Help with program that wants to control svhost

[tazman01 0]

Windows XP home SP3 with all updates, Nod32 AV version 4, OA Premium (but not with the AV), Use Firefox, (at times Opera and Chrome)

I started getting this question from OA Module \BaseNamedObjects\ShimCacheMutex

wants to remotely control another process using OLE

C:\WINDOWS\system32\svhost.exe

I block it (not selcting remember, trust or terminate) since I am not sure if it is safe or not and it comes back again ~10 minutes later.

Anyone have any idea if it is safe or what it is for?

[GT500 841]

Does Online Armor give you any idea as to what process may be doing this? It is very common for legitimate software (especially security software) to use svchost.exe to run parts of their program.

[stapp 151]

tazman did you make a spelling mistake when you put svhost.exe?

[tazman01 0]

I did mis-type - the entry should say svchost.exe (not svhost.exe). It looks like this may be a Google update thing. I didn't recognize it since usually I saw something in the online armour popup that said google\update

[GT500 841]

Please run OTL by following the instructions below:

1. Click this link to save OTL onto your desktop (please make sure to click 'Save' instead of 'Run').
   
2. Double click on the OTL icon on your desktop to run it. Make sure all other windows are closed and to let it run uninterrupted.
   
3. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan will take a few minutes.
   
   • When the scan completes, it will open two Notepad windows. OTL.Txt and Extras.Txt. The first one (OTL.txt) will be automatically saved on your desktop next to OTL, and the second one will need to be saved manually.
     
   • Please make sure that both OTL.txt and Extras.txt are saved on your desktop, and then attach both of them to a reply so that we can take a look at them.
     

[GT500 841]

Also, if you could get us a screenshot of the popup, that might be helpful as well. Here's a link to instructions on how to sake a screenshot. Please attach it to a reply using the More Reply Options to access the attachment controls.