Be Sociable, Share!

Svchost error message might signal that the system is infected by the virus that has the same name with one of the most important system programs. Svchost.exe is a legitimate generic host process for operating system services that run from system DLLs. Each of these dynamic link libraries encapsulates some system service functions. Host Process runs multiple instances of the host process, and each instance handles the group of related services.

  • This design helps to save system resources needed for application ptograms.
  • This design helps viruses to hide among multiple Host Process instances.

Some warms are spreading a file named Scvhost.exe that can look like the legitimate one. Besides hiding, this worm blocks Task Manager, Registry Editor, and Command prompt to make its identification and removal more difficult.

There is a possibility of manual fake svchost.exe removal; however, there is no guarantee that it is up to date at any time of the warm existence and possible farther development with more intricate design that is hard to remove manually. The svchost.exe virus removal is simpler and better made by special antivirus software or the virus removal utilities.

DownloadDownload Fix Wizard

<h2>Instructions for the svchost,exe virus manual removal </h2>

Note: It is better to turn off the system restore before the virus is eliminated.

  • Enter system as a system administrator.
  • Click Start button and right-click My Computer
  • Select Properties in the menu and check Turn off System Restore option. Repeat it for each drive present in the System Restore tab and click OK.

Restart your computer in Safe Mode (log in as Administrator).

  • Press “F8” key after the first beep during start up process.
  • Select the first option (run Windows in Safe Mode)

Access the system command prompt.

  • Click Start and Run.
  • Type “cmd.” And Click OK

Change directory with cd command at the prompt and press space bar.

  • Type the name of the full directory path of the folder that containing your Windows system files. It will be in the “C:\Windows\System 32.” folder

Take protection off the virus files that are needed to be removed

  • attrib -h -r -s scvhost.exe” and press Enter
  • attrib -h -r -s blastclnnn.exe” and press Enter
  • attrib -h -r -s autorun.inf” and press Enter

Delete these files by typing the following commands at the command prompt:

  • del scvhost.exe” and press Enter
  • del blastclnnn.exe” and press Enter
  • del autorun.ini” and press Enter

Type “cd\” for returning to the main Windows folder.

Unprotect and delete the Autorun.inf file by typing the following from the Windows directory command prompt:

  • attrib -h -r -s autorun.inf” and press Enter
  • “del “autorun.inf” and press Enter
  • Type “regedit” and press Enter to open the Registry Editor.

Locate the virus entry key in the system registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

Delete the incorrectly setYahoo Messenger entry with the value “c:\windows\system32\scvhost.exe.”

Locate the following key in the system registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.

In this key, there is a “shell” entry with the value of “explorer.exe, scvhost.exe”. Edit the entry to remove the reference to Scvhost.exe, leaving Explorer.exe as the remaining value in the registry entry.

Locate the following key:

HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>

  • Delete the following subkeys from the left panel:
  • RpcPatch
  • RpcTftpd
  • Exit the command prompt and return to the operating system.
  • Type “Exit,” and press “Enter.”
  • Reboot your PC.

If Scvhost.exe still resides on the computer, then try to repeat these steps or try an automated utility removal program for the svchost.exe virus removal.

DownloadDownload Fix Wizard

Be Sociable, Share!