# svchost.exe



## a.maverick (Oct 19, 2001)

I somehow got the Cydoor set of malware into my winXp home PC.I downloaded Ad aware and ran it, and it got rid of most of the stuff.
But ad aware detects the program "svchost.exe" in the system folder as a harmful file.It cannot delete the file.I even tried deleting it in safe mode but no success.
The only remanats on my system are this message and the occasional changing of my homepage to a porn site.

Someone please advise on removing this, manually or with some software 

Thanks
AM


----------



## RSM123 (Aug 1, 2002)

Hi,

See this link for further information on removal

http://www.sophos.com/virusinfo/analyses/trojunreala.html

And on the homepage being hijacked ( this happening to me was the reason I joined TSG.) See here.

http://www.spywareinfo.com/hijacked.html


----------



## Top Banana (Nov 11, 2002)

Leave svchost.exe alone. Don't remove it. Update your Ad-aware 6 Build 162 with the latest reference file which is OR133 26.03.2003 as I type, and scan again. svchost.exe is not harmful.


----------



## $teve (Oct 9, 2001)

wouldnt be a bad idea to download "startuplist" run the program and copy/paste the text file here......then we can take a look see if anything else needs taking out.
http://www.lurkhere.com/~nicefiles/


----------



## $teve (Oct 9, 2001)

forgot to mention in my pm.........if you need to uninstall "getright" it should be in add/remove programs list.
then run spybot to take out anything it leaves behind.


----------



## AAPlus (Oct 29, 2001)

Hello,a.maverick

Please do as asked by Top Banana
if you have Ad-Aware build 0162 & the
Latest Reffile # 133 26.03.2003 you should
not have this problem

Hey,Top Banana

Thanks for the heads-up on this

Good luck


----------



## rhprice (Jun 13, 2003)

Norton Virus Alert tells me I hae a Backdoor.Litmus.203 virus in svchost.exe. 
When I do a virus scan, Norton indentifies the virus but can't delete or quaranitine it. In addition, the virus alert box on my desk top will not close.
Any suggestions for someone not so capable on a computer?
Please contact me at [email protected]

R H Price


----------



## Debb-aura (Oct 28, 2002)

Hi R.H,
Go here:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.litmus.203.html

That's the fix.
HTH, Regards, Debb


----------



## SVCHoSTBaD (Jun 18, 2003)

svchost not bad? are you CRAZY??

svchost is a nessasary program that uses generic host to connect you to the internet.
without svchost your internet explorer cannot connect.
the problem is that people replicate you legitamate file and make extra svchost on your computer which they use to "file share" and
have "net bios" sessions with your computer without you knowing.

basically they have copmplete control over your files and they can download them copy them or anything. if you get a crappy firewall like Sygate personal firewall. it will show you how many svchost you have connecting and if you put your mouse curser over them it will show you what each one is doing for example:-
1 may be sharing your comps files
and another maybe having a net bios session with your computer

the problem is getting rid of the damm things. i dont know how and if any one finds out please tell me cos i only need two svchost connecting using generic host for internet explorer but i have 10 altogether and all the othert ones are sharing my files and my resourses.

you can press....ctrl + alt + del and you will see the task manager window and you can see all the current running processes on your computer and you can stop svchost running in there but i have found that when i have 10 svchost connections and ctrl alt and del only shows 5 of them. also in the task managert window you can stop svchost running but if you click on the one your computer needs to run it will shut down your computer so here is a easy way to tell which ones are nessasary.

start at the top and make your way down clicking on all the svchosts running and stop them running untill you reach the one which is using up the most {k} then delete that one and do not delete any more below that.

you will know what i mean by K when you press ctrl alt and del.


hope i have been of some help to some people and if anyone finds out how to properly shut these down or delete them for good then please let me know.


do me a favour and visit my site ..

WARNING this is not spam i am telling you in advance that this is a outwar type game but this is a porn version. if it was spam i would be lying about what it was but as i am telling you all directly you do not have to click it if you dont want to and now you all know what it is so pls dont report this as spam and get me knocked of this site.

if you want your own porn version of this site click my link and you will see a page that also offers you the chance to fill in and register for your own game.

moderators....please do not delete this post. i am not spammin i am telling everyone in advance what this is and if they dont want to click it they dont have to.
thanks in advance.

REMOVED LINK!
Perhaps you'd better read our forum rules again


----------



## $teve (Oct 9, 2001)

and after the X rated flame posts by SVCHoSTBaD(removed by eddie)lets hope he stays away............it must have took a lot out of him thinking up words like that.
he should save his breath for blowing up his girlfriend.


