Computing.Net > Forums > Security and Virus > svchost.exe help

svchost.exe help

Reply to Message Icon

Original Message
Name: bmeek
Date: February 16, 2005 at 16:17:51 Pacific
Subject: svchost.exe help
OS: xp home
CPU/Ram: 3.2 / 1.5
Comment:

I noticed there are 10 svchost.exe processes running. I did a virus scan with norton and housecall and ran ad-aware se and no virus or anything was found.

2 of them are in c:\program files\internet explorer\

6 of them are in c:\windows\system32\

2 of them does not show a path in either task manager or win task pro 5.

Is this normal for this many svchost.exe processes running? My cpu usage is at 1% and mem usage is 18%.


Report Offensive Message For Removal


Response Number 1
Name: TheKid
Date: February 16, 2005 at 17:24:59 Pacific
Subject: svchost.exe help
Reply: (edit)

Report Offensive Follow Up For Removal

Response Number 2
Name: bmeek
Date: February 16, 2005 at 17:47:07 Pacific
Subject: svchost.exe help
Reply: (edit)

TheKid

That link doesn't help. It doesn't explain about having 10 or more svchost.exe running at the same time is normal or not. I know having 4 or 5 is normal but not 10. I have been doing alot of searching and cannot find anyone having this problem.

Typing "tasklist /svc" in the dos command prompt does not work. Says its not recognized as an internal or external command.


Report Offensive Follow Up For Removal

Response Number 3
Name: HiJinx
Date: February 16, 2005 at 17:59:55 Pacific
Subject: svchost.exe help
Reply: (edit)

XP home does not have tasklist.exe: see here.

You should not have a svchost.exe in program files\internet explorer. That one's probably bad. You could try ending task on it, renaming the file so it doesn't load, and see how things go.

In addition to the online scans, you can also submit individual files for analysis here.


Report Offensive Follow Up For Removal

Response Number 4
Name: bmeek
Date: February 16, 2005 at 18:19:45 Pacific
Subject: svchost.exe help
Reply: (edit)

When right clicking on the files and clicking on properties the description says "Generic Host Process for Win32 Services" and copyright "© Microsoft Corporation. All rights reserved." If one of these were "bad" files will the description be different?


Report Offensive Follow Up For Removal

Response Number 5
Name: HiJinx
Date: February 16, 2005 at 18:31:53 Pacific
Subject: svchost.exe help
Reply: (edit)

If one of these were "bad" files will the description be different?

Should be, although it wouldn't be impossible for a virus writer to put that information into the executable. You could also compare file sizes, but it's still not normal to have an svchost.exe running out of program files/internet explorer.



Report Offensive Follow Up For Removal


Response Number 6
Name: bmeek
Date: February 16, 2005 at 18:47:01 Pacific
Subject: svchost.exe help
Reply: (edit)

I was wrong about svchost in c:\program files\internet explorer\. Win task pro had it iexplorer.exe in the process but listed svchost in the process description. Below is a search on my hard drive where svchost.exe exits.

C:\WINDOWS\$NtServicePackUninstall$ - 13kb

C:\WINDOWS\Prefetch - 16kb

C:\WINDOWS\ServicePackFiles\i386 - 14kb

C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8efd5a9b6f87fff395a2eb989 - 14kb

C:\WINDOWS\system32 - 14kb

I still have 10 of them running. Win task pro shows them all in c:\windows\system32 exept 4 of them does not show a path for them.


Report Offensive Follow Up For Removal

Response Number 7
Name: HiJinx
Date: February 16, 2005 at 18:58:59 Pacific
Subject: svchost.exe help
Reply: (edit)

Sure you meant iexplorer.exe and not iexplore.exe? iexplore.exe is Internet Explorer... iexplorer.exe is a name sometimes used by malware.

Also, before searching go into Control Panel>Folder Options (view tab) and set it to show hidden files and folders and untick 'hide protected operating system files'.


Report Offensive Follow Up For Removal

Response Number 8
Name: bmeek
Date: February 16, 2005 at 19:13:58 Pacific
Subject: svchost.exe help
Reply: (edit)

Yes I meant iexplore.exe. I already had folder options set to show hidden and system files. Any ideas why I have 10 svchost.exe processes running?


Report Offensive Follow Up For Removal

Response Number 9
Name: HiJinx
Date: February 16, 2005 at 19:29:49 Pacific
Subject: svchost.exe help
Reply: (edit)

You may have unnecessary services running. There's a site called BlackViper where you can poke around and look at what you do and don't need.

If you still want to rule out the security aspect, download HijackThis and post its log to SpywareWarrior.com. They're experienced with reading the logs and will help you track down anything bad that's loading itself at startup.


Report Offensive Follow Up For Removal

Response Number 10
Name: Paddy G
Date: March 27, 2005 at 03:26:43 Pacific
Subject: svchost.exe help
Reply: (edit)

Heh, just looking on the net and came across this. I currently have about 100 SVCHOST.EXE running in my system memory. Obviously a virus, but as I'm not too good with computers I have no idea where to start. It's absolutely draining my cpu and net speed. I've run AVG anti Virus, Spybot, Adaware etc. Still can't get rid of them :(
Anyone help? I think it's starting to really take control...


Report Offensive Follow Up For Removal

Response Number 11
Name: Wishmaster
Date: March 28, 2005 at 16:38:04 Pacific
Subject: svchost.exe help
Reply: (edit)

If in this problem yuor CPU worked 100% ?
Try change your IE to Mozilla FireFox, see what going on, and say out here.
It's some time a problem from IE, and many times you haven't another choice.
Ciao.


Report Offensive Follow Up For Removal






Use following form to reply to current message:

   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: svchost.exe help

Comments:

 


  Homepage URL (*): 
Homepage Title (*): 
         Image URL: 
 
Data Recovery Software




How often do you use Computing.Net?

Every Day
Once a Week
Once a Month
This Is My First Time!


View Results

Poll Finishes In 3 Days.
Discuss in The Lounge