svchost.exe

ben1390 · 20-04-2006, 22:15

I have a file on my PC which is called svchost.exe and Norton Internet Security 2003 is saying that it is a virus. After a quick google i found out that it is not a virus. But i continually get these Norton error messages saying that it cannot quarantine or delete the virus. I have tried manually deleting the virus but it can't do that. Does anyone have any ideas on how to fix this?

nffc · 20-04-2006, 22:23

Depends where it is. If it's C:\Windows\System32 it's legit but should never appear in Msconfig.

ben1390 · 20-04-2006, 22:25

its in the location C:\Documents and Settings\All Users\Start Menu\Startup\svchost.exe if this helps

Gareth · 20-04-2006, 22:36

Right click on it and select properties. If it was in Windows\system32 then it should be the legitimate Windows file of that name, but considering where it is and that your AV says it's infected, I'd tend to believe it and try quarantining it.

Here's an example of a worm that creates a file of the same name but that is infected... http://www.symantec.com/avcenter/ven...torvel@mm.html

Just because a file has the same name as a legitimate file, doesn't mean that it's not infected with a virus.

bopdude · 20-04-2006, 22:44

Quote:

Originally Posted by topcreator

I have a file on my PC which is called svchost.exe and Norton Internet Security 2003 is saying that it is a virus. After a quick google i found out that it is not a virus. But i continually get these Norton error messages saying that it cannot quarantine or delete the virus. I have tried manually deleting the virus but it can't do that. Does anyone have any ideas on how to fix this?

There was another thread a while ago about this, there's some good info, plus, check out my links in post #9, they give you info on what each instance is

Thread

Anonymouse · 20-04-2006, 22:47

If you select Properties and click on the Version tab, if the file's legit it'll have the value 'Microsoft Corporation' next to 'Company Name' and there'll be a copyright message. The file will identify itself as 'Generic Host Process for Win32 Services'. If there's nothing there and/or the file is anywhere else but the Windows\System32 folder, it's a worm.

Graham M · 20-04-2006, 22:55

Quote:

Originally Posted by Anonymouse

If you select Properties and click on the Version tab, if the file's legit it'll have the value 'Microsoft Corporation' next to 'Company Name' and there'll be a copyright message. The file will identify itself as 'Generic Host Process for Win32 Services'.

This information can easily be spoofed in the file. You can set this information in whatever programming environment you use!

**Paul** · 20-04-2006, 23:01

Given it's location I would simply delete it - no genuine copy of scvhost.exe would reside there.

TheBlueRaja · 20-04-2006, 23:02

Im with Paul M it shouldnt be in startup, delete it.

Graham M · 20-04-2006, 23:04

You might have to kill it first before you can delete it. If you check in the processes list of task manager the real SVCHosts should be owned by a user like "System" or "Network Service" or similar, whereas the dodgy one will probably be owned by Your Username.

deadite66 · 21-04-2006, 06:43

you can submit a single file to be scanned on kaspersky
http://www.kaspersky.com/virusscanner

Gareth · 21-04-2006, 09:59

Contrary to Paul, I wouldn't delete it - I would quarantine it. Any decent antivirus has a quarantining function, which blocks the file from doing anything, but allows you to unquarantine it if your PC gets fubar'ed.

It's hard to get it back if you've deleted it however.

TheBlueRaja · 21-04-2006, 11:55

Quote:

Originally Posted by Gareth

Contrary to Paul, I wouldn't delete it - I would quarantine it. Any decent antivirus has a quarantining function, which blocks the file from doing anything, but allows you to unquarantine it if your PC gets fubar'ed.

It's hard to get it back if you've deleted it however.

But he's got norton (snigger)...

Seriously though, that product does quarantine, the real question is why hasnt it detected it IF its a virus?

Assuming thats what it is.

ben1390 · 21-04-2006, 16:11

Thanks for all your help, i have now sorted it. It was not a shortcut to the system32 folder and i tried manually deleting it and that didn't work so i have quarantined it and my system is now working alright

Anonymouse · 21-04-2006, 22:33

Quote:

Originally Posted by Zeph

This information can easily be spoofed in the file. You can set this information in whatever programming environment you use!

Of course you can do that, and anyone who's writing legit apps should and probably will - but the maladjusted ******s who write such scumware generally don't. They're clever enough to write the crap, but not clever enough to include copyright info.

We hope.

And there's one property that's difficult to spoof, viz. the file size. It is - or should be - 7,952 bytes for Win2000 and 14,336 bytes (exactly 14K) in XP.