SVCHOST.EXE question

[Enkidu]

Thanks for the advise. Just checked and no reg entries..Deleted SVCHOST.EXE
from the wins directory....for the unteenth time. DL'd and ran 3 of Symantecs
anti viral programs which didn't find anything.....this was after I reloaded
AVG (for the unteenth time), ran it, and deleted the 'nachi' worm (for the
unteenth time).

Ask WHY you keep getting reinfected! You talk about downloading your
AV but you don't mention patching your system.

Disconnect from the network or the Internet. Download the patches on
another machine. Apply the patches, and run the worm removal tools.
Note that while the AV tools will detect and make the worm harmless,
they DO NOT remove it. You need a special tool.

Cheers,

Cliff

 

[elfa]

Ask WHY you keep getting reinfected! You talk about downloading your
AV but you don't mention patching your system.

Disconnect from the network or the Internet. Download the patches on
another machine. Apply the patches, and run the worm removal tools.
Note that while the AV tools will detect and make the worm harmless,
they DO NOT remove it. You need a special tool.

Cheers,

Cliff

That's the BIG prob. I have a hardware problem that doesn't allow me to run MS
Service packs ("file is corrupt" is one of the standard warnings). Without at
least Service Pack 2, I can't put on the prevention tools.

elfa

 

[Enkidu]

That's the BIG prob. I have a hardware problem that doesn't allow me to
run MS Service packs ("file is corrupt" is one of the standard warnings).
Without at least Service Pack 2, I can't put on the prevention tools.

Are you sure it's a hardware problem? Have you tried getting the
patches downloaded *from another machine* that is known good (friend,
family, work or whereever).

Cheers,

Cliff

 

[elfa]

Are you sure it's a hardware problem? Have you tried getting the
patches downloaded *from another machine* that is known good (friend,
family, work or whereever).

Cheers,

Cliff

Ya...trust me on this. I actually paid $20 to MS to send me the Service Pack
CD, thinking it was a DL error (they sent the wrong one!). "File is corrupt"
error from the CD install. I can't even reformat and reinstall Windows fresh
from DOS, as I get the same errors when executing winnt.exe.

I can reimage the PC from an image I made, thinking the image was 'clean'.
Turns out that the image had 2 worms (nachi and blaster). NAV (with the latest
updates) didn't catch either of them (that is, when NAV didn't crash my computer
when doing a scan). So...each time I got frustrated with my PC, I'd reimage and
of course, get the worms! Switched to AVG and am using the Symantec tools....at
this point I seem to be "worm free"....the HD no longer 'churns' for no reason
and I'm no longer getting 15 copies of CMD.EXE in Task Manager/Processes. AND,
drum roll please, no more copies of SVCHOST.EXE in the wins directory.

So...I'm stuck with what I've got. No job means no replacement hardware.

elfa

 

[Earl F. Parrish]

T.R. pounced upon this pigeonhole and pronounced:

system.

While you are correct and it is normal to have three or four running
copies of svchost.exe, the original question was about two different local
files named that.

On my Win2K SP4 system, I have two copies, in:
c:\winnt\system32
c:\winnt\system32\dllcache

Both are 7,952 bytes and dated 12/7/1999 (Dec 7, 1999)

All the Windows 2000/XP system files are backed up in
system32\dllcache. It grows as you make changes to operating system
software. I have over three thousand files in the folder on my
computer. You can control its size using the System File Checker
application. The Windows Task Manager shows processes and not just
running programs. If SVCHOST.EXE is performing a different
process, you will see a different listing. If you look at your
Services under Administrative Tools, you will see that many of the
services are SVCHOST.EXE with a different switch. My computer only
has one copy of SVCHOST.EXE in windows\system32 plus the backup copy
in windows\system32\dllcache. The path will begin with winnt with
Windows NT and Windows 2000 and with windows for Windows XP.

 

[T.R.]

All the Windows 2000/XP system files are backed up in
system32\dllcache.

I don't seem to have that folder Earl...

But, if one did and lets say that their system is working just fine
then could one just clean that folder out?

Regards......

ô¿ô
~


The Reply

 

[Earl F. Parrish]

I don't seem to have that folder Earl...

But, if one did and lets say that their system is working just fine
then could one just clean that folder out?

Regards......

ô¿ô
~


The Reply

It is a hidden protected operating system folder. You have to
uncheck that option in Tools/Folder Options/View from any folder
window to see that subdirectory or its contents. Remember to
reactivate the option when you are done. If you used brute force to
delete the files in that folder, they would be restored by the
operating system from the active copy. If both are missing, you
would have to use the CD-ROM each time you reinstall a Windows
component.
[/QUOTE]

 

[T.R.]

It is a hidden protected operating system folder. You have to
uncheck that option in Tools/Folder Options/View from any folder
window to see that subdirectory or its contents.

Actually, I always have my system configured to "Show all Hidden Files
and Folders". That way I see if anything new is popping up that
shouldn't be. Still no such folder as the one you mentioned on my
system. Could it be a difference in an OEM version of XP and a retail
version or the difference in XP Pro and Home?

I use an OEM (Gateway) version of XP Home.

Regards......

ô¿ô
~


The Reply

 

[Earl F. Parrish]

Actually, I always have my system configured to "Show all Hidden Files
and Folders". That way I see if anything new is popping up that
shouldn't be. Still no such folder as the one you mentioned on my
system. Could it be a difference in an OEM version of XP and a retail
version or the difference in XP Pro and Home?

I use an OEM (Gateway) version of XP Home.

Regards......

ô¿ô
~


The Reply

I sent you a reply with a picture of the place where you change the
setting to see all files. The message never made it to this
newsgroup. I had already sent it when I realized that is was going
to two other newsgroups. They must have blocked it because it had
binary content. Scroll down within the Folder View window until you
see an entry "Hide protected operating system files (Recommended)
and turn off the check mark until you have finished looking for the
folder. Recheck it when you are done.

 

[T.R.]

"Hide protected operating system files (Recommended)
and turn off the check mark until you have finished looking for the
folder.

Earl, I always have that unchecked so Hidden Files and Folders always
show so I can see when something pops up that shouldn't be popping up.
The folder is question is still not on my system.

It doesn't really matter since I was just inquiring that if I did have
it, could I empty it and you answered that question. I assume that
the reason I do not have that folder may be that my copy of XPHome is
a Gateway OEM version which has some different stuff in it that your
off-the-shelf versions don't have and is also possible different in
configuration than your of-the-shelf versions.

I do know from another NG that depending on where you get your copy of
XP depends on if your windows directory is named Windows or named NT.
Mine is named Windows but my neighbor's is named NT. His copy of XP
is a DELL OEM Version. So.... from this I assume that not all
versions of XP are the same or have the same "basic" directories.

Regards......

ô¿ô
~


The Reply

 

[Enkidu]

It doesn't really matter since I was just inquiring that if I did have
it, could I empty it and you answered that question. I assume that
the reason I do not have that folder may be that my copy of XPHome is
a Gateway OEM version which has some different stuff in it that your
off-the-shelf versions don't have and is also possible different in
configuration than your of-the-shelf versions.
Not likely.

I do know from another NG that depending on where you get your copy of
XP depends on if your windows directory is named Windows or named NT.
Mine is named Windows but my neighbor's is named NT. His copy of XP
is a DELL OEM Version. So.... from this I assume that not all
versions of XP are the same or have the same "basic" directories.

There is only one version. However if you install an upgrade, you will
find that the directory is WinNT. If it is a full version it is
usually named Windows.

Cheers,

Cliff