hi,
I'm trying to locate an app/process/malware that auto connects me
to the internet, on random times. windows FW exceptions are all
unchecked. NAV/SPYBOT scans came with nothing so far.
During the search i found 2 extra(?) copies of 'svchost.exe':
1. c:\windows\system32\svchost.exe - 14336 bytes (ver 5.1.2600.2180)
2. c:\windows\ServicePackFiles\i386 - 14336 bytes (ver 5.1.2600.2180)
3. c:\windows\$NtServicePackUninstall$\ - 12800 bytes (ver 5.1.2600.0)

all support sites say that only the 1st one should be present.
any ideas?
--------------
thanks, jacob

Jacob

1. Current in use.

2. Backup copy if 1 gets damaged.

3. Previous copy if you decide to uninstall update and go back.

Please show me a support site which says only one should
be present. I think you are misinterpreting what has been written.

svchost.exe is used by a number of applications, which can
all be running at one time.

Try another anti-spyware programme or several.
http://www.broomeman.com/spyware/

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


"jacob" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> hi,
> I'm trying to locate an app/process/malware that auto connects me
> to the internet, on random times. windows FW exceptions are all
> unchecked. NAV/SPYBOT scans came with nothing so far.
> During the search i found 2 extra(?) copies of 'svchost.exe':
> 1. c:\windows\system32\svchost.exe - 14336 bytes (ver 5.1.2600.2180)
> 2. c:\windows\ServicePackFiles\i386 - 14336 bytes (ver 5.1.2600.2180)
> 3. c:\windows\$NtServicePackUninstall$\ - 12800 bytes (ver 5.1.2600.0)
>
> all support sites say that only the 1st one should be present.
> any ideas?
> --------------
> thanks, jacob
>

...........
> Please show me a support site which says only one should
> be present. I think you are misinterpreting what has been written.
...........

Gerry,
i'm beginning to think you are right about that, though here's
one of the sites that made me think the opposite:

http://process.networktechs.com/Svchost.exe.php

<quote>
VIRUS PRECAUTION:
The original file from Microsoft gets placed in the Located in
C:WINDOWSSystem32 directory. If you find it anywhere else
then you should be suspicious for sure.
</quote>

----------
thanks, jacob

jacob wrote:

> I'm trying to locate an app/process/malware that auto connects me
> to the internet, on random times. windows FW exceptions are all
> unchecked. NAV/SPYBOT scans came with nothing so far.
> During the search i found 2 extra(?) copies of 'svchost.exe':
> 1. c:\windows\system32\svchost.exe - 14336 bytes (ver 5.1.2600.2180)
> 2. c:\windows\ServicePackFiles\i386 - 14336 bytes (ver 5.1.2600.2180)
> 3. c:\windows\$NtServicePackUninstall$\ - 12800 bytes (ver 5.1.2600.0)
>
> all support sites say that only the 1st one should be present.



No, that last statement is completely false. In fact having several examples
of svchost running is completely normal.

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup

The site you listed refers to "1" listed in Gerry's response

"jacob" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> ..........
>> Please show me a support site which says only one should
>> be present. I think you are misinterpreting what has been written.
> ..........
>
> Gerry,
> i'm beginning to think you are right about that, though here's
> one of the sites that made me think the opposite:
>
> http://process.networktechs.com/Svchost.exe.php
>
> <quote>
> VIRUS PRECAUTION:
> The original file from Microsoft gets placed in the Located in
> C:WINDOWSSystem32 directory. If you find it anywhere else
> then you should be suspicious for sure.
> </quote>
>
> ----------
> thanks, jacob
>

On Sun, 3 Dec 2006 09:13:34 -0700, "Ken Blake, MVP"
<(E-Mail Removed)> wrote:

>> all support sites say that only the 1st one should be present.
>
>
>
>No, that last statement is completely false. In fact having several examples
>of svchost running is completely normal.

I currently have 6 svchost.exe processes running on my computer. Three
of them are SYSTEM, two are NETWORK SERVICE, and one is LOCAL SERVICE.
As far as I know, my system is clean... I hope.

--
Zilbandy - Tucson, Arizona USA <(E-Mail Removed)>
Dead Suburban's Home Page: http://zilbandy.com/suburb/
PGP Public Key: http://zilbandy.com/pgpkey.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Zilbandy wrote:

> On Sun, 3 Dec 2006 09:13:34 -0700, "Ken Blake, MVP"
> <(E-Mail Removed)> wrote:
>
>>> all support sites say that only the 1st one should be present.
>>
>>
>>
>> No, that last statement is completely false. In fact having several
>> examples of svchost running is completely normal.
>
> I currently have 6 svchost.exe processes running on my computer. Three
> of them are SYSTEM, two are NETWORK SERVICE, and one is LOCAL SERVICE.
> As far as I know, my system is clean... I hope.



Right. Six is not at all unusual, nor does it represent a problem.

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup

> No, that last statement is completely false. In fact having several
> examples of svchost running is completely normal.

Ken,
having several *processes* running with svchost is indeed normal,
but how would i know if they *all* were started by the *same*
file "svchost.exe" that resides in \system32?
-----
jacob

Yes


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

"jacob" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>> No, that last statement is completely false. In fact having several
>> examples of svchost running is completely normal.
>
> Ken,
> having several *processes* running with svchost is indeed normal,
> but how would i know if they *all* were started by the *same*
> file "svchost.exe" that resides in \system32?
> -----
> jacob
>

jacob wrote:

>> No, that last statement is completely false. In fact having several
>> examples of svchost running is completely normal.
>
> Ken,
> having several *processes* running with svchost is indeed normal,
> but how would i know if they *all* were started by the *same*
> file "svchost.exe" that resides in \system32?


I'm confused by your question. Why should you expect anything different?

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup