"DLLHOST.EXE" "SVCHOST.EXE" under /winnt/system32/wins I install few win2000 workstations for my company everyday. Sometimes these two files are there after installation, sometimes arn't. after i install the anti-virus software, they're dected as virus, so should i del them in safemode or should i keep them? please advice me, thanks.

Go here for SVCHOST.exe info: http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q250/3/20.ASP&NoWebContent=1 I cut and pasted this about DLLHOST.EXE: dllhost is the host process for all COM+ applications. DCOM support module for DLL based COM objects (DCOM = Distributed Component Object Model). DCOM is a software architecture model which is an intrinsic part of Windows, of most Microsoft products, and of many non-Microsoft products. In most cases you should never see DLLHOST in your Task List, as, typically, DLLHOST starts, does what it has to do, and then terminates. However, sometimes, if a Java COM object runs (this could happen if you are browsing the Internet and come to a page which has Java code), DLLHOST may not terminate, which is when you would see it in your Task List.Recommendation : Do not ""End Task"" it as there is no way to determine whether DLLHOST has completed its task or not. For the more advanced users, however, deleting the registry key ""HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Java VM\MSDebug"" can often solve the problem of DLLHOST constantly appearing in the Task List. I have seen some additional statements around the net about the Welchia virus affecting the dllhost.exe. Check out this website: http://www.pchell.com/virus/welchia.shtml ALSO RUN THIS TOOL AT THIS WEB SITE: http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html Good Luck raincheck

Neither svchost.exe or dllhost.exe should be loading or even in the C:\winnit\system32\wins folder...if they are there...they are viral. Svchost.exe and dllhost.exe both belong in the system32 folder. I believe raincheck is spot on with the welchia removal tool. The tool should not only remove the infected files but also should remove the registry entries responsible for their startup. The tool may also direct you to windows update site to install the patch to stop this worm. Good luck and Happy New Year

I agree with blender. If you have dllhost.exe in your process list you are most likely infected with w32.welchia. It's not malicious but does cause problems for networks. Get the removal tool here.