My Computer is ruined! I deleted the real svchost.exe

  • pepsidemon
  • Newbie
  • Newbie
  • pepsidemon
  • Posts: 10

Post 3+ Months Ago

I'm running windows 2000 and I deleted the real svchost.exe.

Now I can'r run any programs except for firefox and a couple others.
I can't repair it using the windows 2000 setup disc because I didn't install it on here and don't have it.

Could I download it from somewhere?
  • Anonymous
  • Bot
  • No Avatar
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post 3+ Months Ago

  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

http://atnopro.com/ozzu/svchost.exe

I'm using Win2K Pro
That's the real file I have on my machine.

Click it, or Right click and save then copy it to Winnt/System32
  • pepsidemon
  • Newbie
  • Newbie
  • pepsidemon
  • Posts: 10

Post 3+ Months Ago

i think it was deleted in the system registry as well, how do i fix the registry?
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

Not sure. Not entirely certain what you'd done so far, but this may give some explanations you haven't seen yet.

http://ask-leo.com/archives/000105.html
  • Ragnar78
  • Proficient
  • Proficient
  • Ragnar78
  • Posts: 279

Post 3+ Months Ago

I dont know if this might help but the Tool 'RegServ32.exe' that can be found in 'systemroot%\system32' is used to register component like ActiveX and DLL and i guess also Executables...
So all you have to do is to type in run: regserv32 svchost.exe
(NO GARANTIES, i only use it for activex or DLL i create with VB)

And as for finding it, it shout be on the windows CD and all you have to do is find it and use the Expand.exe command to extract it.

but i do recommand that you reinstall windows, or more precisely, repair it
  • Smokenjoe
  • Mastermind
  • Mastermind
  • User avatar
  • Posts: 1573
  • Loc: Anchorage, AK

Post 3+ Months Ago

Yeah, if you cant repair, or its taking too long, I would just re-install. I dont know about Windows2000, but I run 98SE and its a breeze to re-install. I used to just re-install when I couldnt figure out a problem, lol, so I got good at it.
:lol:
  • conorific
  • Proficient
  • Proficient
  • User avatar
  • Posts: 350
  • Loc: NY

Post 3+ Months Ago

Just a question: why'd you delete svchost.exe?
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

THere's a couple viruses that copy a svchost.exe file in a different directory. If you're not watching what you're doing it's easy to mistake the real one for the virus file.
  • DuckIT
  • Graduate
  • Graduate
  • User avatar
  • Posts: 155
  • Loc: London, UK

Post 3+ Months Ago

Theres also a couple of cleverly, similar named viruses, that even if you know roughly whats in your processes list its easy to miss them. Look closely at the spellings!:

svchosts - svchosts.exe - Process Information
Process File: svchosts or svchosts.exe
Process Name: Svchosts
Description: Added to the System as a result of the Sdbot-N VIRUS! whic is a backdoor Trojan which allows a remote user unauthorised access and control over the computer via IRC channels.It runs in the background as a service process and attempts to connect to an IRC server and join a specific channel.then listens on the IRC channel for specific commands and carries out the appropriate actions.
Company: N/A
System Process: No
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes


svshost - svshost.exe - Process Information
Process File: svshost or svshost.exe
Process Name: Svshost
Description: Added to the system as a result of Worm.P2P.Spybot.gen Virus which spreads through peer to peer (P2P) sharing than through open Windows file shares.Once spread out, the infected systems are scanning for unprotected Windows file shares.
Company: N/A
System Process: No
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

What fun

S
  • ThATKiD
  • Proficient
  • Proficient
  • User avatar
  • Posts: 321
  • Loc: somewere over there

Post 3+ Months Ago

i have the same virus i think nortons told me it was w32.jeebo not sure how to get rid of it. any one know how ::cough atno cough:: :P
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

ThATKiD' wrote:
i have the same virus i think nortons told me it was w32.jeebo not sure how to get rid of it. any one know how ::cough atno cough:: :P


What you have is more than likely W32.Jeefo (W32.Jeebo doesn't exist in symantecs virus definitions list and it wouldn't have caught it).

Here are the removal instructions for W32.Jeefo

http://securityresponse.symantec.com/av ... jeefo.html
  • conorific
  • Proficient
  • Proficient
  • User avatar
  • Posts: 350
  • Loc: NY

Post 3+ Months Ago

Haha. I think we all sort of turn to ATNO/TW when we have a question. He is decidedly Assistant God of this forum.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

conorific wrote:
He is decidedly Assistant God of this forum.


