Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
I am wondering about two files in my windows/system folder. Can someone tell me if these are okay or should they be deleted? I have run my Anti-virus program and it isn't listing them as viruses, but someone told me they were. Here they are:
DLLHOST.EXE
SVCHOST.EXE
I could just post links to google's search result for those 2 files, but I believe "give a man a fish, u feed him for a day, teach him fishing and you feed him for a life time"
The easiest thing to do when in doubt about a file is to look it up on a search engine. google by far is the best.
Go through the various links that come up and you will end up learning a lot about them.
btw, just out of curoisity, how come you suspect those two files when there are a thousand on the computer?-Kailas
0 
Hi Scarlett, Kailas, hi everyone,Scarlet, they are not viruses in Windows98!
Both these files would be viruses on NT, W2K and XP with both files in C:\WinNT\System32\Wins... this virus is named W32/Nachi-A but doesn't attack Ws9x!
I know it well as I had to deal with it this morning!
In Ws9x, these files are system files, don't delete them!
Look at this link: W32/Nachi-A
Have a good day,
Gérard from Paris, France
0
They would not be viruses in NT, 2K, or XP. Those are system files and are found in EVERY NT based OS.
0
Hi Scarlett, Kailas, Tom, hi everyone,Tom, look at the link to Sophos I gave above! both files in C:\WinNT\System32\Wins are added by the W32/Nachi-A (DLLHost.exe 16 KB is the virus itself).
You are right about the fact that the files exist in other folders (same names but different sizes).Have a good day,
Gérard from Paris, France
0
Thanks everyone for the quick response.
I did do a search on these files through Google, and I still wasn't sure.
Thanks Frenchie, that's a relief!
I didn't know whether to remove them or not.I hope you got your own files fixed.
Thanks again.
Scarlett
0
Gérard, that article is incorrect. The virus may overwrite the file with an infected version, but those files are part of the Windows OS. I've checked 3 different Win2k systems here at work. None of these systems have ever been infected with a virus and each contain those files. There are three different Virus scanners that run making sure it never happens. We have Antigen, and McAffe running at the server level and Norton's on each of the desktops. We also apply the hotfixes, service packs, and security patches as soon as they come out.
0
Tom, sorry for the misunderstanding! ;-)I agree with you, two files with such names belong to the system!
But W32/Natchi-A adds these files to C:\WinNT\System32\Wins ie another folder as well as two new Rpc services.
If there were an infection, there would be two DLLHOST.exe and two SVCHOST.exe on the disk (different folders of course).I don't say that these filenames indicate viruses but, on the opposite: if infection, take care not to delete good files!
As for Ws98 and Scarlett question, I say the system can't be infected by W32/Nachi-A (RPC DCOM vulnerability) so files have to be kept!
Another link -> MSBlast.D at Trend's
-----
Scarlett, no problem with the virus this morning... I had only one infected workstation and it was only the beginning of infection! I didn't understand how the virus came as my servers are fine (vulnerability eliminated by the adequate patch), Sophos antivirus alerted me immediately and infected files was only DLLHOST.EXE! Thanks for asking!Have a good day,
Gérard from Paris, France
0
I am looking at C:\WINNT\system32 on a Win2K machine and find both at 6kb and 8kb respectively. They both shows their properties to be a creation of MS.
When I look in C:\WINNT\system32\Wins I see that folder is empty.
Bryan
0
Hi Scarlett, Tom, Bryan, Kailas, hi everyone,>When I look in C:\WINNT\system32\Wins I see
>that folder is empty.
Fine Bryan... you're not infected! ;-)When there's an infection, C:\WINNT\system32\Wins contains both files DLLHOST.exe and SVCHOST.exe belonging to the virus system.
Have a good day,
Gérard from Paris, France
0
Frenchie, Hi,
i have a new win98 installation, and the file Dllhost.exe is in my system folder..Svchost.exe is not in my PC..Hope that helps,location wise:))
0
Hi Joe, hi everyone,Thanks for your post!
In the PC I have in front of me (Ws98SE):
-DllHost.exe is in C:\Windows\System
-SvcHost.exe is not on the disk.Have a good day,
Gérard from Paris, France
0
When I try to delete dllhost.exe on XP it won't allow me. It allowed to delete Ms_BLAST.exe but not the other one. Any idea how to get rid of it. My anti-virus detects it's a virus but won't clean and when I try to manually, it won't let me. When I try to go the registry, the window comes up for 5 seconds and goes away. Same thing with the processes tab. THe computer is no longer shutting down bc I deleted MS_Blast.exe but it is still not 100% clean.
HELP!
0  |
 IE Content
|
networking and Win98SE
|
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
