svchost.exe
 

I have a file on my PC which is called svchost.exe and Norton Internet Security 2003 is saying that it is a virus. After a quick google i found out that it is not a virus. But i continually get these Norton error messages saying that it cannot quarantine or delete the virus. I have tried manually deleting the virus but it can't do that. Does anyone have any ideas on how to fix this?

Re: svchost.exe
 

Depends where it is. If it's C:\Windows\System32 it's legit but should never appear in Msconfig.

Re: svchost.exe
 

its in the location C:\Documents and Settings\All Users\Start Menu\Startup\svchost.exe if this helps

Re: svchost.exe
 

Right click on it and select properties. If it was in Windows\system32 then it should be the legitimate Windows file of that name, but considering where it is and that your AV says it's infected, I'd tend to believe it and try quarantining it.

Here's an example of a worm that creates a file of the same name but that is infected... http://www.symantec.com/avcenter/ven...torvel@mm.html

Just because a file has the same name as a legitimate file, doesn't mean that it's not infected with a virus.

Re: svchost.exe
 

There was another thread a while ago about this, there's some good info, plus, check out my links in post #9, they give you info on what each instance is :tu:

Thread

Re: svchost.exe
 

If you select Properties and click on the Version tab, if the file's legit it'll have the value 'Microsoft Corporation' next to 'Company Name' and there'll be a copyright message. The file will identify itself as 'Generic Host Process for Win32 Services'. If there's nothing there and/or the file is anywhere else but the Windows\System32 folder, it's a worm.

Re: svchost.exe
 

This information can easily be spoofed in the file. You can set this information in whatever programming environment you use!

Re: svchost.exe
 

Given it's location I would simply delete it - no genuine copy of scvhost.exe would reside there.

Re: svchost.exe
 

Im with Paul M it shouldnt be in startup, delete it.

Re: svchost.exe
 

You might have to kill it first before you can delete it. If you check in the processes list of task manager the real SVCHosts should be owned by a user like "System" or "Network Service" or similar, whereas the dodgy one will probably be owned by Your Username.

Re: svchost.exe
 

you can submit a single file to be scanned on kaspersky
http://www.kaspersky.com/virusscanner

Re: svchost.exe
 

Contrary to Paul, I wouldn't delete it - I would quarantine it. Any decent antivirus has a quarantining function, which blocks the file from doing anything, but allows you to unquarantine it if your PC gets fubar'ed.

It's hard to get it back if you've deleted it however.

Re: svchost.exe
 

But he's got norton (snigger)... :p:

Seriously though, that product does quarantine, the real question is why hasnt it detected it IF its a virus?

Assuming thats what it is.

Re: svchost.exe
 

Thanks for all your help, i have now sorted it. It was not a shortcut to the system32 folder and i tried manually deleting it and that didn't work so i have quarantined it and my system is now working alright

Re: svchost.exe
 

Of course you can do that, and anyone who's writing legit apps should and probably will - but the maladjusted ******s who write such scumware generally don't. They're clever enough to write the crap, but not clever enough to include copyright info.

We hope.

And there's one property that's difficult to spoof, viz. the file size. It is - or should be - 7,952 bytes for Win2000 and 14,336 bytes (exactly 14K) in XP.