svchost.exe

[Db]

MS AntiSpyware Beta1 found this to be a possible Trojan
file. Thus I presumed that it needed to be researched
and possibly deleted from my system. Only to find out on
the MS Website that this is a system level MS program
that is functional to Windows XP. go figure...guess I
best not be trying to delete this puppy. So I turned off
any blocking of this file by the AntiSpyware Beta.
Thanks sorry to clog up your newsgroup!

 

[same heresame here]

same here

 

[Ron Chamberlin]

Hi DB,

Take a real hard look at that file and make really , really sure that it is
spelled exactly the way it should be, and has no extraneous letter,
characters or numbers with it.

I've handled a few of these wherein that file name was munged to look like
the real deal, and it wasn't.


Ron Chamberlin
MS-MVP

 

[Rob]

lcass (small L) & Icass (capital "eye") in an Arial font, for ex.
(d***ed near drove me nuts!!)

 

[Bill Sanderson]

Check the location of the file as well.

Personally, if Microsoft Antispyware alarms on this file, I'd bet that this
is a legit alarm, and I'd fix it pronto. If in doubt, check with a
competent antivirus with current signatures--I believe any good antivirus
should be finding this as well.

 

[Ron Kinner]

If you are sure it's not scvhost or svhost then

http://www.diamondcs.com.au/index.php?page=products

Get their AutoStart Viewer, install and run it. Then find
each svchost.exe file and verify that they all have the
same path. Then look at the end of each line. After
svchost.exe it should have -k something. rpcss netsvcs are
the two running on my Win2K.

As always if you need help:

Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then
send it to me as an attachment.

Ron Kinner
(e-mail address removed)