Ah.. svhost.exe as Welchia Worm??

Hey again.

I come with yet another question..

Lately Zone Alarm Pro keeps telling me that svchost.exe is trying to access the internet or act as a server or something in some new port. I denied it because it looked weird to me and I wasn't sure if I could trust it so I looked it up.

On some page it said svchost.exe is part of Win32 and is important to run or something, and on another it said it works as a Welchia Worm. Or something like that, a worm with the letter W in the beginning of it's name.

What should I do?

 

If you look in the Process tab of Task Manager you will see several instances of svchost.exe running. It is a platform for the running of .dll based services and is hosted by the Generic Host Process for Win32. The important thing to note is the file path, which should be C:\Windows\system32\svchost.exe.

Malware often uses the name, or variants of it, so you should check both the filepath and the exact spelling of the name. The genuine svchost.exe never appears as an auto-start in msconfig, so that is another place to look.

Edit - Ron beat me to the post; Process Explorer is similar to TM but with more detailed information.

 

Hmm.. Maybe I'm just half asleep or retarded or something. What am I looking for?

 

Yea, I just figured that out.. but it says for the Welchia worm, it tries to run on a Port 135 or something. My memory is lacking intelligence right now.

But totally aside from all of this, I'm running a virus scan for the hell of it, and it told me 3 things have changed: user32.dll, shell32.dll, and ntoskrnl.exe

I'm annoyed and am positive I caught something here. Too tired to throw a tantrum though.. should I just get the worm remover thing?

 

What scan have you just run? What malware did it say you had (I mean the name not the file)?

PS - svchost will usually be trying to get through port 135 because of epmap (run by the Remote Procedure Call - RPC).

 

Ah. I have 2 Anti Viruses. I just ran AVG Free Edition. I'm sure I have the Welchia Worm.

Any way to remove it without any big fusses?

 

Well if it says you've got it. Go here and D/L Stinger:- http://vil.nai.com/vil/stinger/

Boot into safe and run Stinger, then do a full system scan with your AV. (Best to clear out your temp files and disable System Restore as well).

 

The fact that I had a sleepless night because of too much caffeine.

 

Will I need any fancy things like the Windows XP CD to restore key registries or something?

I also use Symantec Antivirus Corporate Edition.

 

Don't know if this helps. Welchia worm removal tool here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

 

No, just run it (and the above tool as well if you like!).

 

I have a fancy Idea. What if I just all together do the General Cleaning AND the Welchia Worm removal tool.

Is there any chance the general cleaning will further mess up my computer beyond function?

(I'm talking about his general cleaning: https://www.wilderssecurity.com/showthread.php?t=50662 )

 

It shouldn't as all tools are designed to run while on a infected machine.

Hope this helps...

Let us know how you go.

Cheers

 

Hi,

I wouldn't use a program like process Explorer ads unless your a very experienced user it can be hard to use. Try a programm like What process, that is easier to use and has online support.

www.what-process.com

 

Great, So I did it all, and it managed to find 3 trojans, but kept insisting I had no worm.

So I moved on.

Then, I had a setup for a game that I had installed some time ago, and when I went to install the game again, Ewido Security Suite freaks out and keeps insisting it's a TrojanDropper.small.mt ... Err? Its a damn game's setup that I've installed before and was a game... Could Ewido just be crazy or can Trojans be shoved in game setups too?

 

That sounds like a false positive but to be sure, scan the file flagged by Ewido with the Kaspersky Online Virus Checker and let us know what if anything it says. If KAV is not detecting anything in that file flagged by Ewido, most likely a f.p. You can submit the file to, I think, submit@ewido.net and mention you think it is a f.p.

 

That's what I was thinking, because I've installed the game before.

Thanks for the website, but it says the file can't be more than 1mb, and the setup is a good 240mb.

I'm so fed up with viruses and worms I'm at the point where I'd just install the damn game anyway, lol.

 

Well then that has to be f.p. because no malware would ever come packaged as such a large file -- nobody would ever download it onto their system! I guess that rules out sending the file to ewido, hehe .. I believe Kaspersky also has an online system scan if you want to try that, just to make sure you are clean. There is also the Microworld Free AntiVirus Scanner, a free KAV-based scanner. Good Luck ..

 

Oh I know I'm not quite clean yet. But I'm just so fed up with computers, they tick me off and drive me up the wall. Blame it on Microsoft if I end up in a psichiatric unit by the time I'm 25.

Also, for some reason, since I did the general cleaning, my computer's been having these weird slooooooowwwwwwwwww moments where I could swear it was as if it was upping itself with a carrot in the brain. Man, I wish these things could hear us and understand us, then I wouldn't be wasting my cussing.

However I remembered reading somewhere that Ewido Guard likes to do random guard scans or something, could that be the responsible little bunny?