Windows Forum
Could someone that is running windows xp pro; Go to Task Manager and see if you have "svchost.exe system" or svchost.exe running under Processes.
If so, if you would right click on either one of those and choose end process; see if you get the "windows will shutdown" popup message. Is this normal? Should this happened?
by dmiles
No the message stated a warning
Terminating a process can cause undesired results including loss of data and system instability
by pmidnite
by ann777
If you click OK, then of course, the system will shut down.
Paste this link into your browser for a description of what svchost does...
support.microsoft.com/default.aspx?scid=kb;EN-US;314056
by pmidnite
Poster rated this answer.
by s1police
yes, if you kill this job, it will turn off your computer.
that like, if you kill the explorer.exe, you cannot see all , for example, menu bar...etc. if you turn on again, it will appear again. you can try.
by pmidnite
Poster rated this answer.
by joseph moore
You are having a lot of problems with this, aren't you?
Like everyone else is saying, yes, SVCHOST.EXE is a valid Windows application. It has been since at least NT4. Many services run under that EXE, including the RPC service.
The Blaster worm and it variants (namely the Welchia variant) would trigger a newly disclosed vulnerability in the way RPC service talks to the DCOM service on TCP port 135.
On some machines, when the Blaster worm tried to trigger the vulnerability to then infect the target system, the RPC service would instead become unstable. When that happened, the virus was stopped in its tracks and did NOT infect the target system, but it DID manage to mangle RPC in the process.
That was when people were getting the "shutdown in 60 seconds" countdown window.
And yes, if you manually kill the SVCHOST.EXE process running, that is the same as killing the RPC service. Windows doesn't run without RPC. That is why it was such a dangerous vulnerability. All Windows verions (the NT Kernel type) run RPC, and you can't stop it.
So, if you are worried about if you are infected with Blaster or Welchia or any other variant, go here:
www.sarc.com
The Symantec antivirus section. Go to the Virus Tools section, and download the Blaster and Welchia tools and run them both.
And make sure you are patched with the lastest RPC patch, MS03-039, located here:
http://www.microsoft.com/security/security_bulletins/ms03-039.asp
(please remove any spaces)
Being patched will prevent any future infections.
by joseph moore
Just run the tools, be patched, and relax. It is ok.
hope this helps
by pmidnite
Poster rated this answer.
by pmidnite
This discussion is closed to new replies.
Sort by Trending