Behaves Like Win32.irc-backdoor

slesij

Dear all,

I'm having problems for several days now with my computer. I have BitDefender internet security 2008. BitDefender reports that "memory dump" (svchost.exe) is infected with Win32.IRC-backdoor. To be more specific, it says behaves like Win32.IRC-backdoor. After the scan BitDefender reports, that system was cleaned, virus deleted. But on the next scan - it's the same story. It goes on for several days now.

Could you please advise?

Thank you!

Stas, Slovenia

Niels

Dear slesij

svchost.exe is legitimate but there could be malware that is also running. I recommend that you download and install hijackthis. Start hijackthis and press do a system scan and save a log file. Post the output into your next reply.

To see what modules are currently loaded in svchost please do this go

to start,run,type cmd press enter type now :

tasklist /svc /fi "IMAGENAME eq svchost.exe press enter That works only on windows xp professional.

Otherwise download process explorer

Unzip it. Double click on procexp agree the disclaimer.

Now double click on a svchost.exe entry,click on services. Now you will see the services that are currently loaded.

Now do this go to start,run,type regedit expand hkey_local_machine and the following folders and subfolders:

system,currentcontrolset,services. You have to expand the folders on the left by clicking on the +-icon you will see a folder called parameter. You will now see which file is being loaded that information is written after ServiceDll.

Best regards

Niels