Virus - using svchost -k GPSvcGroup on stand alone machines

Virus creates a Group Policy Client using svchost -k GPSvcGroup. I have run all the scanning tools (and run MSE all the time) and they do not recognize this as an issue - I believe because it looks like the Group Policy settings on a corporate network. This is a stand alone machine running W7 Home Premium - it does not belong to a group.

(The normal gpsvc settings on a stand alone machine seem to be svchost -k netsvcs). I assume this is trying to use the group policy infrastructure to take control of machine configurations like a botnet.

How do I get rid of this ? How do I see the address of any machine communicating with the group policy client so I can report it ?

While I appreciate that some people are managing huge numbers of machines, the infrastructure to do that should be disabled on stand alone home machines.

thx,

k

Continue reading...