Ive run several spyware and adware removal programs along with HT and I am still having problems. Five process called svchost are almost always running and when I close them more open right away. I had a mass of problems with system32 related files recently. Also, Im not sure what the second result on my HT scan is and I cannot delete it. Any help would be greatly appreciated. The following is my HT scan results. Logfile of HijackThis v1.97.5 Scan saved at 12:22:49 PM, on 11/16/2003 Platform: Windows XP SP1 (WinNT 5.01.xxxx) MSIE: Internet Explorer v6.00 SP1 (6.00.xxxx.xxxx) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe C:\WINDOWS\Explorer.exe C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\PROGRA~1\COMPAQ\EASYAC~1\BTTNSERV.exe C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe C:\Program Files\AdsGone\adsgone.exe C:\PROGRA~1\COMPAQ\EASYAC~1\EAUSBKBD.exe C:\Documents and Settings\Default\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fark.com/ O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\adsgone.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Global Startup: AdsGone 2004.lnk = C:\Program Files\AdsGone\adsgone.exe O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM) O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM) O9 - Extra 'Tools' menuitem: AV Home (HKLM) O9 - Extra button: Translate (HKLM) O9 - Extra 'Tools' menuitem: AV &Translate (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37941.058599537

To find out what each Startup(or Process) item does or means: http://www.answersthatwork.com/Tasklist_pages/tasklist.htm Then click the "S"

Also: Here is the Hijack logfile check list: http://hjt.wizardsofwebsites.com/

It's common to have 4 or 5 svchost's running.

I disagree with Kevin. . .it might be a virus. Click on start, run, type "cmd". then type "netstat -an", if you are connecting to ips with ports 135, 139, 13#. . .you have a virus and need to get rid of it by either updating your current anti-virus, or downloading antivirus software that can scan and get rid of this virus. You can also block this traffic by downloading a firewall ie zonealarm, to block the virus from contaminating other computers.

I agree with Kevin. It's quite common to have a number of svchosts running since it's used for many different things. This does not mean there isn't a virus, and the other advice is sound. IMHO, of course.

It is quite normal to have 4 - 5 svchosts.exe running. Read This