----------



## Dashley (Jun 28, 2003)

I've been having problems lately with what seams like my computer skips like a cd player when it gets bumbed around. Usually restarting the computer fixes the problem for a little while but it has been coming back faster and faster. I tried watching the Task Managers Process list so see what uses up the CPU and its this svchost.exe program. It never uses more then 10 percent of the CPU so I'm not completely sure if that is the problem. The Task Manager says I have 4 copies of this svchost.exe program running though so I don't think thats normal. So I did a google search to see what I could come up with and I found this thread on your board. I downloaded Spybot and adaware and ran both of the programs that that doesn't seem to have fixed it. I tried ending the process on one of the processes and that shut down the computer. You probably already said some other suggestions in this or other threads but I would really appreciate it if someone could walk me through what I should do.

Thanks,
Dan


----------



## mal1930 (Apr 27, 2002)

Hi Dan, I am using XP home and my computer is squeaky clean. I have 5 svchosts in my Task manager. It is a host for numerous services. 3 are for systems 1 for networks service and the last for Local service. Peace Mal

PS I am behind a firewall that has been tested and is secure and I don't run any file sharing programs.


----------



## Dashley (Jun 28, 2003)

It is almost certainly caused my svchost.exe cause i've watched the taskmanager while listening to an mp3 player so I could see what spiked in cpu usage when the music skipped and it was svchost.exe. I ended that process and it stopped skipping. I would like to know how to get rid of it so I don't have to keep finding out which copy of svchost is the bad one and ending the process everytime I restart my computer.


----------



## mal1930 (Apr 27, 2002)

HI, I am sorry but I can't help you. Have a look her to see what services are neccessary.

http://blackviper.com/


----------



## foam987 (Jul 18, 2003)

Hello All, My Norton Firewall tells me that a computer in China at 210.5.22.20 is trying to connect to my computer via svchost.exe. I have never has contact with anyone in China.
Could this be an attempt to hack into my puter??


----------



## mal1930 (Apr 27, 2002)

HI, THis happens sometimes but most pings are harmless and your firewall is stopping it anyway. I would more or less forget it. Peace Mal


----------



## jeboone (Jul 25, 2003)

If the svchost.exe file is located in the /Windows/system32/ folder, then its okay. If the file is located in the /Widnows/winsys/ folder, then it's the devil. 

Restart your computer, repeatedly tap the F8 key (after you get done w/ the Bios functions) and start in Safe Mode. When you get started up, either run a virus utility or delete the file in the /Windows/winsys/ folder. That should do the trick.

Another symptom of this virus is the inability to startup either the taskmanager, msconfig, or regedit.

Good Luck.


----------



## meuserme (Jul 28, 2003)

207.46.134.94

if you have a svchost from this ip address 207.46.134.94
it is Microsoft windows update but Microsoft use's cluster servers so the ip address can change
the only two ports open are port 80 and 443 
found with sss.exe


----------



## Dooood (Aug 5, 2003)

hello  i recently had probs with the svchost.exe file that would cause my comp to restart itself about 45 secs after the error message popped. Spybot Search and Destroy has cleared the problem so far. However, when i view all the processes runnin on my comp...I see 3 svchosts.exe runnin from win32 (which was stated in an above post to be ok) but 2 others that dont have a source file givin. I was wonderin if anyone could tell me somethin about this pls  is it good, bad, or dont worry about it .

-Brad


----------



## mal1930 (Apr 27, 2002)

Hi, I really can't tell you about your computer but mine can have at least 6 running and as far as I am aware my computer is as good as new.

There are 4 running for systems, 1 for local service and 1 for Network service.

They are all in the taskmanage but at the time I write are not using the CPU. Peace Mal


----------



## Dooood (Aug 5, 2003)

Hi again hehe. I run SpyBot everyday and there are always new things that need to be removed. why and is there anyway i cant prevent them from gettin on my computer? I'm glad I can at least remove them....but i would like to stop them from evening gettin on.

-Brad


----------



## mal1930 (Apr 27, 2002)

Hi, I am not certain about the things you need to remove. Spybot files with a red ! Mark need to be removed.

Spybot at one time also showed files that could be removed to protect your privacy with the marker in amber. Removing many of these are a waste of time as the keep recurring every time you use that particular program. I just disregard them. I also think you might be able to indicate to the program that you no longer want to track such items. Read the Help.

Spyblaster will warn you of items that are spyware before you download and another program that gives extra help is Spyguard.
Have a look here. Peace Mal
http://www.wilderssecurity.net/spywareguard.html


----------



## Dooood (Aug 5, 2003)

Thanks alot Mal


----------



## Rollin' Rog (Dec 9, 2000)

closing thread; those with specific problems should start a new one for best support.


----------

