svchost.exe virus?

svchost.exe virus?

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
svchost.exe virus? crown4363 01-16-2007
Posted by =?Utf-8?B?Y3Jvd240MzYz?= on January 16, 2007, 5:19 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
hello,having memory problems with windows xp 512.after 20 minutes or
so,computer stops responding so I tried to stop one of the 6 svchost.exe
applications running and ran into the old nt authority shutdown
message.several scans showed no virus. am i infected? thanx

Posted by David H. Lipman on January 16, 2007, 5:25 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| hello,having memory problems with windows xp 512.after 20 minutes or
| so,computer stops responding so I tried to stop one of the 6 svchost.exe
| applications running and ran into the old nt authority shutdown
| message.several scans showed no virus. am i infected? thanx

It is NOT the number of SVCHOST.EXE processes that are running to determine if
its malware
but WHERE they are executed from.

If they are executed from the %windir%\system32 folder then they are
legitimate. If the
are running from any other location they they are most likely malware.

Process Explorer can be used to determine what is running and the fully
qualified path of
where they were launced...
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by =?Utf-8?B?Y3Jvd240MzYz?= on January 16, 2007, 8:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
ty for the reply.process explorer shows all svchost.exe coming from system
folder.

is it normal to have the nt authority message shut down the pc when attempting

to close an svchost application, and is this the forum for memory problems?

"David H. Lipman" wrote:

>
> | hello,having memory problems with windows xp 512.after 20 minutes or
> | so,computer stops responding so I tried to stop one of the 6 svchost.exe
> | applications running and ran into the old nt authority shutdown
> | message.several scans showed no virus. am i infected? thanx
>
> It is NOT the number of SVCHOST.EXE processes that are running to determine if
its malware
> but WHERE they are executed from.
>
> If they are executed from the %windir%\system32 folder then they are
legitimate. If the
> are running from any other location they they are most likely malware.
>
> Process Explorer can be used to determine what is running and the fully
qualified path of
> where they were launced...
>
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>

Posted by B-Man on January 17, 2007, 3:39 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
yes it is very common for the NT AUTHORITY account on your computer to
attempt to shutdown your computer when trying to end the svchost proccess

your computer may have a memory leak problem in that case im not too sure
what to do i had the same thing happen to my computer a few years back but
cant remember what i did to fix it

sorry,
Brian M

> ty for the reply.process explorer shows all svchost.exe coming from system
> folder.
>
> is it normal to have the nt authority message shut down the pc when
> attempting
>
> to close an svchost application, and is this the forum for memory
> problems?
>
> "David H. Lipman" wrote:
>
>>
>> | hello,having memory problems with windows xp 512.after 20 minutes or
>> | so,computer stops responding so I tried to stop one of the 6
>> svchost.exe
>> | applications running and ran into the old nt authority shutdown
>> | message.several scans showed no virus. am i infected? thanx
>>
>> It is NOT the number of SVCHOST.EXE processes that are running to
>> determine if its malware
>> but WHERE they are executed from.
>>
>> If they are executed from the %windir%\system32 folder then they are
>> legitimate. If the
>> are running from any other location they they are most likely malware.
>>
>> Process Explorer can be used to determine what is running and the fully
>> qualified path of
>> where they were launced...
>>
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx
>>
>> --
>> Dave
>> http://www.claymania.com/removal-trojan-adware.html
>> http://www.ik-cs.com/got-a-virus.htm
>>
>>
>>



Similar ThreadsPosted
Strange svchost.exe April 23, 2008, 8:54 am
Modified svchost.exe November 9, 2008, 5:46 am
C:\WINDOWS\SYSTEM32\SVCHOST.EXE August 7, 2006, 6:00 pm
Help! Fake svchost.exe on my computer October 6, 2006, 7:27 am
What is C:\WINDOWS\system32\svchost.exe December 8, 2006, 10:03 pm
SMTP Trojan uses SVCHOST on W2K Pro November 4, 2008, 1:23 pm
Re: Unknown svchost.exe DNS port 53 network activity December 20, 2006, 4:26 pm
HELP: Virus is preventing me from installing anti virus software!! January 11, 2007, 2:17 am
I have a virus that uses "anti virus software" downloads as a cover up March 24, 2007, 1:40 pm
I have a worm or virus that does not allow me to go to ANY anti-virus website January 28, 2006, 10:29 pm

The site map in XML format XML site map

Contact Us | Privacy Policy