SCVHOST.EXE

[Ashley]

I have a worm which has infected my computer - (AGOBOT.SD
and the infected file is C:\Windows\System32\SCVHOST.EXE.)
My current virus scanner (Trend Micro PC Cillin)
identifies the worm but cant remove it. I have tried other
virus scanners (NOD32 and Norton) to no avail.
As a last resort, a friend has suggested that I delete the
file and he will copy the same file from his computer (like
me, he is using WIN XP Professional with Service Pack 1).
This could of course create a lot more problems than it
solves. Does anyone know what this particular file does
and whether I will cause trouble if I delete and recreate
it as suggested?
Any advice would be greatly appreciated.

Cheers
Ashley

 

[*Vanguard*]

Ashley said in news:[email protected]:

I have a worm which has infected my computer - (AGOBOT.SD
and the infected file is C:\Windows\System32\SCVHOST.EXE.)
My current virus scanner (Trend Micro PC Cillin)
identifies the worm but cant remove it. I have tried other
virus scanners (NOD32 and Norton) to no avail.
As a last resort, a friend has suggested that I delete the
file and he will copy the same file from his computer (like
me, he is using WIN XP Professional with Service Pack 1).
This could of course create a lot more problems than it
solves. Does anyone know what this particular file does
and whether I will cause trouble if I delete and recreate
it as suggested?
Any advice would be greatly appreciated.

Cheers
Ashley

For those type of questions, a search at Microsoft's support site will
often turn up useful articles:

http://support.microsoft.com/
Advanced Search
Windows XP
Search on "svchost description"

Voila, http://support.microsoft.com/?id=314056.

 

[nerd32768]

I have a worm which has infected my computer - (AGOBOT.SD
and the infected file is C:\Windows\System32\SCVHOST.EXE.)
My current virus scanner (Trend Micro PC Cillin)
identifies the worm but cant remove it. I have tried other
virus scanners (NOD32 and Norton) to no avail.
As a last resort, a friend has suggested that I delete the
file and he will copy the same file from his computer (like
me, he is using WIN XP Professional with Service Pack 1).
This could of course create a lot more problems than it
solves. Does anyone know what this particular file does
and whether I will cause trouble if I delete and recreate
it as suggested?
Any advice would be greatly appreciated.

Cheers
Ashley

No matter what, DO NOT DELETE THIS FILE
svchost.exe is a file containing your services. I think that most networking
services are covered by this file. if you delete it, and the version is off
by one digit, your computer will be worthless. if you check the file
versions(right click on the file, go to properties, go through the tabs, it
should be in there somewhere), and they are exactly the same, copy them.
If you are using XP, the file version should be 5.1.xxxx, but I am not sure.

quick note:
a 5.1.2154 file will not be compatible with a 5.1.5153 file.

If the file is exactly the same, you should be safe. If you wait for another
month, XP service pack 2 will be released. all of the service packs will
have an updated version of that file. just get the service pack when it
comes out, and you should be fine. Also, if you can do windows update, and
get service pack 1a, I think 1a comes with that file.

Hope this helps,
Nerd32768, A+, Network+ certified

 

[S.Sengupta]

Hi,
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.bluecode.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
A Description of Svchost.exe in Windows XP:
http://support.microsoft.com/?kbid=314056

regards,
ssg MS-MVP
pronetworks.org

 

[*Vanguard*]

*Vanguard* said in news:%[email protected]:

Ashley said in news:[email protected]:

For those type of questions, a search at Microsoft's support site will
often turn up useful articles:

http://support.microsoft.com/
Advanced Search
Windows XP
Search on "svchost description"

Voila, http://support.microsoft.com/?id=314056.

Note, since this file may be inuse, you won't be able to copy over it.
Don't know if it is still inuse when you use the Recovery Console bootup
mode. If so, use Microsoft's 'inuse' utility to do the file replace on
a reboot (http://support.microsoft.com/?id=228930).