Infected w-svhost / worm_rbot.ffx

Giganews Newsgroups
Subject: Infected w-svhost / worm_rbot.ffx
Posted by:  *rain*drops* (ra…@oregon.net)
Date: Wed, 16 May 2007

I did an online scan using TrendMicro.  It found "worm_rbot.ffx" in the
system32 folder.  I let it clean.  I have not rebooted yet.  I googled and
most entries say svhost.exe is a bogus file with a worm in it.  Some posts
said it was a valid process that causes problems after an MS update.  I'm
confused.

I found the file svhost.exe and checked properties -- no version or
manufacturer.  Its creation date was 2/15/2006 and modification date was
8/10/2004.  My computer software was first loaded on 2/15/2006.

I use MCE 2005 / XP SP2 with updates.

Questions:
1.  Is it a worm or a valid MS component?
2.  Am I safe to reboot?
3.  What other security measures should I take?

Thank you for your assistance.

--

*rain*drops*

Replies