port 3389 for RDP is listened to by vchost.exe

According to ThreatExpert.com, vchost.exe could be a threat. I'd scan your system with whatever AV tools you have installed to confirm.

Symantec also makes a reference to a trojan that will create a Vchost directory.

Here's another reference to it as a threat.

This is not to be confused with vshost.exe or svchost.exe.

Note that the real Windows RDP server actually shows up as svchost.exe.

Bon Gart

Posted 2012-05-20T04:04:07.970

Reputation: 12 574

ok, I'm doing a scan with microsoft security essentials. I can't do any scans in safe mode unfortunately because I'm totally blind, and my text-to-speech software doesn't work in safe mode. But if it doesn't come back as a threat from MSE, is there some way to unblock port 3389? I followed the instructions on the linksys router page and I know I did it right because other ports I opened work fine. I suppose I could reassign the port that RDP uses to something like 3390? Or is that a bad idea? – user135184 – 2012-05-20T20:38:45.000

@user135184 you would be better off trying to remove vchost.exe, rather than trying to bypass the trouble it is causing you. Try ComboFix http://www.bleepingcomputer.com/download/combofix/ if you can get it from that page

– Bon Gart – 2012-05-20T22:05:35.840

I downloaded Combo Fix but have no idea how to read the log. Can I post it here for someone to look at? – user135184 – 2012-05-22T22:42:08.390

@user135184 the people at BleepingComputers have extensive experience with ComboFix and can be far more helpful. Sign up, post the issue with vchost.exe, and ask them if they can explain the log for you. – Bon Gart – 2012-05-23T02:52:17.167

port 3389 for RDP is listened to by vchost.exe

Answers