Computing.Net > Forums > Security and Virus > SVCHOST.EXE space prob, virus?

SVCHOST.EXE space prob, virus?

Reply to Message Icon

Original Message
Name: clockworksdude
Date: September 23, 2006 at 16:25:46 Pacific
Subject: SVCHOST.EXE space prob, virus?
OS: Windows ME
CPU/Ram: I don't know
Model/Manufacturer: Dell
Comment:

Hi,
I think I have been infected with a virus. I heard that if a svchost.exe takes more space than your explorer, than it is a virus. I've scanned my computer with Trend Micro AV and nothing comes up. When I end this program, my speakers don't work. Any info would be great. I have check my system32 folder and there is one svchost. This is probably a stupid question, but I'm a bit paranoid because this is a new computer.

Thanks in advance


Report Offensive Message For Removal


Response Number 1
Name: jboy
Date: September 23, 2006 at 16:41:31 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

"if a svchost.exe takes more space than your explorer, than it is a virus"

Never heard that one - nor do I know what is meant by it.

Other than that dubious 'clue', is there any more concrete reason you believe your system is infected?

You can always try an online scan, such as Panda, but, if you keep coming up with nothing, then most likely it is (nothing)

Diplomacy is the art of saying 'Nice doggie!'... till you can find a rock


Report Offensive Follow Up For Removal

Response Number 2
Name: clockworksdude
Date: September 23, 2006 at 16:53:20 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

Another site I was looking at, don't remember name, but it said that if one version of svchost.exe takes more space, such as 10kb to explorers 6kb (EXAMPLE), then it is most likely a hidrag virus. Just wanted to clarify. Usually I have like 4-5 of these. Two of them are high, but only one is higher than explorer.exe. Others are below 1000kb.


Report Offensive Follow Up For Removal

Response Number 3
Name: clockworksdude
Date: September 23, 2006 at 17:04:11 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

I tried the Panda scan and downloaded it. How do I use it?


Report Offensive Follow Up For Removal

Response Number 4
Name: Johnw
Date: September 23, 2006 at 17:44:40 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)


Svchost.exe ( also named Scvhost.exe ) can be a virus.
http://www.2-spyware.com/files.php# ( click on svchosts.exe )
http://windowsxp.mvps.org/svchost.htm


Report Offensive Follow Up For Removal

Response Number 5
Name: jboy
Date: September 23, 2006 at 19:07:11 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

It's an online scan, requiring ActiveX, so basically all you do is go to the site using IE and click the 'Panda Active Scan' image presented to you there

You're still not really being clear and I kind of suspect you are jumping at shadows, since the only 'symptom' you have mentioned arises when you turn off a Windows service, if I read the following correctly:

"When I end this program, my speakers don't work.

Do you mean svchost? It can be a normal function of Windows, and likely shouldn't be halted on a whim

Diplomacy is the art of saying 'Nice doggie!'... till you can find a rock


Report Offensive Follow Up For Removal


Response Number 6
Name: clockworksdude
Date: September 23, 2006 at 21:07:02 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

Well I downloaded the Panda thing and nuthing happened, it just stopped and I don't know how to scan my computer. My problem is that I heard that if a thing of SVCHOST.EXE is using more space in kb than explorer is, then its most likely a virus under that name. Is there anything to like make sure that the specific task SVCHOST.EXE is not a virus?


Report Offensive Follow Up For Removal

Response Number 7
Name: jboy
Date: September 23, 2006 at 21:54:00 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

You're not doing it right - - whatever

"My problem is that I heard that if a thing of SVCHOST.EXE is using more space in kb than explorer is, then its most likely a virus under that name"

Probably not your only problem (but I digress)

So, that's it then? Something you 'heard' has gotten you all worked up? I think you're confused - based on this:

"Usually I have like 4-5 of these. Two of them are high, but only one is higher than explorer.exe. Others are below 1000kb. "

... I get the impression you're referring to the Task Manager, and not file size at all. Multiple instances of Svchost in the Task Manger is business as usual

Quit worrying about rumours - you don't even have any symptoms, now do you?

Welcome to the world of computers - first rule:

Not everything you don't understand is a virus (so cut that out)

The only way to be positive is to run a virus scan, or more than one. Good judgement comes into play as well - but given your level of inexperience, that's not presently a factor


Diplomacy is the art of saying 'Nice doggie!'... till you can find a rock


Report Offensive Follow Up For Removal

Response Number 8
Name: jboy
Date: September 23, 2006 at 23:28:43 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

Heh - I just noticed:

OS: Windows ME

Now, that can't be right either, can it, Mr. 'I don't know'?

Assuming you are in fact running XP on this "new computer", then by all means read the links provided by John in #4

Diplomacy is the art of saying 'Nice doggie!'... till you can find a rock


Report Offensive Follow Up For Removal

Response Number 9
Name: clockworksdude
Date: September 24, 2006 at 16:30:05 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

Heh - I just noticed:
OS: Windows ME

Now, that can't be right either, can it, Mr. 'I don't know'?

Assuming you are in fact running XP on this "new computer", then by all means read the links provided by John in #4


Well thats what came on my computer because my dad got it from a special deal at work and I haven't got the money or time to buy XP. When my laptop loads up, it says Windows Media Edition. Yes I'm for the most part very inexperienced with computers because this is the first computer in my household that actually works well.


