I have a number of reasons to suspect that my explorer.exe and/or svchost.exe files are infected with an otherwise undetected root kit. Is there a freeware boot CD iso anywhere that will allow me to move these to a floppy or thumb drive? I’ve already tried the one from ntfs.com and it won’t allow me to write either of these files to a floppy although other non-system files are writable. After obtaining copies of these two system files, what is the procedure to submit them for analysis, if any?
Can you boot from a Linux CD? Maybe you can manage the files from it.
To know if a file is a false positive, please submit it to VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
Other possibility is JOTTI. VirusTotal and Jotti both have file size limits 10 and 15MB each.
I suggest also a full computer on-line scanning:
Kaspersky (very good detection rates)
ESET NOD32
Trendmicro housecall
AVGas (does not necessary if you have AVG antispyware installed)
F-Secure
BitDefender (free removal of the malware)
and what about using the recovery console from MS Win installation disc?
That is probably the best choice. 