Management

Lemon13

MIS

Zelandakh

MIS

GrimR

IS-IT--Management

Similar threads

Part and Inventory Search

Sponsor