Need some help - Blaster worm

gibberishrthrtgjhfg

Junior Member
Aug 29, 2008
3
0
0
I noticed that I have several copies of svchost.exe running at once. Theres six of them right now. Ive been alerted to the buggyness of windows automatic updates, so I disabled them and then went to end process the horde. Some of them just end. Sometimes I get the shutdown thingy symptomatic of the blaster worm (dcom server process launcher ended unexpectedly). I do shutdown -a and keep removing them. However, as I delete them, they pop back up.

Im not seeing anything in the processes tab by a name associated with the blaster worm to end prior to installing the update to end the vulnerability. http://i172.photobucket.com/al.../w12/g_man1679/1-1.jpg

Im not sure what to do.
 

Billb2

Diamond Member
Mar 25, 2005
3,035
70
86
Windows normally runs multiple copies of svchost.exe. That's nothing to worry about.

Just do a scan with your AV program. ..and reactivate Windows Update.
 

MadAmos

Senior member
Sep 13, 2006
818
0
76
You could run a scan with one of the online scanners at Kaspersky or Trendmicro also superantispyware has been quite effective the free version works well just has to be run manually. It may also be useful to post a hijackthis log to see if there is any thing there.
I have 7 instances of svchost on one of my clean systems the other has 8.

Amos
 

gibberishrthrtgjhfg

Junior Member
Aug 29, 2008
3
0
0
Huh. I figured that several copies was suspicious. Okay then. I guess Ill try a few scans.

Im not certain of the functions that result in that error. So, does anyone know if it's possible for that error to occur without being infected by the blaster worm? I find it interesting that it occurs when I terminate svchost, rather than shortly after booting the computer as is usual for this worm.
 

SagaLore

Elite Member
Dec 18, 2001
24,036
21
81
You are most certainly not blasted with the Blaster worm, unless you've never run windows update.

Multiple copies of svchost.exe are normal. Open a CMD prompt, type in tasklist /SVC

You can see all the dll's that are hosted by svchost.