benjamin.durham Posted February 27, 2005 Report Share Posted February 27, 2005 I recently recieved a window popup by my norton firewall saying, 'would you allow svchost.exe to accsess the internet', I bocked it after knowing it can be related to the W32.Welchia worm. I looked at my Task manager and noticed there were several 'svchost.exe' processes, using large memory usage and some on 'Network Service' (See Attachment) In fear I have run countless virus scans with norton and run W32.Welchia removal tools in hope if I have a worm it will remove it, It said my computer wasn't infected. I have looked at the registry through regedit and avn't found anything what symantec told me the worm created. But i'm worried do I have the worm or is it just windows working normally? Please HelpBen Quote Link to comment Share on other sites More sharing options...
mark2 Posted February 27, 2005 Report Share Posted February 27, 2005 Hi benjamin, 5 'svchost.exe' is probably about right for XP, I've just checked in my taskmanager, i currently have 6 running :blink: , however as it can be implicated in virus attacks it may be worthwhile posting a hijackthis log in the hijackthis board for a checkup. Quote Link to comment Share on other sites More sharing options...
Cpt James T. Kirk Posted February 27, 2005 Report Share Posted February 27, 2005 mine ususally only shows 2 maybe 3 at the most. i beleive thats the norm for xp Quote Link to comment Share on other sites More sharing options...
Boris Posted February 27, 2005 Report Share Posted February 27, 2005 5 in mine !"Normal" XP ? - depends what you've got running ! Quote Link to comment Share on other sites More sharing options...
benjamin.durham Posted February 28, 2005 Author Report Share Posted February 28, 2005 Thanx for all your replies, I much appreciate it,Ben Quote Link to comment Share on other sites More sharing options...
xakep Posted February 28, 2005 Report Share Posted February 28, 2005 I think this svchost is a mistery - the Microsoft Knowledge Base is notably vague about it,; I know 3 networking gurus and 2 security analysts, and they all no very little about this host. Quote Link to comment Share on other sites More sharing options...
-pops- Posted February 28, 2005 Report Share Posted February 28, 2005 I recall that the rogue version of this was of a slightly different spelling or case (such as SVChost.exe or svc.host.exe and similar). I am now unable to locate where I saw this. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.