svchost.exe deleting an Tcpip and netbt files!!! RRS feed

  • Question

  • Good evening,


    I have a question about system service changes in Windows Vista Home Premium. I changed in my antivirus application a setting where I pointed to antivirus system, that it will notify me of any system service change that Windows will provide. Well, next I turned on my computer and there were system changes like:

    "svchost.exe is attempting to delete Tcip"

    "svchost.exe is attempting to delete netbt"

    "wmiadap.exe is attempting to delete wmiprpl" (here I'm not sure, if this are the exact names of the files)


    Is this a normal activity for a healthy Windows system or do I have there anybody running and changing my settings in my computer???


    Thank you

    Sunday, July 4, 2010 5:48 AM

All replies

  • Hi,

    I think, what u can do here is go to command prompt and type tasklist /svc and see in the output if you have any malicious service registered itself  in SVCHOST.exe

    Also you can see the same in the services console.


    SVCHOST is a Generic host process inside which multiple services(process) run. So it could be something fishy..!!

    Saturday, July 10, 2010 1:43 PM