"svchost.exe" in Windows ME

Hi,

I just got rid of a Trojan horse, so every time I sit down
at my computer, I check the start up files in msconfig to
make sure the Trojan is gone for good.

During one of these checks, I found a brand new
file "svchost.exe" which according to the time stamp, was
installed while my wife was viewing pictures she had
received via email. She never installs anything
intentionally - she leaves that to me.

I began an info hunt and found that "svchost.exe" is a
common file on Windows XP and is also a file installed by
the "W32.Welchia.Worm."

Searched the Microsoft web site and could not find any
reference for "svchost.exe" on Windows ME - just on XP.

Downloaded Symantec fix for "W32.Welchia.Worm" and ran it.
However, it reported that the worm is not on my computer.

To be on the safe side, I renamed "svchost.exe" and moved
it. It is still on my msconfig start up list, but is
deselected. My computer seems to be running quite well.

So... I'd like to know how "svchost.exe" got on my system
in the first place, do I need it or should I get rid of it
completely? I'd appreciate any help.

Regards
Matthew

Alan
Thu Jul 15 05:41:08 CDT 2004

Svchost may be common in XP and Win2K but it should not be in Win 9x
or Win ME.
Welchia is not the only worm or trojan that uses a bogus svchost.exe .
I suggest you get rid of it.

...Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.windowsme.general, "Matthew"
<anonymous@discussions.microsoft.com> wrote:

>Hi,
>
>I just got rid of a Trojan horse, so every time I sit down
>at my computer, I check the start up files in msconfig to
>make sure the Trojan is gone for good.
>
>During one of these checks, I found a brand new
>file "svchost.exe" which according to the time stamp, was
>installed while my wife was viewing pictures she had
>received via email. She never installs anything
>intentionally - she leaves that to me.
>
>I began an info hunt and found that "svchost.exe" is a
>common file on Windows XP and is also a file installed by
>the "W32.Welchia.Worm."
>
>Searched the Microsoft web site and could not find any
>reference for "svchost.exe" on Windows ME - just on XP.
>
>Downloaded Symantec fix for "W32.Welchia.Worm" and ran it.
>However, it reported that the worm is not on my computer.
>
>To be on the safe side, I renamed "svchost.exe" and moved
>it. It is still on my msconfig start up list, but is
>deselected. My computer seems to be running quite well.
>
>So... I'd like to know how "svchost.exe" got on my system
>in the first place, do I need it or should I get rid of it
>completely? I'd appreciate any help.
>
>Regards
>Matthew

Matthew
Thu Jul 15 19:18:55 CDT 2004

Thanks Alan - I appreciate the advice - that svchost.exe
is GONE!!!

Matthew

>-----Original Message-----
>Svchost may be common in XP and Win2K but it should not
be in Win 9x
>or Win ME.
>Welchia is not the only worm or trojan that uses a bogus
svchost.exe .
>I suggest you get rid of it.
>
>....Alan
>
>--
>Alan Edwards, MS MVP W95/98 Systems
>http://dts-l.org/index.html
>
>In microsoft.public.windowsme.general, "Matthew"
><anonymous@discussions.microsoft.com> wrote:
>
>>Hi,
>>
>>I just got rid of a Trojan horse, so every time I sit
down
>>at my computer, I check the start up files in msconfig
to
>>make sure the Trojan is gone for good.
>>
>>During one of these checks, I found a brand new
>>file "svchost.exe" which according to the time stamp,
was
>>installed while my wife was viewing pictures she had
>>received via email. She never installs anything
>>intentionally - she leaves that to me.
>>
>>I began an info hunt and found that "svchost.exe" is a
>>common file on Windows XP and is also a file installed
by
>>the "W32.Welchia.Worm."
>>
>>Searched the Microsoft web site and could not find any
>>reference for "svchost.exe" on Windows ME - just on XP.
>>
>>Downloaded Symantec fix for "W32.Welchia.Worm" and ran
it.
>>However, it reported that the worm is not on my computer.
>>
>>To be on the safe side, I renamed "svchost.exe" and
moved
>>it. It is still on my msconfig start up list, but is
>>deselected. My computer seems to be running quite well.
>>
>>So... I'd like to know how "svchost.exe" got on my
system
>>in the first place, do I need it or should I get rid of
it
>>completely? I'd appreciate any help.
>>
>>Regards
>>Matthew
>
>.
>