Svchost

[carnau]

Ok i did a system scan and svchost.exe came back as a virus.

it is in my c:\winnt\system32 folder so i don't know if I should delete it or not.

Can somone look in there folder and tell me if they have that file in there.

Please before you check and let me know anything let me know you are useing windows 2000 first.

Thanks

[Chris]

svchost.exe is a valid windows file!

If the file has an infection than try and rapair it with your Virus scanner.

[Redhat]

http://securityresponse.symantec.com/avcen...lchia.worm.html

[Redhat]

svchost.exe is a valid windows file!

This one aint valid :P

[Chris]

Oh and i know can EDIT the XF86 config file redHat thanks for ya "help" :P

[carnau]

Redhat

so what do i do... delete it... i can't fix it with my virus scan...

also if you can take a look at my other problem on this board.

[Redhat]

Which Anti-Virus are you using?

For now, go to http://housecall.trendmicro.com run that and let it scan/clean.

[mark2]

A removal tool is available here at the bottom of the page

[Agent Smith]

carnau, just for everybody's reference, what did you use to scan your files? And what virus was the infected file actually reported as having?

As has already been pointed out, the mentioned file can be a valid windows file M$ KB description of svchost, but it can be infected, like most files!

There is also a worm removal tool available from the previously posted symatec link.

And finally, I am running 2kpro, and I have the file in that location. (Mine is not infected though!!! :D )

Regards. Mr. Mouse.

[carnau]

Which Anti-Virus are you using?

For now, go to http://housecall.trendmicro.com run that and let it scan/clean.

I did that... also

i am doing this as we speak.

A removal tool is available here at the bottom of the page .

from marks post.

I just want to say thanks. even if this dosn't get fixed and i end up formatting my hard drive, Thanks anyways. You guys have been extremly helpful. I don't know to many other forums that would have been as helpfull as you guys are..

Thanks again

Housecall found a few bugs but all of them were repaird and the ones it did not repaired got deleted.

So far bitdefender has not found anything, not saying it won't but it hasn't this is my second scan.

[Guest LB]

I just want to say thanks. even if this dosn't get fixed and i end up formatting my hard drive, Thanks anyways. You guys have been extremly helpful. I don't know to many other forums that would have been as helpfull as you guys are..

welcome to the forum carnau. i have been here since january but didn't really start posting till some months after that. The people here are the most wonderful bunch anywhere and i couldn't agree more about how helpful they are.....

so heres hoping you stick around and join the fun!!

[mark2]

Carnau, as i said in your other post, a start up list would still be helpful just in case, it would show up spyware or other problems, could even help us to speed up your system. ;)

[carnau]

Start up list like you asked for.

And i will most definetly stick around..

I have learned so much being here.

Thanks again.

if you want i have added it so you can DL it.

startuplist

But i will paste it here as well.

StartupList report, 9/7/2003, 2:32:08 PM

StartupList version: 1.52

Started from : C:\Documents and Settings\Administrator\My Documents\StartupList.EXE

Detected: Windows 2000 SP3 (WinNT 5.00.2195)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

==================================================

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\dllcache\drivers\MicroSofts.EXE

C:\WINNT\system32\dllcache\drivers\MicroSofts.EXE

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\dllcache\drivers\bot\sysinfo.exe

C:\WINNT\system32\dllcache\drivers\raiden\raidenftpd.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINNT\System32\nvsvc32.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\SYSTEM32\ServUDaemon.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE

C:\Program Files\Motherboard Monitor 5\MBM5.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE

C:\WINNT\System32\ctfmon.exe

C:\WINNT\System32\taskmgr.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B7X7JP0K\Antiwelchia-en[1].exe

C:\Documents and Settings\Administrator\My Documents\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:

[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]

Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe

Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon

NvCplDaemon = RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup

nwiz = nwiz.exe /install

AdaptecDirectCD = "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"

CreateCD50 = C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r

MBM 5 = "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"

zBrowser Launcher = C:\Program Files\Logitech\iTouch\iTouch.exe

LDM = C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe

Run32dll = c:\winnt\system32\WINClock.exe

Windows Explorer = C:\WINNT\ServicePackFiles\i386\explorer.exe

TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

SystemUpdate = C:\WINNT\ServicePackFiles\i386\explorer.exe

QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime

EPSON Stylus C62 Series = C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"

SearchEnhancement = "C:\Program Files\scbar\v1\scbar.exe" /U

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = ctfmon.exe

LDM = C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\scbar\v1\scbar.dll - {00041A26-7033-432C-94C7-6371DE343822}

CCHelper - C:\Program Files\Panicware\Pop-Up Stopper Pro\CCHelper.dll - {0CF0B8EE-6596-11D5-A98E-0003470BB48E}

(no name) - (no file) - {146f854c-f46c-4d9e-b5fc-c1a76f76c2f2}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[{11111111-1111-1111-1111-111111111111}]

CODEBASE = http://207.246.124.105/cabs/ROOSTRS3002/TPS108.cab

[Musicnotes Viewer]

InProcServer32 = C:\WINNT\Downloaded Program Files\mnviewer.dll

CODEBASE = http://www.musicnotes.com/download/mnviewer.cab

[shockwave ActiveX Control]

