Microsoft Generic host what is this?

[chp]

While surfing the internet, a warning appear in my Norton Personal
Firewall - " A remote system is attempting to access Microsoft Generic Host
Process for Win32 Service on your computer"
Program: C:\windows\system32\svchost.exe

Is this port scan or trojan horse , should I block it permanently or let it
proceed as recommended by my firewall.
Thanks in advance.

 

[CWatters]

Then back up important data (label the backups to indicate they might
contain viruses), then run an anti virus scan AND a scan for trojans and
spyware.

I recommend "Spybot Search and Destroy" which is free from here...

http://www.safer-networking.org/

If Spybot S&D cannot remove anything nasty that it finds then make a note of
the name that it reports and go looking for manual instructions at sites
like Symantec and Pest Patrol.

Note: When you follow manual instructions for deleting viruses and Trojans
be very careful what you delete. There are several files with similar names
(eg SCVHOST.exe Svch0st.exe Svchost32.exe) make sure you get the right one!
Delete the wrong one and you might have problems. The folk who write these
nasty programs give them these file names deliberately.

Colin

 

[CWatters]

This page has a list of nasties that mess with files of similar name...

http://www.sysinfo.org/startuplist.php?filter=svchost.exe

 

[CWatters]

I forgot.... NO you shouldn't allow it access
let

 

[chp]

Scan with norton and spybot with the latest update install, result of both
scan - did'nt find any virus, but the warning message keep appearing every 2
to 5 minutes,from my norton firewall when surfing the net. Should I delete
the 'svchost.exe' manually and where can I find info regarding how to
proceed. Thanks in advance. Using WinXp Professional

 

[CWatters]

It should be Ok to block it permanently.

See the reply "Message signals hack attempt " on this page...

http://www.sptimes.com/2003/09/08/Technology/Spyware_likely_suspec.shtml

Colin (not an MVP)