When i boot up, my firewall reports that windows/system32/winhost.exe is trying to connect to freeupdate.homeip.net...

[RgrPark]

I tried running spybot and ad-aware but still have the same problem...

should i replace the winhost.exe file from someone with XP?

 

[montag451]

take your pick:

http://www.google.com/search?q=winhost....sourceid=opera&num=0&ie=utf-8&oe=utf-8

Dload
ZONEALARM
ADAWARE
SPYBOT
SPYSEEPER
TROJANHUNTER
and update your favourite ANTIVIRUS.
Update and install all the above,

Boot into safe mode.
Run all progs at least twice with a reboot imbetween

Boot into normal mode
run all scans again.

If nothing found - then make sure you use a firewall in the future

 

[RgrPark]

holy crap thanx!
i thought winhost.exe was a native windows system file!!

 

[mechBgon]

Sounds like a Spybot.worm variant. Can I suggest

1) install a free 15-day trial of McAfee VirusScan 9.0

2) disable System Restore

3) reboot into Safe Mode

4) run a McAfee antivirus scan of the whole system while in Safe Mode. It'll take a while if you have a lot of data, so maybe do this overnight.



Another recommended goodie: Microsoft Baseline Security Analyzer.

If there are multiple people using this computer, ask them if they've noticed anything weird going on when they were using MSN Messenger, since one of the places where I've seen this mentioned is Bropia worms that spread using MSN Messenger.

 

[JackMDS]

The Windows service is svchost.exe

Get rid of the Winhost.exe you do not have to replace.

However if after deleting it you have trouble run winsock.

May be this can Help.

Link to: Internet infestation -Or, how you are getting Internet "Junk" in and compromise your Computer/Network?

Link to: Basic Steps in cleaning Internet "Junk".

:sun: