Re: win32Rootkit-gen

Donald Eagle wrote:
I run XP home, SP3 updated to today with Zone Alarm free, Avast 4 Home,
Malwarebytes, and SuperAntiSpyware.
This afternoon Avast told me it had detected Win32Rootkit-gen in
Windows\system32\svchost.exe, but could not quarantine it, Windows
Defender, MalwareBytes and SuperAntiSpyware found nothing. A boot scan
from Avast also found it, but I did not attempt a repair because it is a
Windows file. root kit remover did not find it, but
Sophos Anti-Rootkit did, but gave the following message:

Area: Local hard drives
Description: Unknown hidden file
Location: C:\WINDOWS\system32\svchost.exe
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

What do I do now? Can I tell Sophos to remove it and regenerate the
file? Can I repair it from an Avast boot scan? If I do either of these,
will I still be able to boot to Windows?

Suggestions for a solution greatly appreciated.

Hello Donald:

Upload your suspected C:\WINDOWS\system32\svchost.exe to:


After VT has analyzed, post the URL for the analysis here as a follow
up. Please don't reproduce the report here.


1PW @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]