Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: svchost.exe virus

31 Dec 2011   #1

Windows 7 Home Premium 64 Bit
svchost.exe virus

I have looked for numerous solutions to my problem but to no avail. My antivirus software had given me many warning of malicious URLs relating to the svchost.exe. I did not have any issues outside of those warning until the other day when I came back to my computer and got a blue screen.

I have run countless scans on AVG Free, Malwarebytes, and Avast Internet Security. AVG and Avast were not picking up on anything, but Malwarebytes said that the svchost.exe was a Trojan and that it would delete on reboot...after reboot however, it was still there.

From my understanding, svchost.exe is normally supposed to exist just in the C:\Windows\System32 folder, but I have another one in the C:\Windows folder that says it was created just a few days ago (as opposed to July 2009). There is something wrong with this svchost.exe in the Windows folder, but nothing seems to be getting rid of it.

I am a novice when it comes to computers, but would rather not have to resort to paying over a hundred dollars to fix this issue. Is there any way to rid myself of this virus manually?

(if this helps, I am running Windows 7 64bit on an HP Pavillion g6 series laptop)

My System SpecsSystem Spec

31 Dec 2011   #2

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro

What was the virus name/file that Malwarebytes identified it as? You can check the logs in MB to find it if you don't remember. I ask this since there are cleaners that target specific viruses. The name would be helpful.

Also, did you check the box next to the listed virus so that it would be quarantined? MB will not act if you do not check the box.

The other options for AV scanners are:


This link is for the portable version, you can d/l it & run it from a FD or CD.
Please note : The scanner is saved under a random filename so that malware infections won't block the scanner.
Norton Power Eraser

You will need an active net connection to run this tool.
Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully.
Another option is to use a Bootable AV disk. This will scan your system at startup and attempt to clean out the infections before they initialize. Probably your best bet if the others can't remove it since the infected svchost is in active use by the system and can't be removed unless it's inactive.

Note: Kaspersky has caused problems in the past, if they have remedied this, I do not know, but it may be wise to try one of the other disks first
My System SpecsSystem Spec
31 Dec 2011   #3

Windows 7 Home Premium 64 Bit

The file name that Malwarebytes gave me was "C:\Windows\svchost.exe". It said the file was a Trojan. On the majority of the times I did a scan, it only allowed me the option to Delete on Reboot, which I did at least 3 times. I believe one time it told me that it was quarantined and deleted successfully, but the file still hadn't moved anywhere.

I did a boot scan with Avast, which I believe is similar to the Bootable AV Disk you are suggesting. It ran a four-hour scan on my entire system before Windows started, but all it ended up doing was corrupting my Windows user file, and when I checked the C drive, svchost was still there.

Unfortunately I ended up sending the computer off to a local repair shop about an hour ago because I was out of all of the options that were available to me. Thank you for your help though.
My System SpecsSystem Spec

31 Dec 2011   #4

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro

Mostly when you get a file like that infected, one that actively runs when Windows is up and running, it's hard to get rid of it since it's in use by the system, something virus makers use to their advantage. If something like this happens down the road, give the above tools a try & consider running them in safe mode without a net connection. Viruses have a bad habit of calling for backup when you try to delete them.

Making a system image can prove invaluable when something like this happens. Here's a couple links you may find useful.

Backup Complete Computer - Create an Image Backup

System Repair Disc - Create

Another program you may wish to add to your arsenal is Rkill

RKill is a program that was developed at that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections.

Wishing you a safe & Happy New Year
My System SpecsSystem Spec
31 Dec 2011   #5

Windows 7 Home Premium 64 Bit

Thanks so much for the resources, and a happy new year to you too.
My System SpecsSystem Spec

 svchost.exe virus

Thread Tools

Similar help and support threads for2: svchost.exe virus
Thread Forum
Solved how to fix / clean windows from ramnit virus and virut virus? System Security
need help removing svchost.exe virus System Security
Want ideas for Virus removal if virus shows up in safemode CMD System Security
svchost.exe virus respawning BSOD Help and Support
Virus in Svchost System Security
svchost.exe virus? Performance & Maintenance
svchost virus System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:25 PM.
Twitter Facebook Google+

Windows 7 Forums

Seven Forums Android App Seven Forums IOS App

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33