Member Avatar for Chike

C:\Documents and Settings\Dawn\BACK UP MY DOCs\SvcHost.exe ? Need to know someone please

  • 2 Contributors
  • 4 Replies
  • 113 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Roebuc

Dani AI

Generated

Short answer: svchost.exe (Service Host) is a legitimate Windows system process, but a copy sitting in a user folder or a backup directory is suspicious and should be treated as potentially malicious until verified. For : because the file you found is in a non-system backup folder, do not assume it is the real system host process — it may simply be a benign copy, or it may be malware pretending to be svchost.exe.

Practical checks to run before deleting anything:

  • Inspect the running process first. Use Task Manager or Sysinternals Process Explorer to see the full image path and digital signature (Process Explorer is especially helpful). See Process Explorer here: Process Explorer.
  • Map services to the svchost instances with tasklist /svc (shows which services each svchost hosts). If a svchost is running from an unexpected path or hosts odd/unknown services, that is a red flag.
  • Check file properties (right-click → Properties → Digital Signatures). A legitimate copy is signed by Microsoft; unsigned/modified files are suspicious.

If the file looks suspicious:

  • Upload the file or its hash to an online scanner such as VirusTotal: VirusTotal.
  • Scan the system with an up-to-date AV and run an offline/boot-time scanner if available. Use Autoruns to check for persistence entries that point to the odd path: Autoruns.
  • Do not delete or remove the svchost.exe from the Windows system directory — that will break many services. If the copy is only in a user/backup folder and is flagged by scanners, it can be quarantined or removed; if in doubt, quarantine and seek a second opinion or professional removal.

Recommended Answers

All 4 Replies

Member Avatar for Roebuc

Someone will probably be able to answer for you, but just out of curosity have you tried scanning it with either your anti-virus or any of the online ones? How did you discover it?

Member Avatar for Chike

I'm monitoring this, I can't scan. I send someone to scan if it's a virus. Doing research I did not find the location to be legit. I just want to make sure before sending someone to fix or clean something that is normal

Member Avatar for Roebuc

Chike, I am not 100% sure if it is a virus or not but I found this , I am not in a network security field, but after what you said and what I have read, I would suggest deleting it. Probably wouldn't hurt to get a second opinion, but basically what I read was if it is not in the registry it is suppose to be, delete it. I am still looking for the correct areas for it to exist though. I will let you know if I find something.

Member Avatar for Roebuc

Ok...I found these four locations to be legit:

C:\Windows\System32
C:\Windows\$NTServicePackUninstall$
C:\I386
C:\Windows\ServicePackFIles\i386

I also read, that even though you could have four copies of this file, only the one in C:\Windows\System32 should be running. And of course this is all assumed you have installed Windows as C:\Windows.
Also, I scanned my Document and Settings folder and did not find that file anywhere. Please post here what you decide to do and if it worked. I would like to learn this as well. Thanks.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.