i have read posts about the virus that can use svchost.exe to run, Welcher if i remember correctly... Anyway, i ran the symantec fix for it and it did indeed find the virus on my system and apparently deleted it. Then i ran the microsoft patch. Thing is tho, im still getting svchost.exe using like 60% of my processor power and when i leave my computer on pretty much 24/7 it can make it get quite hot. It can be closed down in Task Manager but i would like to get rid of the fundamental problem instead of having to mess around with that everytime. I have re-run the symantec fix tool but it says it cannot find the virus. Is there any way to know where this virus is lurking so that i can delete if, if indeed it is a virus at all? Thanks very much Pete

This is the hijackthis log file :) Logfile of HijackThis v1.97.7 Scan saved at 08:49:29, on 20/01/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\System32\GMTService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\soundman.exe C:\Program Files\Gigabyte\EasyTune4\et4Tray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe C:\WINDOWS\System32\WISPTIS.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Neal Wainwright\Desktop\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [EasyTuneIV] C:\Program Files\Gigabyte\EasyTune4\et4Tray.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.exe O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - HKCU\..\Run: [Bandwidth Monitor Pro] "C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe" /minimized O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: Research (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38005.1175694444 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Pete, Your log is clean, except for this POS that is pretty much usless. (SpyKiller) Download AdAware and Spybot S&D and you will be a lot better off, and both are free, unless you feel you need AdAware Plus or Pro. Link for Spybot. http://security.kolla.de/ Link for AdAware. http://www.lavasoftusa.com/ However you do have C:\WINDOWS\System32\WISPTIS.exe in your running processes and this could be part of your problem. Read the thread at this link. http://www.turcic.com/forums/showthread.php?t=1260 Hope this helps and have a nice day. :) Trpm

svchost.exe is part of your operating system. Specifically: Generic Host Process for Win32 Services. Leave this alone. Whatever you read about a virus association has nothing to do with keeping all instances of svchost running. Don't believe me --- go to http://search.netscape.com/ns/boomframe.jsp?query=microsoft+svchost.exe&page=1&offset=2&result_url=redir%3Fsrc%3Dwebsearch%26amp%3BrequestId%3D5efc93a67b3fdb33%26amp%3BclickedItemRank%3D2%26amp%3BuserQuery%3Dmicrosoft%2Bsvchost.exe%26amp%3BclickedItemURN%3Dhttp%253A%252F%252Fsupport.microsoft.com%252F%253Fkbid%253D314056%26amp%3BinvocationType%3D-%26amp%3BfromPage%3DNSCPIndex&remove_url=http%3A%2F%2Fsupport.microsoft.com%2F%253Fkbid%253D314056

svchost.exe please help

hello sir, In over office we have 10 system connected in lan. server is windows 2000 server family edition. and other are windows 2000 server and 2 are windows xp prof. we use applications micromedia mx all and photoshop 6.0,pagemaker 7,corel draw 11, WINFTP,SQL SERVER 7.0. So, when we are work in applcation copy paste are not work measege box coming that rpc servies is not working when we are going to servies the rpc properties are not showing and also not restarting in system task manager->processor the following unknow exe are runing 1.smss.exe 2csrss.exe 3.svchost.exe 4.mslaugh.exe 5.msblast.exe and also when we are ending the process it is tells that acces is deined. we formated system and reinstall the os and connected the lan but the same thing is happing so kindly, give any solution for the problem if you have any fix tool for that please mail me back email id: anand_gali@yahoo.com thanking you anand