The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Help needed with scvhost.exe

    Discussion in 'Windows OS and Software' started by Tim, Jan 4, 2007.

  1. Tim

    Tim Notebook Virtuoso

    Reputations:
    2,752
    Messages:
    3,141
    Likes Received:
    2
    Trophy Points:
    106
    Somehow my laptop got the Trojan horse scvhost.exe. I was able to remove it with avast but now every time I start up windows it says it can't find scvhost.exe in the registry and it tells me to delete the entry in the registry. However I have no idea where to look in the registry.

    Thanks in advance for your help,
    Tim
     
    Tim, Jan 4, 2007
    #1
  2. Charles P. Jefferies

    Charles P. Jefferies Lead Moderator Super Moderator

    Reputations:
    22,339
    Messages:
    36,639
    Likes Received:
    5,076
    Trophy Points:
    931
    Charles P. Jefferies, Jan 4, 2007
    #2
  3. Gator

    Gator Go Gators!

    Reputations:
    890
    Messages:
    1,889
    Likes Received:
    0
    Trophy Points:
    55
    Uh are you sure it was a virus? The process "svchost.exe" is used by Windows to run a multitude of services, from System Restore to Autoplay to the all important Remote Procedure Call (RPC). If you somehow delete the file and registry entry, Windows may just load in a backup version for self preservation---it is that crucial.

    If it is "sCVhost", then yeah it looks like a virus/trojan/keylogger. Anything you downloaded lately that would lead you to this conclusion?
     
    Gator, Jan 4, 2007
    #3
  4. Tim

    Tim Notebook Virtuoso

    Reputations:
    2,752
    Messages:
    3,141
    Likes Received:
    2
    Trophy Points:
    106
    Thanks Chaz. I ran CCleaner earlier but it didn't do anything. I found two things relating to scvhost so I will see if that helps.
    Tim
     
    Tim, Jan 4, 2007
    #4
  5. Tim

    Tim Notebook Virtuoso

    Reputations:
    2,752
    Messages:
    3,141
    Likes Received:
    2
    Trophy Points:
    106
    Yeah I am pretty sure it was scvhost and not svchost. I wrote it down before closing the windows.

    I am not sure how that happened. I have a feeling someone (my brother :p) figured out my password. Sadly he is a pretty good hacker. lol
    Tim
     
    Tim, Jan 4, 2007
    #5
  6. Tim

    Tim Notebook Virtuoso

    Reputations:
    2,752
    Messages:
    3,141
    Likes Received:
    2
    Trophy Points:
    106
    Sigh...it didn't work. Here is the message it is giving me when I start up.

    [​IMG]

    Tim
     
    Tim, Jan 4, 2007
    #6
  7. Gator

    Gator Go Gators!

    Reputations:
    890
    Messages:
    1,889
    Likes Received:
    0
    Trophy Points:
    55
    Tim do you still have your WinXP disc around? You can pop it in and do a repair of your OS install. It won't wipe out your data, it will just overwrite a lot of OS files to the original ones.

    Before you try that, look in your startup folder (Start--->All Programs--->StartUp) and make sure there's not a shortcut pointing to a scvhost.exe file in your Windows directory. Also, look into Start--->All Programs--->Accessories--->System Tools--->Scheduled Tasks, and make sure there are no suspicious tasks scheduled to be run at regular intervals. Finally, doing a system restore to a few days or week ago is a good idea also.
     
    Gator, Jan 4, 2007
    #7
  8. Jalf

    Jalf Comrade Santa

    Reputations:
    2,883
    Messages:
    3,468
    Likes Received:
    0
    Trophy Points:
    105
    Ah yeah, I had that one too once.

    Anyway, just open regedit, click on the root, hit f3 (search) and enter scvhost.exe.
    Then delete everything it finds.

    (Just make sure to get the spelling right, so you dont delete anything related to svchost ;))
     
    Jalf, Jan 5, 2007
    #8
  9. crappyGPU

    crappyGPU Notebook Consultant

    Reputations:
    102
    Messages:
    248
    Likes Received:
    0
    Trophy Points:
    30
    i had that one year ago on my desktop, too :))
    the funny thing is that scvhost would take 100% CPU usage until i terminate it, kind of annoying when you're playing something your fps drop to 1 (or crash) and you have to terminate a stupid thing to get back
     
    crappyGPU, Jan 5, 2007
    #9
  10. Tim

    Tim Notebook Virtuoso

    Reputations:
    2,752
    Messages:
    3,141
    Likes Received:
    2
    Trophy Points:
    106
    Yep that did the trick. Thank you Jalf. :D
    Tim
     
    Tim, Jan 5, 2007
    #10
  11. BENDER

    BENDER EX-NBR member :'(

    Reputations:
    641
    Messages:
    1,125
    Likes Received:
    0
    Trophy Points:
    55
    Yep definitely a virus. Follow the following directives to remove it
    http://www.delphifaq.com/faq/spyware_virus/f884.shtml

    ...and disconnect your lappy from the network. It is preventing other users from using the forum. Typical Denial Of Service attack. lol =p
     
    BENDER, Jan 5, 2007
    #11
  12. anubissx

    anubissx Notebook Consultant

    Reputations:
    53
    Messages:
    167
    Likes Received:
    0
    Trophy Points:
    30
    I recommend using ad-aware
    Lately I have been attacked by SCCVHost.exe but it can not get in my registry because of ad-aware.
    It will ask you if you agree for the SCCVHost to get in the registry, just answer Block and you be fine.
    Just my opinion, hope I post it in the right place
     
    anubissx, Jan 5, 2007
    #12