Virus File

[R. Hansel]

Interested in a file known to be linked to blaster. Its
called svchost.exe Question is, should I delete this
file? I don't believe I am infected but have seen in
Norton under Welsha or something like that, and they
wanted that file deleted. All virus software is updated
and I am running a firewall from Zone Alert. Registry is
clean of the files Norton mentioned. But I do see
svchost.exe in my windows system\win directory. I am
having no problems that I aware of with the computer. All
security updates have been installed.

 

[sli]

If you decide to hit end task on that function for
svchost, just make sure it is not in CAPS. If it is in
caps, then it is a valid file that Windows needs to run.

Where is this documented? Mine are not in caps.

 

[purplehaz]

I don't know about the caps statement, but heres info on it:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

 

[purplehaz]

This is not linked to blaster it a legit windows process and it normal to
see 3,4, 5 or more running. Here's some info on it:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

 

[ceedee]

svchost.exe is a system file
it is located in the system32 dir and also poss will be found in the
system32/dllcache dir
if you have installed servicepack then it may appear also in c:\i386 and/or
c:\windows\servicepack files

if you have it in system32/wins dir it is the remnant of a virus
the built in ftp in winxp is copied to wins dir as svchost.exe along with
the virus file usually called wins/dllhost.exe

most virus checker will clean the virus by deleting dllhost.exe but usually
miss or leave the copied svchost.exe in the wins dir

just delete this file from the wins dir

ceedee

 

[Alex Nichol]

Interested in a file known to be linked to blaster. Its
called svchost.exe Question is, should I delete this
file?

SvcHost is an important system component, and the system will not run
properly without it. There should be a copy in windows\system32 and
another in windows\system32\dllcache.

Should you get suspicious of the one in system32, rename it (say
svchost.xex). File protection will then bring in a clean version from
the cache within seconds. Reboot to bring that one into use, and then
delete the .xex