Virus Help

[Mere_Mortal]

If you already know the module that is being loaded into the Service Host, you can use any decent process viewer to terminate such, Process Explorer is a good example. This means that you can remove the injection without having to close the process itself. Naturally, it depends on the malware itself as to what can or can't be done, for example it may simply reinject as soon as you remove it and will most likely be present upon every reboot.

I recommend you take some time to review CastleCops' Malware Removal Procedure in order to remedy your problem.

The file has been renamed to circumvent anti-stinger tactics used by Sober.r

I wouldn't be at all surprised if Sober.r is your foe. Try downloading Stinger from here.