I have a problem with svchost.exe, i downloaded a program from winmx it said it was a zip file so i double clicked on it. but did nothing, i thought nothing of it. then i started to encounter problems like i couldn't run my BCWipe program or my evidence eliminator program. and i noticed that it had 2 svchost.exe programs in the applications tab of the task manager. at the time one was running and the other was not responding. i thought this was the problem so i went into regedit and searched for svchost.exe and it brought up many results had names that related to my songs i downloaded e.g. back in the USSR. so i decided to open that beatles song and it brought a blue screen reporting some serious error, then restarted. nothing bad happened but the 2 files were still there. so i went into regedit and deleted all the results of 'svchost' i restarted my computer and then to my surprise only one svchost.exe file was there in the applications tab. (the other funny thing is that the little icon near svchost.exe in the applications tab was an icon for a zip file) and i tried to listen to the song again it worked but media player brought an error message saying it had to be closed down. i then downloaded hijackthis and here is the log. Logfile of HijackThis v1.97.7 Scan saved at 22:24:50, on 29/12/2003 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe C:\WINDOWS\Explorer.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\KMaestro\KMaestro.exe C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe C:\WINDOWS\Mixer.exe C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\RUNDLL32.exe C:\Program Files\AOL 8.0\aoltray.exe C:\Program Files\AOL Companion\companion.exe C:\KMaestro\WTS_KEY.exe C:\Program Files\AOL 8.0\waol.exe C:\Program Files\AOL 8.0\shellmon.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\Sean\LOCALS~1\Temp\Rar$EX01.140\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://wer-mit-wem.webhop.net/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wer-mit-wem.webhop.net/ R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [KeyMaestro] C:\KMaestro\KMaestro.exe O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup O4 - HKLM\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\ee.exe /m O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor O4 - HKCU\..\Run: [Winstart] C:\windows\winstart32.exe O4 - HKCU\..\Run: [Ahead] C:\windows\Ahead.exe O4 - HKCU\..\RunServices: [Winstart] C:\windows\winstart32.exe O4 - HKCU\..\RunServices: [cmuninst32] C:\windows\cmuninst32.com O4 - Startup: Check For Dope Wars Updates.lnk = C:\Program Files\Dopewars\WiseUpdt.exe O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: PSPSetup.lnk = C:\WINDOWS\regedit.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Researcher (HKLM) O9 - Extra button: Real.com (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://D:\SuperCD\IntraLaunch.CAB O17 - HKLM\System\CCS\Services\Tcpip\..\{50D60893-9619-4269-94E8-0E2C6E0F5121}: NameServer = 195.93.32.134 I also have used mcafee virus scanner, and it brought up no results. Sorry for my long winded problem report, but could someone please help me. Many thanks Sean

Run an up to date virus scan. You can use AVG anti virus from www.grisoft.com. it's Free. Downlaod it and run it. SVCHOST.exe should be capitalized in your running progs. I'm pretty sure that svchost in small letters is a virus. Don't open any attatchments until you scan them in the future.

Read about svchost.exe at http://answersthatwork.com/ svchost.exe is not in upper case in my running processes, I think it's the reverse i.e. it's in uppercase as a virus but have a read anyway Re your Hijackthis log please read http://www.computing.net/windowsxp/wwwboard/forum/87147.html and http://www.computing.net/security/wwwboard/forum/6433.html Good luck & Happy New Year. V...