Svchost.exe possibly a virus?

Question

I was downloading some... sketchy... software and when I started up Windows again, it said it was "Configuring" an executable file called "Svchost.exe." Upon looking it up, I've realized that this was a vital system file, but many viruses use its name to trick people into thinking it is a system file. I loaded my Ubuntu partition and I searched my file system for "Svchost.exe" and I found these as results:
SVCHOST.EXE-03BA2AA1.pf in C:\WINDOWS\Prefetch
SVCHOST.EXE-3530F672.pf in C:\WINDOWS\Prefetch
svchost.exe in C:\WINDOWS\system32
Svchost.exe in C:\directory\CyberGate\WinDir
SMSvcHost.exe in C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319
SMSvcHost.exe.config in C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319
SMSvcHost.exe in C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation
SMSvcHost.exe.config C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation

If it helps at all I run Windows XP

Answer 1

Its not a virus. Probably.



Try doing this. (If is is a virus the system will not want that to run the system.)



Press (Alt + Ctrl + Del) and get the task manager.



Try to find the particular name that is Svchost.exe in process tab. After finding the running process select it and right click and select "End process" if your system reboots or stop running or if some dialog box appear as shutting down in some seconds don't worry its not a virus.



If the system has no respond yeah it is a virus.



Try using Nod32 5 as your virus guard. Its the best and what is recommend.

Answer 2

2

Answer 3

The svchost.exe (usually) isn't malware (a virus) in itself. If one of the instances of svchost.exe is acting really strange or out of the ordinary then this could be due to malware/virus which is leveraging it. Trace the instance of svchost which is acting up back to the corresponding services/registry keys/(DLL). It's also possible that the malware (virus) is just using the process name svchost.exe to fool you since multiple instances of the real svchost.exe are always running anyway.



Scan your registry for errors with at least two good tools in safe mode.



Additional Info:

svchost.exe is the service host in the NT based Windows operating systems. That's literally all it is and all it does, it the application which hosts Windows services. The services it runs are DLL's or dynamically linked libraries in the registry. Also, be advised that Windows XP is one of the weakest operating systems in terms of security, even service pack 3 is pretty darn pathetic in terms of security. Use your Ubuntu for all Internet stuff is what I would suggest if you can. Also, take some time to educate yourself and change your habits as to be more conducive to avoiding these types of issues in the future. Always scan any executable for malware before running it! Every time I tell the truth (my feelings) about Windows on here I get slammed with tons of thumbs down, so bring it on Winblowz fans. No seriously, I love Windows, without it 99% of the computer security industry would go up in smoke. ;)



Hope this helps, and yes I do believe you have been infected. Post here if you need more help. Good luck.







EDIT:

Also, you can bring up "run" and type "msconfig" go under the "services" tab and disable everything that isn't Microsoft/Windows services. There is a little box you can click at the bottom which will hide all the Windows services, then whatever is left you can disable all... for one, if the system doesn't let you do this or reverts your changes then you KNOW you have a problem(malware)!

Answer 4

No, it is not a virus. It stands for service host.

It hosts windows services that runs multiple programs or windows at the same time. The best thing to do is run an updated virus scan. Sometimes you can have 5 plus svchost.exe and they are all properly running.

Answer 5

Original location where C:\WINDOWS\system32 should be is in C:\WINDOWS\system32.

some viruses can patch that file to make it a virus. originally, that file is used to run windows services.



If you Use Windows 7, No Virus Can Infect C:\WINDOWS\system32 because Windows 7 Has A self Defense Protection.

Answer 6

K7 AntiVirus is home-user friendly virus removal software, which protects your computer from viruses, Trojans, malware and spyware. K7 Anti Virus Software features include automatic updates - Ensures very latest virus database. Real time scanning - Scans your computer all time for any potential virus theats. Email Scanning - Automatically scans all incoming and outgoing emails and attachments for email borne virus and malware attacks. Spyware Protection - protects your computer from unwanted programs such as trojans, worms, rootkits, adware, keyloggers from installing themselves. Enhanced and fastest scan engine to protect you PC from virus threats and mailicious software.



Read more: K7 Antivirus - CNET Download.com http://download.cnet.com/K7-Antivirus/3000-2239_4-10909401.html#ixzz24pApq08P

Answer 7

no its not a virus