What is going on???

Faye · Luna Sierra Age: 41 Gender: Joined: 28 Apr 2004

Alright, here is the low down on my situation here. Whenever I start my computer this program starts up with it called "scvhost.exe" and the little icon next to it looks like a winzip file. Now if I just leave it there all it appears to do is take up processing power but whenever I try to end program this little message pops up and says the NT/Authority has initiated shutdown and I have 60 seconds to save all my work and wait for impending doom.

I would just leave it alone if I knew what it was doing but it is just eating at me to get rid of the thing. I have tried remove programs and I get nothing and I have tried searching and I come up with zilch. No antivirus comes up with anything and the firewalls are useless. I need help.

What do I do????

GAAZ · MOD Black Sheep Commander Gender: Joined: 14 Oct 2002

I'd say go to Start..Run..And type MSConfig. then turn off EVERYTHING that is not an auto-windows start up..There's a button for it in XP.

After that I'd say run Spyware and got to www.hijackthis.com and DL CWShredder and Hijack then delete everything you see...And only use Mozilla from now on.

Minosheep · Posted: Mon Jul 05, 2004 10:54 pm Post subject:

I have that svchost.exe thing on my computer too... Any idea what it is, anyone?

EDIT: Seems it's a crucial system process. It's in Microsoft's library of Windows processes.

Faye · Luna Sierra Age: 41 Gender: Joined: 28 Apr 2004

Thanks Azv, but it didn't change anything. I couldn't get your link to work though, it kept taking me to the wrong site and Hijack or CWShredder were no where to be found.

Help?!?!

GAAZ · MOD Black Sheep Commander Gender: Joined: 14 Oct 2002

Sorry...They musta changed the domain...It can be found here
www.spywareinfo.com/~merijn/downloads.html
www.merijn.org

Those should work but my comp is acting wierd and won't let me check to be sure.

Just Google Hijack this or CW Shredder.

Or MSN me at Gaaz1981@hotmail.com

I can UL you the progs.

Senkir · inward singing since 1983 Gender: Joined: 21 Sep 2002

well windows has an actual and important system function running off scvhost.exe, but there are viruses out there that like to pass themselves off as that program, when they really aren't. Most of the time you can tell if it's real by checking it through one of those programs Az just mentioned

Musashi · Scrummy Translator Gender: Joined: 07 Nov 2002

Sounds like you have a virus man. Ok first off, background info...

The first link is for info on the svchost.exe that is part of windows.
http://support.microsoft.com/?kbid=314056

Now this link is for information on a virus that uses scvhost.exe (notice the letter swapping). This might be what you have, but you can't really be sure till you scan and find out. I'm not sure if there are other trojans that try to spoof that particular file. Most of this info you can find by searching google for scvhost.exe.

http://uk.trendmicro-europe.com/enterprise/security_info/ve_detail.php?Vname=WORM_AGOBOT.QE

Last but not least, you can do a free online virus scan via TrendMicro at the following link:

http://housecall.trendmicro.com/'

You also might want to try Ad-Aware or Spybot for searching and killing spyware.

Anyway, hope that helps. Good luck!

Shino · Posted: Tue Jul 06, 2004 7:35 am Post subject:

Most of the time I see this with spyware.

I would say you got some good info from everyone here.

I actually worked on 2 computer over the weekend and ran ad-aware and it killed some of the excess svchost.exe processes.

My laptop at work has 4 instances of svchost.exe running. Mainly b/c it uses a lot of stuff that needs to access dlls.

I did just happen to run ad-aware and there were 108 items targeted. Most of them called WildTangent. That and Gain (Gator) are the most common sneakies that get on your computers.

Most of the things that ad-aware catches get on there through IE.

Let us know how it goes.

Faye · Luna Sierra Age: 41 Gender: Joined: 28 Apr 2004

Apparently it is a Worm_Bagle and supposedly it is nondestructive. Although it managed to wipe out 2 hours worth of Summonings editting for the RPG when it decided to freeze everything on my computer, but the little coutdown clock to shutdown, not allowing me to save any of my work. Flaming Mad

However I seem to have ended its rain of terror thanks to all of your help. Now if I can just keep this from happenging again. Can any of you suggest a good antivirus to prevent this kinda crap again.

GAAZ · MOD Black Sheep Commander Gender: Joined: 14 Oct 2002

Problem is that worms and Trojans are normally never stopped by Anti-virus stuff..Your best thing to do is NEVER us Internet Explorer again..Get opera, Safari, or Mozilla and their built in blockers should stop all of them.