%windir%\svohost.exe
SVOHOST.EXE is a Trojan.Joex.
SVOHOST.EXE changes the Internet Explorer home page.
SVOHOST.EXE disables the Windows Task Manager.
Related files:
%Windir%\SVOHOST.EXE
%System%\commamd.exe
%System%\lsasa.exe
Adds the value:
"ctfnom.exe" = "%Windir%\SVOHOST.exe"
"Shell" = "Explorer.exe commamd.exe"
"command" = "%System%\lsasa.exe "%1""
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avcenter/venc/data/trojan.joex.html
Removal:
Kill SVOHOST.EXE process and remove SVOHOST.EXE from Windows startup using RegRun Startup Optimizer.

[AutoRun]
open = sxs.exe
shellexecute= sxs.exe
shell\Auto\command=sxs.exe

Option Explicit
Dim WSHShell, n, MyBox, p, p1, Title911, errnum, vers, itemtype
Set WSHShell = WScript.CreateObject("WScript.Shell")

p = "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"
p1 = "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"
p = p & "NoFolderOptions"
p1 = p1 & "NoFolderOptions"
itemtype = "REG_DWORD"
Title="killvirus"
Err.Clear
On Error Resume Next
n = WSHShell.RegRead (p)
On Error Goto 0
errnum = Err.Number
if errnum <> 0 then
	WSHShell.RegWrite p, 0, itemtype
	WSHShell.RegWrite p1, 0, itemtype
End If
If n = 0 Then
	n = 1
	WSHShell.RegWrite p, n, itemtype
	WSHShell.RegWrite p1, n, itemtype
	Mybox = MsgBox("Folder Options cua ban da bi AN DI, logoff hoac khoi dong lai may tinh de thay doi co tac dung", 4096, Title911)
ElseIf n = 1 then
	n = 0
	WSHShell.RegWrite p, n, itemtype
	WSHShell.RegWrite p1, n, itemtype
	Mybox = MsgBox("Folder Options cua ban da duoc HIEN LEN, logoff hoac khoi dong lai may tinh de thay doi co tac dung", 4096, Title911)
End If