About srvchost.exe

[Guest]

I am seeing more than one srvchost.exe on the processes
tab when I open windows task manager. Could this be due to
virus?

 

[David H. Lipman]

If you mean SVCHOST.EXE that's normal.

If you spelled it correctly, it may be...

In either case, please go to McAfee (http://www.mcafee.com/myapps/mfs/default.asp) and/or
Trend
(http://housecall.antivirus.com ) and perform an online scan of your platform.

Please report back your results.

Dave



| I am seeing more than one srvchost.exe on the processes
| tab when I open windows task manager. Could this be due to
| virus?

 

[Tim]

-----Original Message-----
I am seeing more than one srvchost.exe on the processes
tab when I open windows task manager. Could this be due to
virus?
.
Check to see if you have a folder called

C:\WINNT\system32\wins on your computer, if you do and
there is a copy of svchost in it, this is from the welchia
virus. It creates this folder and makes a copy of the
svchost file. Just go into your computer under safe mode
and delete this folder.

 

[David H. Lipman]

If he has the Nachi/Welchia worm, that information you provided would be insufficient !

The PC has to be patched and the worm eliminated.

Dave



|
| >-----Original Message-----
| >I am seeing more than one srvchost.exe on the processes
| >tab when I open windows task manager. Could this be due
| to
| >virus?
| >.
| >Check to see if you have a folder called
| C:\WINNT\system32\wins on your computer, if you do and
| there is a copy of svchost in it, this is from the welchia
| virus. It creates this folder and makes a copy of the
| svchost file. Just go into your computer under safe mode
| and delete this folder.

 

[Tim]

-----Original Message-----
If he has the Nachi/Welchia worm, that information you

provided would be insufficient !

The PC has to be patched and the worm eliminated.

Dave



|
| >-----Original Message-----
| >I am seeing more than one srvchost.exe on the processes
| >tab when I open windows task manager. Could this be due
| to
| >virus?
| >.
| >Check to see if you have a folder called
| C:\WINNT\system32\wins on your computer, if you do and
| there is a copy of svchost in it, this is from the welchia
| virus. It creates this folder and makes a copy of the
| svchost file. Just go into your computer under safe mode
| and delete this folder.


.
Yes, you are right sorry, patch is KB823980, deleting

this folder will eliminate virus though, patch should
still be applied

 

[David H. Lipman]

Nope...

The following patch SUPERCEDES the patch you indicated. The following patch is for the
RPC/RPCSS Buffer Overflow Vulnerability that is addressed by Microsoft Security Bulletin
MS03-39 http://support.microsoft.com/?kbid=824146

They should also use McAfee's Internet worm removal tool, Stinger
http://vil.nai.com/vil/stinger/ to remove any infected files in Safe Mode.

It is also suggested that they read the following URL:
http://www.microsoft.com/security/incident/blast.asp

They should also use a FireWall. If they don't patch the PC and not use a FireWall then
they will just be re-infected.

Dave



| >Yes, you are right sorry, patch is KB823980, deleting
| this folder will eliminate virus though, patch should
| still be applied