InProcServer32 = C:\WINNT\system32\Macromed\Director\SwDir.dll

CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab

[{26E8361F-BCE7-4F75-A347-98C88B418322}]

CODEBASE = http://dst.trafficsyndicate.com/Dnl/T_50006/btiein.cab

[RdxIE Class]

InProcServer32 = C:\WINNT\Downloaded Program Files\RdxIE.dll

CODEBASE = http://207.188.7.150/09169704652047f51d03/...ip/RdxIE601.cab

[ExentInf Class]

InProcServer32 = C:\WINNT\Downloaded Program Files\exentctl_0_0_0_1.ocx

CODEBASE = http://us.games2.yimg.com/download.games.y...ctl_0_0_0_1.ocx

[HouseCall Control]

InProcServer32 = C:\WINNT\DOWNLO~1\xscan53.ocx

CODEBASE = http://housecall.trendmicro-europe.com/hou...all/Xscan53.cab

[Yahoo! Audio UI1]

InProcServer32 = C:\WINNT\Downloaded Program Files\yacsui.dll

CODEBASE = http://chat.yahoo.com/cab/yacsui.cab

[HouseCallButton.setup]

InProcServer32 = C:\WINNT\Downloaded Program Files\HouseCallButton.dll

CODEBASE = http://de.trendmicro-europe.com/file_downl...eCallButton.CAB

[installShield International Setup Player]

InProcServer32 = c:\winnt\downlo~1\isetup.dll

CODEBASE = http://www.installengine.com/engine/isetup.cab

[WebCam Control]

InProcServer32 = C:\WINNT\DOWNLO~1\ACTIVE~1.OCX

CODEBASE = http://webcamnow.com/broadcast/ActiveXWebCam.cab

[update Class]

InProcServer32 = C:\WINNT\System32\iuctl.dll

CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/...7604.4510069444

[shockwave Flash Object]

InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx

CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab

[Yahoo! Webcam Viewer Wrapper]

InProcServer32 = C:\WINNT\Downloaded Program Files\yvwrctl.dll

CODEBASE = http://chat.yahoo.com/cab/yvwrctl.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll

WebCheck: C:\WINNT\System32\webcheck.dll

SysTray: stobject.dll

--------------------------------------------------

End of report, 7,763 bytes

Report generated in 0.330 seconds

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

[carnau]

Here is my scan report.

for BitDefender

Scan Report

Folders:2880

Files:61652

Infected:0

Warning:0

Suspicious:0

Cleadned:0

Deleted:0

Cleaned at restart:0

Deleted at restart:0

Unable to be Cleaned:0

[mark2]

"scbar.exe" is spyware

instructions for removal here http://www.doxdesk.com/parasite/SCBar.html

backWeb-8876480.exe also spyware "Unless you are using BackWeb for news content, we strongly recommend de-installing

it. It is often a serious resource hog, in most cases it is also advertising adware,

it slows down your Internet connection, unacceptably if you connect by modem, and

it has the potential for sending out information from your PC. De-install via the

"Add/Remove Program" icon in the Control Panel, or disable with Startup Manager."

Spybot S & D targets this as does Adaware

Still working thru the list but they jumped out at me

[carnau]

i have ad-aware 6.0 should i just run it?

[mark2]

Make sure you have updated it 1st

You could also speed up your boot time by disabling

C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

and

C:\Program Files\QuickTime\qttask.exe" -atboottime

currently looking for a version of Msconfig for Win 2000 which will make it easier to stop these autostarting

[mark2]

Msconfig for win 2000 is available http://www2.whidbey.net/djdenham/Msconfig.htm

[carnau]

ok ad aware found 34 files. i deleted them all.

I did the removal for the scbar.dll and it says

DllUnregisterServer in \Program Files\scbar\v1\scbar.dll succeeded

so i guess that means it got deleted.

i also deleted the 'SearchEnhancement' entry on the right pointing to scbar.exe

[carnau]

Make sure you have updated it 1st

You could also speed up your boot time by disabling

C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

and

C:\Program Files\QuickTime\qttask.exe" -atboottime

currently looking for a version of Msconfig for Win 2000 which will make it easier to stop these autostarting

How do i go about disableing those?

also i DL'ed the Msconfig for win 2000 is available http://www2.whidbey.net/djdenham/Msconfig.htm

in the files it said to.. after i get done dl'ing them it dosn't say what to do from there?

[mark2]

Msconfig should be copied to C:\WINNT\system32

if you downloaded the msconfig helpfile it should go to C:\WINNT\Help folder

Go to Start >run > and type Msconfig in the box

[mark2]

Here for some screenshots of what you will see and further instructions

[carnau]

ok here is my 2 screen shots.

What should i uncheck??

[Guest LB]

here is a program that will put an applet into your control panel that makes it easier to control which programs startup. Just install it and goto CONTROL PANEL>STARTUP and deselect until your hearts content.....

StartupCPL.zip

[Guest ellas]

this is a useful site to tell you what to disable at startup http://www.pacs-portal.co.uk/startup_content.htm