Ye's svhost issue

YCL wrote:

I used AVG n nothing but windows firewall...
I used others earlier but kinda screwed me up...

I used to get this svhost like years ago n fixed it by some articles that I found that time...yet this time, all the googling gives me confusing results...either the virus is modified or the articles are buried down under the others of the same keyword...bad is patience is not my virtue on most cases...

Taking the off-topic-ness from the REAL members' pictures thread, I put this, so we continue discussing this issue on its own thread. If it can be fixed, you can post the directions to how to remove it. That way, if it ever happens again, just take a small browse here, and problem solved.

Ye, can you tell me what this keyword is? I could ask some of my friends, and I could make a thorough research around it. Might even stumble with the article you checked out to remove it. That is, assuming virus hasn't been modified, story could be different if it has been modified.

Making a small research just using svchost virus as keywords, I found this reply in Spanish, will post it here and then translate it in English. Hopefully, this must be what Ye needs to fix his pc.

One interesting note is: it depends where this svchost.exe is located. If its anywhere BUT C:/Windows/System32, then its a virus. I'll leave the Spanish post for me to translate it later.

Wama wrote:

Hola, yo tenia el mismo virus, el svchost, que se encontraba en los discos c,d,etc:\svchost.exe. Lo que hice para eliminar fue lo siguiente. Desoculté todos los archvios del sistema, entré al administrador del sistema y eliminé todos los procesos,en especial el explorer.exe, pero al momento de eliminar uno de los svchost mi equipo quizó reiniciarse, para esto me fui a la pestaña aplicacion es y ejecute nuevo tarea en la casilla puse lo siguiente shutdown -a, con esto paro el reinicio, por lo tanto seguí eliminando todos los procesos que se podía. y me volví a ir a aplicaciones donde inicie nueva tarea y con el boton examinar eliminé de todos los usuarios las siguientes carpetas C:\Documents and Settings\usuario\Configuración local, alli eliminé la carpeta temp, con shift + supr para eliminarlos completamente del sistema. eliminé de todos los usuarios que tenia. y luego los eliminé de mis disco. De está forma no se volvió a reproducir.

Es muy largo el proceso, les haré un script.

Quote :

Hi, I had the same virus, the svchost, that was in the disks C, D, etc:\svchost.exe. What I did to eliminate it is the following. I showed all hidden folders from the system, entered as system administrator and eliminated all processes, especially explorer.exe, but at the moment of eliminating one of the svchost my equipment wanted to restart. For that, I went to the applications tab and executed a new task and in the box I put the following shutdown -a. With this, the restart stopped, thereforeI resumed eliminating all the processes possible. I went back to Applications tab where I started a new task and with the Browse button I eliminated from all users the following folders C:\Documents and Settings\user\Local Configuration, from there I eliminated the temp folder with shift + supr to eliminate them completely from the system. I eliminated from all users I had, and then eliminated them from my disc. That way, it didn't reproduce.

The process is very long, I'll make a script.

That should be it... need to look for said script.

Well, first of all it's svhost not svchost...according to what I faced with this once long time ago, there's several svchost.exe running in those are all the correct one n when you start shutting down svchost...I experienced that one of those may shut down the pc, so it's kinda the opposite of the written here...

On googling you'll find svchost most of the topic...I even use -svchost to get what I want, but the information now seems...rather...blurry...

I get zone alarm working on now n it can block traffic as it used to be...before I was getting tired of opening one by one application that needs internet access... >.<
it can block svhost traffic however the process itself is still there...

Anyway I'll be able to be online tomorrow afternoon...I hope...

Was speaking about that with Hatsu on Physics class. Funny... I should wait and see what Hatsu has to say about this.

I spoke to her today at Physics class and told me she had a similar problem (won't explain myself due to lack of details). Main thing is that Hatsu installed Zone Alarm for the sole reason of preventing this svhost thing to gain internet access, which I assume would be disastrous.

I'll keep searching on it for any possible solutions though.

On another note: Have you tried Ad-Aware anti-spyware? Sorry if I asked you this earlier; right now I can't recall if I did.

Well. internet is on...but due some stupidity...my other pc in which pw is installed is still out of reach...some cabling issue...

n about that svhost...I simply kill it using zone alarm...well, seems deploying za again is the shortest choice...though...like in the past I'll have some tedious task of allow-deny procedure which is...annoying...

Well well to start off, svchost.exe is a integral part of Windows operating systems, actually its part of its core, any application that requires 16bit libraries will "call" this exe.

Blocking it from accessing internet or even running at all can prove fatal. Windows update, automatic time update, windows native firewall, DNS client and DHCP client all use this exe.
Ive only used ZA to prevent svchost.exe that are NOT located inside windows->system32 to connect to internet.

So there is no real reason to remove it (actually there is no way to remove it w/o "harming" windows integrity, or more like impossible to do so).