system
6
I have applied the ms patch.
I had two svchost.exe on my machine. One in lower case whose original filename was svchost.exe and one in uppercase in the system32\wins directory whose origianl filename was tftpd.exe. It otherwise identified itself as the original MS filename and version.
When the svchost.exe virus is present it repeatedly posts an error saying can’t read memory and shutting osne or one time it said -k rpcss and killed itself. Since I deleted the viral version, no such messages.
Do a search on “svchost.exe virus” on google and you will find a number of items.