check under c:/winnt/system32/wins
see if there is a file there named SVCHOST.exe or DLLHOST.exe
check out teh properties, see if it has been signed anmarked with the author, version etc. and the size, a real svchost should be 4-6K, the virus version is usually 10K, also the virus one will not have proper authors/signature/version etc, find and run the msblast fix