Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple Svchost.exe?


  • This topic is locked This topic is locked
4 replies to this topic

#1 liquidmonkey

liquidmonkey

  • Members
  • 86 posts
  • OFFLINE
  •  
  • Local time:09:45 AM

Posted 20 May 2007 - 04:43 AM

hello,
have recently noticed that i have 8 'svchost.exe' (4 are SYSTEM, 2 are NETWORK SERVICE and 2 are LOCAL SERVICE) running when i start up my PC, also have 3 'rundll32.exe' running too.
a few weeks ago i did have an issue with the 'vundo' pain in the butt vrus/malware and am concerned if it is still on the system. at least the pop ups stopped but things do slow down every now and then.
i run adaware, spybot, norton2007, registry-booster and spywareblaster about once a week to keep things clean and it generally stays that way. this is actually the first time ever i've had any problems.
i don't have any weirdo firewalls or crazy anti-virus stuff, only what i mentioned above.

any ideas??
do u need a hijack-this log?
win7 Ultimate 64bit
2 x 24" LG Monitors
Intel Core i7 920 with Xigmatek HDT-S1283
ASUS P6T WS PRO
12gigs of OCZ Gold XTC Triple Channel 6x2gig DDR3 1333MHz PC10600
XFX Nvidia GTX 260 core 216
Corsair TX750W
Cooler Master 690
HDD Total = F I V E TB!!

BC AdBot (Login to Remove)

 


m

#2 buddy215

buddy215

  • BC Advisor
  • 12,619 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:08:45 AM

Posted 20 May 2007 - 06:08 AM

How did you remove Vundo?


http://www.atribune.org/content/view/24/2/
Please download VundoFix.exe
to your desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when
VundoFix appears at reboot.
--------------------------------------------------------------------------------

Install Super Antispyware. Run it in safe mode. Allow it to quarantine whatever it finds.
http://www.superantispyware.com/
--------------------------------------------------------------------------------

Post a Hijack This log in the Hijack This Forum by following the directions in the link below if the programs above have not removed ALL malware. DO NOT post the log in this forum.
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
--------------------------------------------------------------------------------

How To start Windows in Safe Mode
http://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/
--------------------------------------------------------------------------------

Discussion concerning registry cleaners.
http://www.windowsbbs.com/showthread.php?t...egistry+cleaner

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#3 jgweed

jgweed

  • Staff Emeritus
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:09:45 AM

Posted 20 May 2007 - 09:40 AM

Multiple instances of "svchost.exe " running on your computer are common and do not indicate, by themselves, any malware problem. I have 7 instances currently running myself.
The "rundll32.exe" instances, though, could indicate a potential problem, depending on where the .exe is located: "The rundll32.exe file is located in the folder C:\Windows\System32. In other cases, rundll32.exe is a virus, spyware, trojan or worm!"

http://www.neuber.com/taskmanager/process/rundll32.exe.html

Regards,
John
Whereof one cannot speak, thereof one should be silent.

#4 liquidmonkey

liquidmonkey
  • Topic Starter

  • Members
  • 86 posts
  • OFFLINE
  •  
  • Local time:09:45 AM

Posted 29 May 2007 - 02:34 PM

thanks for the tips!
i've followed the steps above and am now on the other forum for hijackthis logs and so forth.
thanks!
win7 Ultimate 64bit
2 x 24" LG Monitors
Intel Core i7 920 with Xigmatek HDT-S1283
ASUS P6T WS PRO
12gigs of OCZ Gold XTC Triple Channel 6x2gig DDR3 1333MHz PC10600
XFX Nvidia GTX 260 core 216
Corsair TX750W
Cooler Master 690
HDD Total = F I V E TB!!

#5 rigel

rigel

    FD-BC


  • BC Advisor
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:10:45 AM

Posted 29 May 2007 - 03:54 PM

Hi liquidmonkey,

Since you now have an active HJT log, I am closing this post. Please follow only the team members advice who is handling your issue. Doing otherwise will slow your fix.

Good luck,
rigel

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users