svchost.exe

[Kreon]

I have a total of 10 svchost.exe processes running.

I know svchost.exe is a legit program, but 10 of them running at once seems a little odd. Especially because:
4 are running under system,
2 as network service
4 as local service

I also received an error earlier about an error with "winlogon.exe" (which is legit) or "winlogin.exe" (which is a trojan apparently)

I'm running a virus scan now, can someone help me out with this?

 

[mechBgon]

What OS?

You might want to get Process Monitor from Microsoft, start it up, then click Tools > Process Tree as shown in this pic :camera: so you can see what the different instances are doing.

 

[Kreon]

Thanks

I hate to sound stupid, but what the hell does all of that info mean?
As in, how do I tell what's legit and what's not?
Google the process and see where it should be running?

EDIT: I'm running XP, which I know usually has a number of svchost.exe, but I've never had this many

 

[mechBgon]

One way to help determine if something's wrong, is to run HijackThis and post a log for review, and/or dump it into the online log-review dealiebob at http://hijackthis.de/en and see what it indicates is unusual or known to be bad.

This might be a good time to review your defensive strategy. I listed some suggestions on this page and I know not everyone is ready to follow all of the steps listed, but at least make sure your Data Execution Prevention is maxed out, run the Secunia checkup utility, make sure you've got the Microsoft Update engine upgrade, and have a data-backup plan of some sort.

 

[Kreon]

I figured out what it was. My printer program was being weird and running multiple sessions in the background. A reinstall of it fixed the issue

As far as security strategy- I already have taken the steps you outline in your page, the only exception being running in a non-admin account. That's not possible because of the way the school sets up our computers, though I wish it was.