Hjt Question

Does anyone know what this? Good? or Bad? I couldn't find any info on it. It's from a XP system and only appears here. Thanks O4 - HKLM\..\Run: [System Restores] C:\WINDOWS\svahost.exe

Seems baddie at first look….You need to post the complete HJT Log in order to get correct assistance on it.

It certainly looks like it is trying to look like a couple of legit files and that usually suggests bad…. You can check in Properties for the file. If it is clearly garbage, remove it. If it looks like it could be legit, post the info you find so we can see how it holds up. You can also rename the file with BAK extension and see if it makes any difference since it won't execute with that extension. You have to reboot to check it out…

I was helping someone else out, but they never got back to me so I don't have any info on that file but it certainly looks bad. The original problem was a dialer , www.seksdialer.com , and a shortcut called Teen Seks movie on the desktop. Here's what I found and had him fix: R3 - Default URLSearchHook is missing O4 - Startup: startit.exe O4 - HKLM\..\Run: [System Restores] C:\WINDOWS\svahost.exe C:\WINDOWS\System32\dlloc.exe

If you are planning to do a lot of helping out with logs, you might want to apply to be admitted to the Classroom…. Check here for details:

http://forums.tomcoyote.org/index.php?showtopic=1421

OK, I'll look into it. I've been posting on www.annoyances.org for the last 2 years or so, mostly in the 98 and ME forums, also just started helping in the Spyware/Security forum at www.computing.net. With all the spy/adware problems and hijackers I should expand my knowledge, I do find it very interesting and challenging. I try to read all the post here and learn from them. Thanks alot - MrC