scvhost.exe

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

IS scvhost.exe good or bad?

Some internet site indicate it's bad. I have anNywhere from 4 to 7
scvhost.exe's listed in Task Manager as running at one time.

If bad, how do I remove them/it?
 
Please read the following:

A description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;314056

Description of Svchost.exe in Windows XP
http://windowsxp.mvps.org/svchost.htm

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Get Windows XP Service Pack 2 with Advanced Security Technologies:
http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx

-------------------------------------------------------------------------------------------

:

| IS scvhost.exe good or bad?
|
| Some internet site indicate it's bad. I have anNywhere from 4 to 7
| scvhost.exe's listed in Task Manager as running at one time.
|
| If bad, how do I remove them/it?
 
From: "Jupiter Jones [MVP]" <[email protected]>

| Note the spelling very carefully:
| scvhost.exe is BAD
| svchost.exe is good and normal
| The different sites probably had different spelling and you missed the
| subtle difference.
|
| See this link:
| http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.n.html
|
| Also see this link to help protect your computer and prevent this in the
| future:
| http://www3.telus.net/dandemar/security.htm
|
| --
| Jupiter Jones [MVP]
| http://www3.telus.net/dandemar
| http://www.dts-l.org
|
|
Jupiter:

The statemnt "svchost.exe is good and normal" is only partially true.

The fact is there are *many* forms of malware that use that name. When one sees SVCHOST.EXE
on a Win9x/ME PC it is guaranteed to be malware. If SVCHOST.EXE is found on a NT based OS
in other than
%windir%\system32\svchost.exe (and the usual OS CACHE/ServicePack folders) it is most likley
an infector.

For example, if SVCHOST.EXE is found in %windir%, it could be 'W32/Opanki.worm'-
http://vil.nai.com/vil/content/v_133397.htm

Or if SVCHOST.EXE is found in c:\, it could be 'W32/CodeBlue.worm' -
http://vil.nai.com/vil/content/v_99202.htm
 
eshoeman said:
IS scvhost.exe good or bad?

Some internet site indicate it's bad. I have anNywhere from 4 to 7
scvhost.exe's listed in Task Manager as running at one time.

If bad, how do I remove them/it?


It's perfectly normal to have several instances of Svchost.exe running
simultaneously.

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

However, if Svchost.exe is using a large portion of your CPU
cycles, it has most likely been "hijacked" by a worm, Trojan, or
scumware.


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH
 
Thank you for the correction David.
Your more correct information may be helpful to the OP especially if the
spelling used by the OP meant the usually normal version.
 
From: "Jupiter Jones [MVP]" <[email protected]>

| Thank you for the correction David.
| Your more correct information may be helpful to the OP especially if the
| spelling used by the OP meant the usually normal version.
|
| --
| Jupiter Jones [MVP]
| http://www3.telus.net/dandemar
| http://www.dts-l.org
|

It is interesting to note that SVCHOST.EXE is one of the most targeted names for infectors.
Either they directly use the name SVCHOST.EXE or a variation of that name. Therefore,
spelling the filename exactly can be an important indication of infection and the
relationship to this or other posts.

The problem is we all make stupid spelling errors (myself included) but in this instance,
spelling correctly is highly relevant.
 
Back
Top