Svchost.exe

General Topics
1

Hello everyone. I’ve got a little problem in here, all the time when I’m doing scan on my computer I’ve received that warning. Could somebody explain me what is it ( have a look on picture on the bottom )?
Sorry for my English. Thanks a lot.

Here is a new link
http://imageshack.us/f/40/52359035.jpg/

and there written on russian ( Memmory block )

Log

[2012/03/19 18:55:45 | 002,434,856 | ---- | C] () – C:\Windows\SysWow64\pbsvc_bc2.exe
[2012/03/19 15:35:23 | 000,283,304 | ---- | C] () – C:\Windows\SysWow64\PnkBstrB.exe
[2012/03/19 15:35:21 | 000,076,888 | ---- | C] () – C:\Windows\SysWow64\PnkBstrA.exe
[2012/03/19 12:13:40 | 000,000,376 | ---- | C] () – C:\Windows\ODBC.INI
[2012/03/19 11:50:21 | 000,000,761 | ---- | C] () – C:\Windows\m3jp2k.ini
[2012/03/19 11:50:21 | 000,000,702 | ---- | C] () – C:\Windows\mmtvmj.ini
[2012/03/19 11:50:20 | 000,000,714 | ---- | C] () – C:\Windows\m3jpeg.ini
[2012/03/19 11:50:19 | 000,152,064 | ---- | C] () – C:\Windows\SysWow64\unrar.dll
[2012/03/19 11:50:19 | 000,019,968 | ---- | C] () – C:\Windows\SysWow64\cpuinf32.dll
[2012/03/19 11:50:18 | 000,761,856 | ---- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2012/03/18 23:06:57 | 000,007,667 | ---- | C] () – C:\Users\7Ja\AppData\Local\resmon.resmoncfg
[2012/02/29 13:26:56 | 000,416,064 | ---- | C] () – C:\Windows\SysWow64\nvStreaming.exe
[2011/09/28 17:44:14 | 000,179,271 | ---- | C] () – C:\Windows\SysWow64\xlive.dll.cat

========== LOP Check ==========

[2012/03/19 11:59:38 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\AIMP
[2012/06/24 10:05:45 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\AIMP3
[2012/04/08 15:30:26 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/03/19 12:12:12 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\DAEMON Tools Lite
[2012/03/22 20:48:21 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\Imagenomic
[2012/03/18 22:56:14 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\Leadertech
[2012/05/22 18:22:40 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\MAGIX
[2012/06/10 10:26:47 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\MAXON
[2012/03/19 11:57:13 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\Opera
[2012/03/19 15:10:19 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\Origin
[2012/03/24 07:22:43 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/05/30 19:23:49 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\Stardock
[2012/06/24 09:56:41 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\uTorrent
[2012/03/19 19:48:22 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\wargaming.net
[2012/03/19 14:23:26 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\WTouch
[2012/04/08 21:05:06 | 000,000,000 | —D | M] – C:\Users\7Ja\AppData\Roaming\Yandex
[2012/05/20 18:51:56 | 000,032,650 | ---- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/14 02:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/14 02:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s…s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< MD5 for: WSHELPER.DLL >
[2009/07/14 02:16:20 | 000,015,360 | ---- | M] (Microsoft Corporation) MD5=5B90BB3171504C9DAF3C5CB44B203CA7 – C:\Windows\SysWOW64\wshelper.dll
[2009/07/14 02:16:20 | 000,015,360 | ---- | M] (Microsoft Corporation) MD5=5B90BB3171504C9DAF3C5CB44B203CA7 – C:\Windows\winsxs\wow64_microsoft-windows-w…nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6ace9e67456cc40b\wshelper.dll
[2009/07/14 02:41:58 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=D314DA4B0B8DCD023D547FC568E34FB6 – C:\Windows\SysNative\wshelper.dll
[2009/07/14 02:41:58 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=D314DA4B0B8DCD023D547FC568E34FB6 – C:\Windows\winsxs\amd64_microsoft-windows-w…nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\wshelper.dll

< MD5 for: WSHELPER.DLL.MUI >
[2011/04/12 09:17:22 | 000,008,704 | ---- | M] (Microsoft Corporation) MD5=CD53AEA05D09943FDAA9E6E779D28A26 – C:\Windows\SysWOW64\en-US\wshelper.dll.mui
[2011/04/12 09:17:22 | 000,008,704 | ---- | M] (Microsoft Corporation) MD5=CD53AEA05D09943FDAA9E6E779D28A26 – C:\Windows\winsxs\x86_microsoft-windows-w…ure-other.resources_31bf3856ad364e35_6.1.7600.16385_en-us_adb3c1d9fa188607\wshelper.dll.mui
[2011/04/12 09:17:20 | 000,008,704 | ---- | M] (Microsoft Corporation) MD5=D3C8A35BD4D7F008A7D37AA6F235C8FD – C:\Windows\SysNative\en-US\wshelper.dll.mui
[2011/04/12 09:17:20 | 000,008,704 | ---- | M] (Microsoft Corporation) MD5=D3C8A35BD4D7F008A7D37AA6F235C8FD – C:\Windows\winsxs\amd64_microsoft-windows-w…ure-other.resources_31bf3856ad364e35_6.1.7600.16385_en-us_09d25d5db275f73d\wshelper.dll.mui

< HKCR\CLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /rs >

< End of report >

2

When i click on your image to enlarge it i get a warning from avast! for JS:Redirector-WO[Trj] :o…see screenshot

please remove the image and upload the same image via imageshack.us/

follow the guide: http://forum.avast.com/index.php?topic=53253.0

Attach all logs here then essexboy or jeff will help u :slight_smile:

3

I’ve uploaded a new one and log info as well. Thank you

4

just attach the logs…dont copy paste please. :slight_smile:

5

I guess u tries to do a custom scan…a memory scan of your system…thats why u saw these things…its not malware…u are clean…dont do memory scans please…it causes odd issues…

P.S. sorry my tubelight sparked up late ;D

6

Sorry, But I don’t know how to attach log in here.
You mean that it’s just some kind of mistake only

7

U have done custom scan on memory…and that is known to cause weird issues like u see…so its better to leave it alone…u are clean and this is just because u performed a memory scan u got these results ;D

8

Yes you’re right ,I always do a custom scan.So better switch off memmory scan? Thank you very much for your help!!! :slight_smile:

9

I can’t remember the last time I did a custom scan. Too often a user will do way too deep of scan. This will lead to an immense amount of scan errors.
Try using the default full system scan. I personally use a quick scan twice a week and a “default” full system scan once a week. There is quite a number of users who do a quick scan once a week and a full scan once a month. With avast you have real-time shields so there is less worry about getting an infection. :slight_smile:

10

There are some who just use the screensaver scan and forget about the others ;D