svhost.exe - virus måske???

http://www.svein.dk/Visartikler.asp?ART_id=33&S_Menu=25
http://support.microsoft.com/?kbid=250320

hedder den SV eller SVC host?

den hedder SVhost.exe!

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT.D

jeg er ikke 100% sikker så - har stødt på den før, og nogle mener det er noget system-noget, men det kunne jo være en forveksling af svchost... prøv ect at kig på dette så;

http://www.trendmicro.com/search/google/results.asp?q=svhost

Jeg har været forbi disse link, men svhost.exe eksisterer ikke i nogle af de stier de angiver til regedit...øv!

http://www.unm.edu/cirt/security/win2k1.html

Jeg deler pointene mellem jer. Jeg bliver nok nødt til at formatere.
Tak for jeres tid

Jeg fandt en tråd på nette om samme problem:
http://www.linkbyte.com/ubb/Forum6/HTML/000008.html

et af indlæggene var dette:

Alright guys, here's what you need to do:
Go to regedit, and delete all registry entries assosiated with "firedaemon" and "cygwin." Then go into your "Services" and disable both services assosiated with FireDaemon, and then one assosiated with either "Telnet" (unless you have a specific reason for running it), and "RunAs". This will get you started. Then go into your system root (C drive) and delete any "Mybot" files.
This you're going to have to do in Safe Mode. Go in through safe mode, "Show All Files" in Folder Options, then go to this directory:
C:\winnt\system32\drivers\etc\
There should only be four files in this directory: Network, Protocols, Hosts, Services. Delete all of the rest of them. This will fix the "SVhost and SVChost" problems you've been having.
If there is a folder in the "System32" directory call "NT"....delete it to. Good luck guys. There are two registry fixes for the SVChost issue, on is above and I don't remember the other, but it's not as critical as killing the services and files. 
Alright guys, here's what you need to do:
Go to regedit, and delete all registry entries assosiated with "firedaemon" and "cygwin." Then go into your "Services" and disable both services assosiated with FireDaemon, and then one assosiated with either "Telnet" (unless you have a specific reason for running it), and "RunAs". This will get you started. Then go into your system root (C drive) and delete any "Mybot" files.
This you're going to have to do in Safe Mode. Go in through safe mode, "Show All Files" in Folder Options, then go to this directory:
C:\winnt\system32\drivers\etc\
There should only be four files in this directory: Network, Protocols, Hosts, Services. Delete all of the rest of them. This will fix the "SVhost and SVChost" problems you've been having.
If there is a folder in the "System32" directory call "NT"....delete it to. Good luck guys. There are two registry fixes for the SVChost issue, on is above and I don't remember the other, but it's not as critical as killing the services and files.

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.socksbot.html

Dér var den!

Det er en back-door...


...Google er din ven!

http://www.google.com/search?q=SVhost.exe&ie=UTF-8&oe=UTF-8&hl=da&btnG=Google-s%C3%B8gning&lr=

lukketid?

Jeg fandt faktisk frem til at den eneste måde at fjerne denne "virus" er ved at opdatere windows fra deres hjemmeside.....
Jeg fandt desuden ud af at en hacker har haft adgang til min pc, så det var lidt en haste sag....
Vildt, men nemt at løse (næmere) end de andre guides

Hilsen Carsten

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

http://isc.sans.org/diary.html?date=2003-08-11

og lær så at lukke for port 0 - 1024 hvis du ikke bruger dem !