svchost.exe phoning home a lot

[Robert M Jones]

I am seeing a lot of traffic in my Zone Alarm systray icon for this
program - the ZA entry is as given here
Product name Microsoft® Windows® Operating System
File name C:\WINDOWS\system32\svchost.exe
Last policy update Not applicable
Version 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Last modified date 04/08/2004 13:00:00
File size 14 KB

I know some viruses mimic this process but this entry seems to be in the
right place and my AV and antispyware scans are clear. Can I ignore
this? I'm a newbie to XP so not used to how it behaves.
ZA warns me not to tamper with the entry as it is a system component.
Many thanks

--
Rev Robert M Jones, Wimborne Baptist Church, UK
http://www.wimborne-baptist.org.uk
Free trial of Mailwasher Pro - effective email spam filter - (commission
goes to our partners in Bulgaria)
http://fta.firetrust.com/index.cgi?id=420

 

[JS]

There usually are a number of svchost running at the same time.
Try Process Explorer from SysInternals to help narrow it down:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

JS

 

[Guest]

I am seeing a lot of traffic in my Zone Alarm systray icon for this
program - the ZA entry is as given here
Product name Microsoft® Windows® Operating System
File name C:\WINDOWS\system32\svchost.exe
Last policy update Not applicable
Version 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Last modified date 04/08/2004 13:00:00
File size 14 KB

I know some viruses mimic this process but this entry seems to be in the
right place and my AV and antispyware scans are clear. Can I ignore
this? I'm a newbie to XP so not used to how it behaves.
ZA warns me not to tamper with the entry as it is a system component.
Many thanks

--
Rev Robert M Jones, Wimborne Baptist Church, UK
http://www.wimborne-baptist.org.uk
Free trial of Mailwasher Pro - effective email spam filter - (commission
goes to our partners in Bulgaria)
http://fta.firetrust.com/index.cgi?id=420

Rev Robert M Jones,
Pess ALT+CTRL+DEL on your Desktop and see what Processes is using the most
of the CPU.
If the usage Hiegher than 40% I will be waied, and do online Scan I'm not
sure about ZA.
To do scan onn line go here:
http://www.sophos.com/virusinfo/analyses/trojswizzoraw.html

http://www.spywareguide.com/product_show.php?id=2857
http://www.avast.com/eng/vps_history.html
http://www.nasstec.co.uk/tools.html
Hope this helps
Regards
nass

 

[Robert M Jones]

Rev Robert M Jones,
Pess ALT+CTRL+DEL on your Desktop and see what Processes is using the most
of the CPU.
If the usage Hiegher than 40% I will be waied, and do online Scan I'm not
sure about ZA.
To do scan onn line go here:
http://www.sophos.com/virusinfo/analyses/trojswizzoraw.html

http://www.spywareguide.com/product_show.php?id=2857
http://www.avast.com/eng/vps_history.html
http://www.nasstec.co.uk/tools.html
Hope this helps
Regards
nass

It seems to be mostly at logon - at the moment it is not listed and
virtually all the processes are running at 0% - the cpu graph is
virtually flat. (And that is with Norton AV and ZA running) plus
Thunderbird.
I've just popped across to my Admin account and done the same - and it
fluctuates between 0 and 2%. I think it is benign

--
Rev Robert M Jones, Wimborne Baptist Church, UK
http://www.wimborne-baptist.org.uk
Free trial of Mailwasher Pro - effective email spam filter - (commission
goes to our partners in Bulgaria)
http://fta.firetrust.com/index.cgi?id=420

 

[Guest]

It seems to be mostly at logon - at the moment it is not listed and
virtually all the processes are running at 0% - the cpu graph is
virtually flat. (And that is with Norton AV and ZA running) plus
Thunderbird.
I've just popped across to my Admin account and done the same - and it
fluctuates between 0 and 2%. I think it is benign

--
Rev Robert M Jones, Wimborne Baptist Church, UK
http://www.wimborne-baptist.org.uk
Free trial of Mailwasher Pro - effective email spam filter - (commission
goes to our partners in Bulgaria)
http://fta.firetrust.com/index.cgi?id=420

Rev Robert M Jones,
Thanks for posting back your feed, I think as you stated that this behavoir
start at the begining of log on, it is normal for the all MS drivers and
Applications to load.
My advice, is to keep one firewall on your system as more than one can cause
slow down and conflict in your system.
For now it is normal activties for svchost.exe and it is not a virus.
Regards
nass

 

[Plato]

I am seeing a lot of traffic in my Zone Alarm systray icon for this
program - the ZA entry is as given here

Dont allow anything that you dont want to call home. Then set your
warnings to "ingore".