How to Remove SCVHOST.EXE, SVCHOST.EXE Virus Manually

This are the following tips on how to remove the SCVHOST.EXE virus/worm. Firstly we must know what is SCVHOST.EXE is.

What is SCVHOST.EXE?

In some antivirus they are detected as W32/YahLover.Worm.gen from McAfee Antivirus and Win32/Autorun.R.worm from NOD32.

This virus will installs itself into your PC by using its INF file autorun.inf. The Autorun.inf file has an scripts that will trigger to execute the SCVHOST.EXE. Mostly in a removable disk is this occurred as you noticed that there is an Autoplay instead of Open. Once you double click the drive or removable disk, the autorun.inf run its scripts that this will trigger to execute the SCVHOST.EXE and spreading itself unto your system. It also copies itself through all your shared folders directories and on your computers throughout the network and run itself in the registry entries remotely using a GUEST account (through System:Remote).

Symptoms:

  • When pressing Ctrl+Alt+Del it blocks to launch the Task Manager
  • It blocks the Registry Editor.
  • When you try to go to the command prompt CMD, it will restarts the computer.
  • The shared folders will duplicates itself to different locations of. The duplicated virus uses a FOLDER icon with an .exe file extension. The configuration of your Yahoo Messenger has been changed.

How to Remove It

OK here we go, you must follow this step on how to remove this virus in manually method:

  • Restart your PC and press F8 and select the option Safe Mode Command Prompt Only
  • And after you log-in the command prompt you must log-in as Administrator.
  • Type cd C:\windows\system32
  • Type dir /ah, to display all hidden files on this directory folder. You will see the following files which is used by the virus to spread itself: AUTORUN.INI, BLASTCLNNN.EXE, and SCVHOST.EXE
  • Type ATTRIB -H -R -S SCVHOST.EXE
  • Type ATTRIB -H -R -S BLASTCLNNN.EXE
  • Type ATTRIB -H -R -S AUTORUN.INI
  • Type DEL SCVHOST.EXE
  • Type DEL BLASTCLNNNN.EXE
  • Type DEL AUTORUN.INI
  • Type CD\
  • Type ATTRIB -H -R -S AUTORUN.INF
  • Type DEL AUTORUN.INF

You are almost done, reboot your PC you may seat back and relax.. :) while loading...

Go Start Menu and click the Run and type the REGEDIT command. Take note guys before make any changes into your Registry Editor you must make a full back-up to your registry to avoid system errors. :)

Look the location entry:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, if you see an entry Yahoo! Messengger (it’s spelled like this) with a value c:\windows\system32\scvhost.exe, Delete this entry.

Look the location entry:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, in the entry named: SHELL, a value = Explorer.exe,SCVHOST.EXE. Edit this value, delete the SCVHOST.EXE only and the value must be Explorer.exe. Once you delete all this value, your computer will not login anymore.

OK we are now done.. Please Restart your PC now and Enjoy!!! Thank you and hope this tips will help for everyone..Just post your comments about this problem.

14 comments:

Anonymous said...

Thank you for this tips, I was crazy and annoying about this virus.. Thanks again for this, my PC was working ok right now..

Anonymous said...

Your solution hit the nail on the head. Thanxxx!

Anonymous said...

You are welcome dudes..

Unknown said...

hey thanks a lot but when i type ATTRIB -H -R -S SCVHOST.EXE it says can not find file

Anonymous said...

i'll try this but i have a great problem cause my cmd crashes every 5 sec

Anonymous said...

Hi,
Thanks for this tips. Could you also help me and others by giving similar guide to remove:
TROJ_RENOS.AJT
Infected file is: C:\Windows\Syatem32|Braviax.exe.
Thanks in advance for for your upcoming help.
RPK

Anonymous said...

How about those winlogon.exe i dont know how to remove it

Anonymous said...

I followed your instructions but the problem I am having is that my screen is completely blank, I cannot get to the start menu because it is not there and I cannot press the shortcut keys cause they don't work? I have the mouse pointer and it moves when I move the mouse but again, I have a blank screen. Can you help me?

I could get into the safe mode and command files but even in safe mode it goes blank!

Anonymous said...

Thanks for the tip...
nice....
i like this

Unknown said...

I have the the same problem as one of the anonymous users, I just have a blank screen when I boot up in safe mode. Is there anything I can do from there?

Anonymous said...

you can get your menu bar back by pressing ctrl+alt+del and then hit file > run and type explorer.exe. This should get your taskbar back if you open to a blank screen.

Wern Ching said...

i really need help. my CMD crashes every 5 sec. when i try to go to the command prompt CMD mode, my comp keeps restarting. how do i get rid of this problem? because im trying to remove that scvhost.exe virus too. thank you very much..

Anonymous said...

hi. is there a free anti-virus that can detect this virus and be removed when scanned? it would be easier specially for those who are not technically equipped w/ computers.

Anonymous said...

Someone please help! whenever i try to logon nothing happens and task manager is blocked. I go on safe mod everything is fine i ran into scvhost, and i think I have problembs with rundll32. what should i doo!!! When I tried your method the virus could not be found!