Why would HijackThis find 3 svchost.exe in my system32 folder?

[rthings]

Hi - I noticed that 3 svchost.exe show up in the log file of a HijackThis, in my C:\WINDOWS\system32 folder (except that one time it capitalizes the S in system) ...

When I view hidden files on my PC, I only see one system32 folder apparent, and in it only one svc.host.exe .. I understand svchost.exe to be a legit program if it's in that folder, but associated with malware when found elsewhere.

(Have been trying to track down and eradicate a Fun Web Products adware thing.)

 

[howard_hopkinso]

It`s perfectly normal to have several instances of svchost.exe running. See HERE for info.

For your Funweb problem, please do the following.

Go and read this thread HERE, then post a HJT log as an attachment into this thread.

Regards Howard

This thread is for the use of rthings only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[rthings]

OK, here's the log file

Attached you'll find a HiJack This log file.

I ran it right after I ran a Trend Micro HouseCall scan, which found ADWARE_FUNWEBPRODUCTS and ADWARE_BESTOFFERS and some HTTP COOKIES. I did not perform any cleaning functions with HouseCall before I then ran the HiJack this.

I've previously (recently) cleaned with HouseCall, however... yet the infections came back in a day or so. One thing I wonder is whether other parts of a secure home WiFi network (that I don't administer) may be doing the infecting, or if it's a more local thing. I only use the network as an access point to a cable modem, so would also appreciate advice on the best settings for my PC so as to minimize the risk from any other volumes on the network. Thank you, by the way!

 

[howard_hopkinso]

Your HJT log is clean.

I suggest you download, install and run the Ccleaner programme as per step9 of the instructions in this thread HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

FunWebProducts
Smileycentral.

Close control panel.

Reboot your system.

Smileycentral is the application most associated with the funweb trojan.

Then go and read this thread HERE. It`ll show you how to keep your system more secure.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of rthings only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[rthings]

Thanks much for taking a look.