hello. i just had svchost.exe as a virus with the desc winrscmde as well.
I have managed to correct the problem by myself. The way i've accomplished this is as follows: The virus I had was classified in spybot as smitfraud.c generic. It was an svchost.exe*32 with the description of winrscmde, and would not be removed on reboot by MBAM. Spybot also was not able to terminate it.
You need MBAM to start off with. http://www.techspot.com/downloads/4716-malwarebytes-anti-malware.html
run a scan if you would like, although the solution that worked for me was:
First I went to task manager, and view processes by all users. located the svchost with the description of winrscmde and ended the process.
Next, downloaded TDSSkiller http://support.kaspersky.com/viruses/solutions?qid=208280684
extracted it to the desktop. right clicked and picked run as administrator
it asked me to reboot after it finished scanning, allowed it to reboot.
afterwards ran the latest version of MBAM (right click, run as adminstrator) ran a quick scan. instead of a memory process and a file there was only the file in C:/windows, i clicked remove selected. rebooted and the virus no longer exists on my computer.
Hope this helps as i was frustrated for a few days trying to get rid of the virus on my computer.