Norton keeps detecting svhost.exe as a Worm

Van Damme · Jan 20, 2008

Hi,

Since yesterday Norton ('05) is giving me a weird message that keeps popping up every ten minutes or so. It says:

"Norton Internet Worm Protection has detected a remote system that is attempting to access your computer...
....
Path: C:\WINDOWS\System32\svchost.exe
..."

I thought svchost.exe was legit? When I open the Task Manager I can see that I have it running 6 times?

Does this mean this is some sort of worm? Any help would be greatly appreciated.

DavidGP · Jan 20, 2008

Hi

That location is generally the safe one for SVCHOST.EXE and anything from 4-6+ of these running is normal. So long as the spelling is SVCHOST.EXE as your title and it could be just a typo is SVHOST.EXE, as any mis-spellings of this service are normally malware related

Possible this is a false positive from the latest virus definitions from Norton, but if you need to be more sure its not malware related then please do run the below.

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

READ & RUN ME FIRST. Malware Removal Guide

Van Damme · Jan 22, 2008

Thank you for your help.

I ran the tutorial but the problem still persists. When i get the Norton warning I can either click 'permit' or 'block' but either way it pops up again after 10 minutes or so. Does anyone know what might cause this or should I move this thread to a different section of the forum since it turns out not to be a malware related problem?

chaslang · Jan 23, 2008

You need to follow the instructions that Halo gave to you. Those instructions are not completed until you have run ALL steps and that includes attach the logs that are requested. With doing this we cannot help you.

Log in or Sign up

Norton keeps detecting svhost.exe as a Worm

Van Damme Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

Van Damme Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member