How to Remove the SVCHOST.exe Virus | eHow.

com

Search
more
This Season Halloween Tailgating
Sign In or Join

Home

Internet

Internet Safety & Security

Remove Virus

How to Remove the SVCHOST.exe Virus

Top 5 To Try
How to Fix the SVCHOST Virus Help to Get Rid of Svchost.Exe How to Tell if Svchost Is Real or a Trojan How to Delete the SVCHOST Virus How to Kill Svchost.exe

How to Remove the SVCHOST.exe Virus

By Colette Larson, eHow Contributor updated March 31, 2011 Like Confirm 126 125 0

eHow
Like C fi You like this. Ad Page Insights lik

Related Searches:

Car Unlocker

Malware Anti Virus

Svchost.exe is the name of a generic host process for services that run from dynamic link libraries (DLLs). The legitimate file--located in the C:\Windows\System folder-checks the services portion of the Windows registry to verify and list the services that must load upon system start up. Multiple sessions of the file typically run while a system is operational, each session Remove the SVCHOST.exe Virus containing a separate group of services. A variety of worm malware programs spread a similarly named file--Scvhost.exe--via Yahoo! Messenger that blocks the Task Manager and Registry Editor, as well as use of the command prompt.

Related Ads
Virus Removal Windows XP Svchost EXE Virus Windows Trojan Virus XP AntiVirus Virus Virus Worm

Yes No

Instructions
Instructions

Difficulty: Challenging

If the operating system of the infected computer is either Windows Me or Windows XP, turn off System Restore while this fix is being implemented. To turn off System Restore within Windows Me, click Start > Settings > Control Panel. Doubleclick "System." Select "File System" from the Performance tab. Left click the "Troubleshooting" tab and check the "Disable System Restore" box. Click "OK." To turn off System Restore within Windows XP, log in as Administrator and click "Start." Right click "My Computer" and select "Properties" from the shortcut menu. Check the "Turn off System Restore" option for each drive on the System Restore tab. Left click "Apply" and "Yes" to confirm when prompted. Click "OK."

Related Articles & Videos

How to Repair the EXE Virus

How to Install Svchost.exe

How to Remove Viruses From Svchost.exe

Restart your computer in Safe Mode and log in as Administrator. Press "F8" after the first beep occurs during start up, before the

http://www.ehow.com/how_5132341_remove-svchostexe-virus.html[07.10.2011 22:23:42]

How to Remove the SVCHOST.exe Virus | eHow.com

Ads by Google

display of the Microsoft Windows logo. Select the first option, to run Windows in Safe Mode from the selection menu.

How to Remove the Svchost.EXE Trojan

Access the command prompt. Click Start > Run. Type "cmd." Click OK > CD (change directory) from the command prompt, press the space bar. Type the name of the full directory path of the folder containing your Windows system files. It will be either "C:\Windows\System" or "C:\Windows\System 32."

How to Fix an Svchost.exe Virus

From the command prompt, type the following to unprotect the files for removal: "attrib -h -r -s scvhost.exe" and press "Enter;" "attrib -h -r -s blastclnnn.exe" and press "Enter;" "attrib -h -r -s autorun.inf" and press "Enter."

How to Tell if Svchost Is Real or a Trojan

More

Delete the files by typing the following from the command prompt: "del scvhost.exe" and press "Enter;" "del blastclnnn.exe" and press "Enter;" "del autorun.ini" and press "Enter."

Type "cd\" to return to the main Windows directory. Unprotect and delete the Autorun.inf file by typing the following from the Windows directory command prompt: "attrib -h -r -s autorun.inf" and press "Enter;" "del "autorun.inf" and press "Enter;" Type "regedit" and press "Enter" to open the Registry Editor.

Locate the following entry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Delete the incorrectly spelled Yahoo! Messenger entry with the value "c:\windows\system32\scvhost.exe."

Locate the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Within the key, there is a "shell" entry with the value of "explorer.exe, scvhost.exe". Edit the entry to remove the reference to Scvhost.exe, leaving Explorer.exe as the remaining value in the registry entry.

Locate the following key: HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services> Delete the following subkeys from the left panel: RpcPatch RpcTftpd Exit the command prompt and return to the operating system. Type "Exit," and press "Enter."

10 Reboot the PC.

If Scvhost.exe still resides on the computer, repeat these steps or try using an automatic removal program from McAfee or

http://www.ehow.com/how_5132341_remove-svchostexe-virus.html[07.10.2011 22:23:42]

How to Remove the SVCHOST.exe Virus | eHow.com

Symantec (see links in References).

