When I searched Process Library
on the web for
information on svchost.exe this is the information I received. Note that its legitimate function is as an essential system process that should not be terminated. But it has also been hijacked by the Welchia.Worm and would not be indistinguishable in your list of running processes from the legitimate process. How can you know? I would hope that Spybot S&D would detect it but, since my system is clean, I can't put it to the test. Anyway I am now using WinTasks Pro that I will talk about soon. |
There is an excellent forum with
a lot of
interaction that you can
learn from. Just follow the link from the home page. Here is a screen
shot of part of the opening page. The website was developed from information provided by WinTasks, and is being constantly updated with new definitions. It should be in everyone's Bookmarks or Favorites. |
Some of this
information is common to similar programs such as Process Explorer, but
is better presented here and more advanced in some areas. The facility to create scripts and keep logs must be an advantage for programmers or trouble shooters, and access to a Block List can be an aid in problem resolution. |
If I had been
unknowingly carrying an infected svchost.exe, when I selected it and
then chose the Process Lib tab I
would have received this message from
the database. There is no mistake as to what action is required. With over 300,000 searches every day producing comments and reports, the database is certain to be regularly updated. |