svc host.exe

That is not good advice to listen to FJV. There are trojans that name
themselves as svchost.exe. Its worth checking the request out in more
detail. A quick search on security websites suggests ways of seeing if your
svchost is legit.


"The Prophecy" <njfksdnksfd RemoveThis @bdbadbi.com> wrote in message
news:oWgJc.55187$eO.48492@edtnps89...
> FJV wrote:
>> I had several trojans on my computer in the past. After using and
>> running all recommended antivirus and spyware removal programs,
>> everything seems OK, except when I access internet, Zone Alarm asks
>> to allow SVC HOST.EXE to access internet. If I deny it I cannot
>> connect to any website. I did not have that happen before infections.
>> What does SVC HOST.EXE does, can/should it be uninstalled? Does it
>> mean that I am still infected by some virus/spyware/trojans?
>> Thanks for the help.
>> FJV
>
> svchost.exe is a critical system file in Windows. It is NOT a virus. The
> next time it asks for internet access, Allow it.
>
>
 >> Stay informed about: svc host.exe 

Yes true there are viruses that dump files on to your system with that name.
However, if you do a serach of your hard drive, the legit svchost.exe should
reside in the Windows\system32 folder. Any other files with that same name
will be in a different folder and will also be a virus.

Chris wrote:
> That is not good advice to listen to FJV. There are trojans that name
> themselves as svchost.exe. Its worth checking the request out in more
> detail. A quick search on security websites suggests ways of seeing
> if your svchost is legit.
>
>
> "The Prophecy" <njfksdnksfd.DeleteThis@bdbadbi.com> wrote in message
> news:oWgJc.55187$eO.48492@edtnps89...
>> FJV wrote:
>>> I had several trojans on my computer in the past. After using and
>>> running all recommended antivirus and spyware removal programs,
>>> everything seems OK, except when I access internet, Zone Alarm asks
>>> to allow SVC HOST.EXE to access internet. If I deny it I cannot
>>> connect to any website. I did not have that happen before
>>> infections. What does SVC HOST.EXE does, can/should it be
>>> uninstalled? Does it mean that I am still infected by some
>>> virus/spyware/trojans?
>>> Thanks for the help.
>>> FJV
>>
>> svchost.exe is a critical system file in Windows. It is NOT a virus.
>> The next time it asks for internet access, Allow it.
 >> Stay informed about: svc host.exe 

Thanks guys, I did search my hard drive and found svchost.exe not only in
c:\windows\system32 but also in c:\I386. Does it mean I have a Trojan and
how do I remove it?
I do run updated NAV, Spybot S&D, AdAware, HijackThis (have a clean log),
CWS Shredder and have active SpywareBlaster. Everything is clean, except
when I run S&D in Safe Mode, "DSO exploit" spyware keeps showing up, on next
reboot, even thou I am immunizing it. My friend told me that it is due to a
conflict with AdAware and is not really a spyware. True?
 >> Stay informed about: svc host.exe 

> I don't think the one in C:\I386 is a Trojan as that is kind of like an
> O/S directory, but if you see it running from that directory, you should
> be very suspicious.
>

C:\i386 is where the XP setup files are stored in an OEM setup where neither
an XP disc is supplied nor a hidden partition used.


Shane
 >> Stay informed about: svc host.exe 

Thanks a lot Duane, I followed your instructions, checked for svchost.exe
(with option: all hidden and system files shown) in windows\system
32\dllcache, but it's not there.
Downloaded and ran Active Ports program (neat little utility).
Svchost.exe (shows 9x) and runs only in windows\system32 folder (thank got
for that). One other program that runs from the same folder is LSASS.EXE
(don't know what it does).
Some other programs running are: MSMSGS.EXE (shows 4x) from: program
files\messenger folder (I hate that thing, can't stop it from running in
start up group), IEXPLORER.EXE (shows 3x) from: program files\internet
explorer folder, and ccApp.exe from: program files\common files\Symantec
shared folder.
I really appreciate the advice.
 >> Stay informed about: svc host.exe 

FJV wrote:
> Thanks a lot Duane, I followed your instructions, checked for
> svchost.exe (with option: all hidden and system files shown) in
> windows\system 32\dllcache, but it's not there.
> Downloaded and ran Active Ports program (neat little utility).
> Svchost.exe (shows 9x) and runs only in windows\system32 folder
> (thank got for that). One other program that runs from the same
> folder is LSASS.EXE (don't know what it does).
> Some other programs running are: MSMSGS.EXE (shows 4x) from: program
> files\messenger folder (I hate that thing, can't stop it from running
> in start up group), IEXPLORER.EXE (shows 3x) from: program
> files\internet explorer folder, and ccApp.exe from: program
> files\common files\Symantec shared folder.
> I really appreciate the advice.