Free Website Templates

www.Wix.com/-Free-Website

Design Your Own Free Website. Flash, Drag & Drop, Easy, Unique

Export - Coniex

www.export-coniex.com

Enamelling; Enamel;Silicone Moulds Emaillage; Epoxi; Silicon Molds

Tired of spam email?

www.vamsoft.com

Using Microsoft Exchange? Try ORF from Vamsoft.

FXLiDER Srpska Platforma

Ads by Google

www.fxlider.com

Leverid i do 200:1 Podrka operatera na srpskom!

Tips & Warnings

Manual removal of Scvhost.exe may be difficult as the removal process requires knowledge of the Operating System's command prompt and Registry Editor. In addition, different versions of this malware rename and relocate various file components. If not performed properly, your computer system might experience permanent damage. Consequently, manual removal might be best for experienced users. Less experienced users might want to consider using an automatic spyware removal application, such as that offered by Trend Micro.

This worm duplicates itself to different locations of shared folders. The duplicated program uses a folder icon that has an .exe file extension. DO NOT double click on any of these folders.

References
McAfee Virus Profile: W32/YahLover.worm Symantec W32.Welchia.Worm - Removal Microsoft Description of Svchost.exe

Photo Credit Ryan McVay/Photodisc/Getty Images;

Read Next: How to Repair the EXE Virus

Like Confirm

126

125

Comments
6 comments

View all 10 Comments

en_US h 1ttp://www.ehow.com/how_5132341_remove-svchostexe-virus.html comment feedback_0ZiQRcPfh2l7fhi3g light umf7wl_1 http://www.facebook.com/plugins/comments_v1.php?app_id=63203377906&xid=aG93XzUxMzIzNDFfcmVtb3ZlLXN2Y2hvc3RleGUtdmlydXMuaHRtbA&url=http%3A%2F%2Fwww.ehow.com%2Fhow_5132341_remove-svchostexe-virus.html HPgNJ 6b6a4c6923ce217c6411428b9424d9fa

Add a comment...
Post to Facebook Clyde Donovan South Park High School I'm getting "file Not Found".
Comment Comment

http://www.ehow.com/how_5132341_remove-svchostexe-virus.html[07.10.2011 22:23:42]

How to Remove the SVCHOST.exe Virus | eHow.com

Reply Like

Like

July 20 at 6:28am

Add a Reply...
Reply Reply

Dimuthu Dharshana Lecturer at University of Ruhuna-Faculty of Engineering Follow the below to get the fully access control. Click Start >. Run > Type "regedit" (with out " "). ...See More Reply Like
Like

May 26 at 6:10am

Add a Reply...
Reply Reply

Andrijana Andry Stojanovi University of Belgrade '08 Hi! First I doing: attrib -h -r -s svchost.exe, but when I doing the "del svchost.exe" it said:" Access is denied." How to allow access? Reply Like
Like

April 26 at 2:53am

Vladan Bjelic University of Novi Sad ne razumijem samo kakav je to virus?! pa skoro na svim Windows OS se nalazi taj fajl i svim servisima i system procesima? :/ Reply Like
Like

April 26 at 3:31am

Andrijana Andry Stojanovi University of Belgrade '08 Naravno da se nalazi, ali problem je sto mi je svchost.exe zarazen virusom. Reply Like
Like

April 26 at 3:41am

Vladan Bjelic University of Novi Sad uuu dobro je :D vec sam se prepao da smo svi zarazeni :D Reply Like View 1 more
Like

April 26 at 4:55am

Add a Reply...
Reply Reply

Isabel Thomas Stilwell, Kansas this guide doesn't work at all. step 7 there is no file with yahoo messenger. Reply Like
Like

April 23 at 11:59am

Add a Reply...

You May Also Like

Removal Tools for the Svchost.EXE Virus
Removal Tools for the Svchost.EXE Virus. Svchost.exe is a system process created by Microsoft Windows that manages programs that use Dynamic Link Library (DLL) files ...

http://www.ehow.com/how_5132341_remove-svchostexe-virus.html[07.10.2011 22:23:42]

How to Remove the SVCHOST.exe Virus | eHow.com

Slideshows

Others Also Viewed

How to Get Rid of the Svchost.EXE Virus How to Check an Svchost.exe Trojan How to Remove the Svchost Trojan

15 Home Repairs for $15

10 Best College Football Venues

Little Fashion House on the Prairie

About Kaza.exe What is Rund1132?

Search
About eHow How to by Topic How to Videos Sitemap

Copyright 1999-2011 Demand Media, Inc. Use of this web site constitutes acceptance of the eHow Terms of Use and Privacy Policy.

Ad Choices en-US

http://www.ehow.com/how_5132341_remove-svchostexe-virus.html[07.10.2011 22:23:42]