UPHCLEAN

[Casey]

I have the following problem; I installed the User
Profile Cleanup Service and it detected the following
which I can't find any information on.

event id 1201
scvhost.exe (1240)
HKCU\Software\Classes (0x204)

event id 1201
scvhost.exe (1312)
HKCU\Software\Classes (0x20c)

Does anyone know what this is? Why it might not be
closing. Thanks

 

[Rock]

I have the following problem; I installed the User
Profile Cleanup Service and it detected the following
which I can't find any information on.

event id 1201
scvhost.exe (1240)
HKCU\Software\Classes (0x204)

event id 1201
scvhost.exe (1312)
HKCU\Software\Classes (0x20c)

Does anyone know what this is? Why it might not be
closing. Thanks

Are you sure on the spelling? Svchost.exe is a valid windows file. It
is a "container" service that launches a variety of other processes.
But _Scvhost.exe_ is part of a backdoor Trojan virus, W32/Agobot-S:

http://www.liutilities.com/products/wintaskspro/processlibrary/scvhost/

To see the actual components running inside an instance of Svchost, Open
a command prompt & type:

Tasklist /SVC

For a description of it see:
http://support.microsoft.com/default.aspx?scid=kb;[LN];314056

Another option is to run process explorer from sysinternals.com. That
gives a listing of all running processes and shows what is running under
each instance of svchost.exe.

http://www.sysinternals.com/ntw2k/utilities.shtml

If it is scvhost.exe, then scan the system for malware.