I think I might have a worm

[Liza]

Hi Technical,

Quickly, maybe,  but as I said in my original post,  unfortunately patience in not one of my virtues.    Three weeks I have been trying to figure out what is wrong.  I guess at this point I really don't know what else I can do.  I don't want to start from the beginning but I just don't know what else to do. 

If you can think of anything else that I haven't tried I would be willing to do it.

Thanks,

Liz

[sdelisle]

Hi All

I would like to continue this thread as I too have been having a very similar problem and it started just after New Year. Basically I have ZoneAlarm and I noticed that there was a large amount of Network Activity (I thought it was Internet Activity) but my PC was not doing anything.

Zone Alarm told me it was one of the svchost.exe processes that was causing this. I found that the moment I went in to Task Manager and closed down the svchost.exe process that had the highest Mem Usage my network activity stopped.

I assumed I had some kind of worm or Trojan so I started the long road of researching why.

Eventually I saw a recommendation for Process Explorer as I really wanted to find out what application was piggybacking off the svchost.exe.

I don't really know what I found as I don;t have the technical knowledge to figure this out and I was wondering this extra information might help you guys figure this one out?

Should I start a new post?

I have a screen shot from Process Explorer that I have uploaded to my web site

http://home.exetel.com.au/delisle/scrnshot.gif

I am running WinXP Pro, SP2, Zone Alarm 4.5xxx, McAfee Anti Virus.

The thing is after seeing Process Explorer it occurred to me that perhaps this was a kosher Windows process going across a Network (I have 2 PC's networked in a WorkGroup). I am totally confused but being paranoid I immediately suspected the worst when I saw it.

Any help appreciated as I am not keen on reformatting, esp as I can get around the problem by simply killing the offending svchost.exe process in Task Manager.

Regards

Simon

[Lisandro]

I am running WinXP Pro, SP2, Zone Alarm 4.5xxx, McAfee Anti Virus.

Simon, I know very little about McAfee (I used it in last '90 but I quit it for NAV, then AVG and then avast! 
Maybe you're lucky to found avast forums... 

[sdelisle]

Simon, I know very little about McAfee (I used it in last '90 but I quit it for NAV, then AVG and then avast! 
Maybe you're lucky to found avast forums... 

Well I only bought it becasue ti was recommended. I posted to this forum because youguys seemed to know what you were talking about. I was hoping to find out if I actually did have a Trojan/Worm and if so what it was or what I might do to fix it.

My apologies if I should not be here.

Simon

[Lisandro]

Well I only bought it becasue ti was recommended.

It's good to know that the 'big' companies envy us 

I posted to this forum because you guys seemed to know what you were talking about.

I hope so 

I was hoping to find out if I actually did have a Trojan/Worm and if so what it was or what I might do to fix it.

In fact, it will be better if you uninstall McAfee for a while.
Download and install avast to scan you system.
If you're clean, then you got your answer.
You can uninstall avast and install McAfee after that 

My apologies if I should not be here.

Why? You're in the right place to find help 
Maybe you join the family in the future 

[DavidR]

Hi, welcome to the forums.

I think that you have learned a valuable lesson, no matter what the software, if there is no support, it is worthless. This is without doubt the best support of any AV software I have ever had installed.

There are many ex McAfee, Norton, AVG, etc. users who are now happy avast users, give it a try I don't think you will be disappointed.

In the meantime, check out these threads or links.

Advice & Tools for virus/trojan/malware Removal & Prevention and Eddy's Website click the "HiJackThis Section" and also the "Malware removal instructions and applications" section.

For an on-line scan of your Hijackthis log file try here http://hijackthis.de/index.php