4 svchost.exe's Running, Wierd?

I just got this Keylogger trojan virus and I'm tryin to clean it out but its dug in really deep. When I look in my task manager in Win Xp I see 4 svchost.exe processes running. I didnt think there was supposed to be this many, maybe 2 max. How do I know if one of them is a virus?

I've ran Norton 2002, The Cleaner 4, and Panda with no luck.

 

nah that's not weird.. i've got about 5 running at the moment. (and pc is virus-free )

but how to tell when a virus is running a svchost.. dunno have to check thatone

 

Mistic,
I would run a good anti-trojan program before doing anything else. Trojans and viruses are different breeds which sometimes require different software. Choose one here: http://www.majorgeeks.com/downloads29.html

My favorite is PC DoorGuard, and you can download a trial here: http://www.majorgeeks.com/download968.html or if you don't want to install anything, try Bitdefender's free online scan at: http://www.trojanscan.com/ . (I do both.)

Have you installed Service pack 2 for XP? I have and 5 svchost.exe processes are running! Also, Black Viper's configuration for "SAFE" here: http://www.blackviper.com/WinXP/servicecfg.htm is a good one to follow, but make sure you get rid of all trojans and viruses before doing anything else!

Take Care,
Gina

 

Multiple instances are normal

Search your C: drive for svchost.exe, the genuine Windows file lives in C:\Windows\System32, and there might be a copy in the dllcache folder, if you find one anywhere else, e.g. C:\Windows, it's probably a nasty.

 

If in XP Pro:

At a command prompt type tasklist /svc

It will break down services running svchost.exe.

 

Oops!

In my earlier post it sounds as though I advised to install sp2, and I do not recommend it for troubleshooting. It is beta software. I was asking if Mistic had installed it because I did and it ran 2 extra svchost.exe processes on my computer. I'm just tired & groggy tonight, sorry for the confusion, if any.

Peace & take care,

Gina

 

Cool, thanks guys. I will try the other programs tonight and see if I can't track down those scv's and see where they live.

Gina, Im still on SP1 and it's a pretty fresh install so I havent got the critical updates yet.

 

Ok, but PLEASE don't think of SP2 as a "critical update." (It's only beta right now, for testers only.) That was my faux pas and I was only wondering if that could be why you had so many svchost.exe's running!

Take care,
Gina