msmsgs.exe is the executable for Windows Messenger. To make it stop running,
go to Start, Run, type in "gpedit.msc" (no quotes), under the Computer
Configuration section select Windows Components, Windows Messenger, Double
click on "Do not allow Windows Messenger to be run initially", Set it to
Enabled. If you have never used (or will never use in the future) Remote
Assistance (a program where a remote user can ask you to allow them to
temporarily take over your computer to fix a problem you are having) then
also set the "Do not allow Windows Mesenger to be Run" to "Enabled" as well.
 >> Stay informed about: svc host.exe 

I went to Start, Run and typed: gpedit.msc and got a message: Windows can
not find 'gpedit.msc'. I also tried just: gpedit but Windows could not find
it either.
As far as Active Port Utility is concerned, NAV (scan in safe mode)
identified it as a possible security threat. It could not be deleted or
quarantined. Hmmm. How do I uninstall it if no longer needed.
Thanks
 >> Stay informed about: svc host.exe 

FJV wrote:
> I went to Start, Run and typed: gpedit.msc and got a message: Windows
> can not find 'gpedit.msc'. I also tried just: gpedit but Windows
> could not find it either.
> As far as Active Port Utility is concerned, NAV (scan in safe mode)
> identified it as a possible security threat. It could not be deleted
> or quarantined. Hmmm. How do I uninstall it if no longer needed.
> Thanks

What Operating System do you have?
 >> Stay informed about: svc host.exe 

I have WindowsXP Home.
 >> Stay informed about: svc host.exe 

FJV wrote:
> I have WindowsXP Home.

That's why gpedit.msc could not be found. You did not (to this point) in
this thread say what operating system you have. Next time you post on Usenet
with a problem, please make sure you do. It makes problems MUCH easier to
solve.

Now, the only way I know of to stop Windows Messenger from starting in XP
Home, is to remove it completely. If anybody else knows of another method
for XP Home please tell me.

Go to Start, Run and type in this (without the quotes):

"rundll32 advpack.dll,LaunchINFSection %windir%\inf\msmsgs.inf,BLC.Remove"

If you are ever going to use Remote Assistance (as I described in a previous
post) you will need to go to Windows Update and reinstall it.
 >> Stay informed about: svc host.exe 

"FJV" <fjv.TakeThisOut@yahoo.com> wrote in news:8YCdneaD56rrfmvdRVn-ug@adelphia.com:

> I have WindowsXP Home.
>
>

I don't know why you cannot see svchost.exe in dllcache as it's there on
my XP machines. If you left-click in an open area in the directory and
type svc the cursor will position to the start of the svc range.

Secondly, about Active Ports, I have a short-cut for that program in the
Start Folder so during the boot and logon process, Active Ports gives me
a clear picture as to what's trying to connect in and out with the
machine from remote IP(s).

Since malware can circumvent and defeat any personal firewall solution at
the system boot and get to the TCP/IP connection first and be done before
any non integrated O/S component such as a PFW can get there to stop it,
I use AP to see what's happening myself.

Duane
 >> Stay informed about: svc host.exe 

> I don't know why you cannot see svchost.exe in dllcache as it's there on
> my XP machines. If you left-click in an open area in the directory and

It hasn't been updated?

> Since malware can circumvent and defeat any personal firewall solution at
> the system boot and get to the TCP/IP connection first and be done before
> any non integrated O/S component such as a PFW can get there to stop it,
> I use AP to see what's happening myself.

Yes, one of the Windows Firewall improvements in SP2. Think I'll have a look
at Active Ports meantime.


Shane
 >> Stay informed about: svc host.exe 

"Shane" <arthursixpence DeleteThis @hotmail.com> wrote in
news:2lonceFeshvmU1@uni-berlin.de:

>> I don't know why you cannot see svchost.exe in dllcache as it's there
>> on my XP machines. If you left-click in an open area in the directory
>> and
>
> It hasn't been updated?
>
>> Since malware can circumvent and defeat any personal firewall
>> solution at the system boot and get to the TCP/IP connection first
>> and be done before any non integrated O/S component such as a PFW can
>> get there to stop it, I use AP to see what's happening myself.
>
> Yes, one of the Windows Firewall improvements in SP2. Think I'll have
> a look at Active Ports meantime.
>
>
> Shane
>
>
>

You should set the AP's screen refresh rate to high.

Duane
 >> Stay informed about: svc host.exe