Report Offensive Follow Up For Removal

Response Number 10
Name: Johnw
Date: September 24, 2006 at 17:15:20 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)


OK clockworksdude, you have XP, ME is a 90's version of Windows. As you are learning ( like all of us, it never stops ) keep in mind Google is one of the best tools you can use.
Windows Media Edition
http://www.google.com.au/search?hl=en&q=Windows+Media+Edition&btnG=Search&meta=
http://www.microsoft.com/windowsxp/mediacenter/default.mspx
Use this link to read up on svchost.
http://windowsxp.mvps.org/svchost.htm
The best way to avoid > "but I'm a bit paranoid" is to set up preventitive measures, rather than waiting to get infected & then trying to fix.
I shall prepare that info for you soon.


Report Offensive Follow Up For Removal

Response Number 11
Name: Johnw
Date: September 24, 2006 at 17:43:54 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)


OK, here is what I use.
Preventitive ( Real Time )
Avast
http://www.avast.com/eng/avast_4_home.html
http://www.avast.com/iavs4pro/setupeng.exe
Reregister after 14 months free use ( Still stays free )
http://www.avast.com/i_kat_207.php?lang=ENG
Spyware Terminator
http://www.spywareterminator.com/default.aspx
SpywareBlaster
http://www.wilderssecurity.net/spywareblaster.html
Is the XP SP2 firewall getting a raw deal?
http://blogs.zdnet.com/Ou/?p=81
Find & Remove any that slip past the above.
ewido security suite free for Windows 2000/XP
http://www.ewido.net/en/download/
Please use the online update after the installation. Only then can the recent signature database be transferred and installed.
Ad-Aware
http://www.lavasoft.de/
http://www.lavasoftusa.com/
All software offered on this page is free* to download and use and compatible with Windows 98/ME/NT40, Windows 2000 and Windows XP Home and Professional.
Download sites.
http://download.com.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button
http://majorgeeks.com/download.php?det=506
Spybot
http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/SpyBotSearch-Destroy.shtml
http://www.safer-networking.org/en/index.html
http://beam.to/spybotsd
Update from MajorGeeks if unable to get from Spybot > Spybot Search and Destroy Detection Update
http://majorgeeks.com/
Bad Checksum message
http://www.safer-networking.org/en/faq/20.html
Once you have the program installed, open SpyBot, Select > Mode > Advanced ( menu at the top, gives you more options ) then select the "Immunize" icon on the left & Click on Immunize ( the green icon up the top ) in the new page. Repeat this process every time you Update, unless you get a message that everything is blocked.
Tick > Enable permanent blocking of bad addresses in Internet Explorer & Select > Block all bad pages silently.


Report Offensive Follow Up For Removal

Response Number 12
Name: clockworksdude
Date: September 24, 2006 at 18:16:19 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

Well thanks for all the info I will get started, but because I couldn't get Panda to work I downloaded the free version of AVG. What do ya know??? I had 2 trojans. One was Trojan horse Flooder.nd and the other was Trojan horse Downloader.zlob.BP Any other info would be great. And I just asked my dad and he says that my computer has ME but my OS is XP Home Edition so I don't know whats what.


Report Offensive Follow Up For Removal

Response Number 13
Name: Johnw
Date: September 24, 2006 at 18:22:17 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

"Any other info would be great"
Remember, google.

"so I don't know whats what"
Start > Control Panel > System, now tell us what you have.



Report Offensive Follow Up For Removal

Response Number 14
Name: jboy
Date: September 24, 2006 at 18:30:42 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

"so I don't know whats what"

Yeah, well, first smart thing you've said

Once more - Panda is an online scan, not an installable program

Funny how neither of these newfound trojans happen to be called SVCHOST.EXE, now isn't it?

I predict an interesting future for you, your dad and this computer

Diplomacy is the art of saying 'Nice doggie!'... till you can find a rock


Report Offensive Follow Up For Removal

Response Number 15
Name: clockworksdude
Date: September 24, 2006 at 18:32:26 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

ok Its Microsoft XP Windows Media Edition. Version 2002. Service Pack 2. 1.73 ghz and 504mb ram. Thats my OS. Also about the flooder trojan, AVG says it cannot be healed, is there any trustworthy download that would get rid of it?


Report Offensive Follow Up For Removal

Response Number 16
Name: clockworksdude
Date: September 24, 2006 at 18:37:23 Pacific
Subject: SVCHOST.EXE space prob, virus?
Reply: (edit)

What do you mean my dad and this computer? Jboy, is there any chance that you could reduce the sarcasm and help more on the topic at hand. My first question was just inquisitive and I thought I could get respectable answer here, no offence JohnW as you are helping, but I feel this is not a place to be mean to some one because they don't know. If people knew everything, there wouldn't be a forum here.


Report Offensive Follow Up For Removal






Use following form to reply to current message:

   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: SVCHOST.EXE space prob, virus?

Comments:

 


  Homepage URL (*): 
Homepage Title (*): 
         Image URL: 
 
Data Recovery Software




How often do you use Computing.Net?

Every Day
Once a Week
Once a Month
This Is My First Time!


View Results

Poll Finishes In 2 Days.
Discuss in The Lounge