Help needed with scvhost.exe

Somehow my laptop got the Trojan horse scvhost.exe. I was able to remove it with avast but now every time I start up windows it says it can't find scvhost.exe in the registry and it tells me to delete the entry in the registry. However I have no idea where to look in the registry.

Thanks in advance for your help,
Tim

 

Downloading a registry cleaner may fix your problem - try RegScrubXP:
http://majorgeeks.com/download.php?det=2048

 

Uh are you sure it was a virus? The process "svchost.exe" is used by Windows to run a multitude of services, from System Restore to Autoplay to the all important Remote Procedure Call (RPC). If you somehow delete the file and registry entry, Windows may just load in a backup version for self preservation---it is that crucial.

If it is "sCVhost", then yeah it looks like a virus/trojan/keylogger. Anything you downloaded lately that would lead you to this conclusion?

 

Thanks Chaz. I ran CCleaner earlier but it didn't do anything. I found two things relating to scvhost so I will see if that helps.
Tim

 

Yeah I am pretty sure it was scvhost and not svchost. I wrote it down before closing the windows.

I am not sure how that happened. I have a feeling someone (my brother ) figured out my password. Sadly he is a pretty good hacker. lol
Tim

 

Sigh...it didn't work. Here is the message it is giving me when I start up.



Tim

 

Tim do you still have your WinXP disc around? You can pop it in and do a repair of your OS install. It won't wipe out your data, it will just overwrite a lot of OS files to the original ones.

Before you try that, look in your startup folder (Start--->All Programs--->StartUp) and make sure there's not a shortcut pointing to a scvhost.exe file in your Windows directory. Also, look into Start--->All Programs--->Accessories--->System Tools--->Scheduled Tasks, and make sure there are no suspicious tasks scheduled to be run at regular intervals. Finally, doing a system restore to a few days or week ago is a good idea also.

 

Ah yeah, I had that one too once.

Anyway, just open regedit, click on the root, hit f3 (search) and enter scvhost.exe.
Then delete everything it finds.

(Just make sure to get the spelling right, so you dont delete anything related to svchost )

 

i had that one year ago on my desktop, too )
the funny thing is that scvhost would take 100% CPU usage until i terminate it, kind of annoying when you're playing something your fps drop to 1 (or crash) and you have to terminate a stupid thing to get back

 

Yep that did the trick. Thank you Jalf.
Tim

 

Yep definitely a virus. Follow the following directives to remove it
http://www.delphifaq.com/faq/spyware_virus/f884.shtml

...and disconnect your lappy from the network. It is preventing other users from using the forum. Typical Denial Of Service attack. lol =p

 

I recommend using ad-aware
Lately I have been attacked by SCCVHost.exe but it can not get in my registry because of ad-aware.
It will ask you if you agree for the SCCVHost to get in the registry, just answer Block and you be fine.
Just my opinion, hope I post it in the right place