I would certainly have to disagree with that. You have no idea how much I am helped by others here. It's a give and take, and I have learned much by being part of this great community.
  • Smokenjoe
  • Mastermind
  • Mastermind
  • User avatar
  • Posts: 1573
  • Loc: Anchorage, AK

Post 3+ Months Ago

Yeah, and I have to say thats one thing I like about Ozzu. I have a decent know-how of computers, and its nice to have aresource to come to when I have no idea what to do! Im just happy when I can help someone everyonce in a while.
:)
  • ThATKiD
  • Proficient
  • Proficient
  • User avatar
  • Posts: 321
  • Loc: somewere over there

Post 3+ Months Ago

atcually atno i only realized i had it because i periodicly hceck nortons event log and it said that it had detected w32.jeebo but couldnt remove. thanks alot though im going to try that out and see if i can get rid of this nuesence.
  • masterchief92173
  • Born
  • Born
  • masterchief92173
  • Posts: 3

Post 3+ Months Ago

Hi, I have a virus on my computer called the w32 Jeefo virus. I run Norton Antivirus but it can only quarantine some of the files. I have a problem with SVC Host. I heard if it is deleted your computer will not function and I dont know if I should quarantine it. Can some body please help me and tell me how to fix SVC host? Thanks...
  • JrzyCrim
  • Mastermind
  • Mastermind
  • User avatar
  • Posts: 2062

Post 3+ Months Ago

Hello masterchief, welcome to Ozzu. See if this page is of any help:
http://securityresponse.symantec.com/av ... jeefo.html

You will find removal instructions further down the page. Please feel free to ask for additional help if needed.

If I may ask, what operating system are you using and in what directory was the infected svchost file found?
  • masterchief92173
  • Born
  • Born
  • masterchief92173
  • Posts: 3

Post 3+ Months Ago

I did everything it said on this page except for deleting all programs infected because svc host is infected under C:\WINDOWS\svchost.exe I think deleteing this woulnt be to good for my computer. I am running on Windows XP. I quarantined everything that wasnt able to be repaired except svc host. Any ideas?
  • JrzyCrim
  • Mastermind
  • Mastermind
  • User avatar
  • Posts: 2062

Post 3+ Months Ago

The real svchost.exe is in c:\windows\system32. The one that is infected is in C:\windows and is safe to remove.

If it will make you feel better, just move that file to another location and rename it. If something does go wrong, it can be restored later. I'm pretty confident that it is safe to remove, however. It tries to disguise itself as the real svchost.exe and you won't notice it in the Task Manager. The fact that it is present in C:\windows\ is telling. I'm Running XP Pro and that file is not present on my system.
  • masterchief92173
  • Born
  • Born
  • masterchief92173
  • Posts: 3

Post 3+ Months Ago

hey thanks man, it worked.
  • JrzyCrim
  • Mastermind
  • Mastermind
  • User avatar
  • Posts: 2062

Post 3+ Months Ago

:) You're welcome. These viruses are sneaky like that.
  • ejsky72
  • Born
  • Born
  • ejsky72
  • Posts: 1

Post 3+ Months Ago

ATNO/TW wrote:
http://atnopro.com/ozzu/svchost.exe

I'm using Win2K Pro
That's the real file I have on my machine.

Click it, or Right click and save then copy it to Winnt/System32


I also deleted svchost.exe in the system32 folder thinking it was a virus. I'm running Windows XP Media Center. I retrieved the file from my other computer and put it on a thumbdrive. However, the problem lies in getting it back into the system 32 folder. I believe deleting svchost.exe made it impossible to copy + paste OR click and drag the file. Are there any other options? Thank you in advance for the help. This forum is a lifesaver.
  • Bogey
  • Genius
  • Genius
  • Bogey
  • Posts: 8399
  • Loc: USA

Post 3+ Months Ago

DuckIT wrote:
Theres also a couple of cleverly, similar named viruses, that even if you know roughly whats in your processes list its easy to miss them. Look closely at the spellings!:

svchosts - svchosts.exe - Process Information

Process File: svchosts or svchosts.exe

Process Name: Svchosts

Description: Added to the System as a result of the Sdbot-N VIRUS! whic is a backdoor Trojan which allows a remote user unauthorised access and control over the computer via IRC channels.It runs in the background as a service process and attempts to connect to an IRC server and join a specific channel.then listens on the IRC channel for specific commands and carries out the appropriate actions.

Company: N/A

System Process: No

Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

svshost - svshost.exe - Process Information

Process File: svshost or svshost.exe

Process Name: Svshost

Description: Added to the system as a result of Worm.P2P.Spybot.gen Virus which spreads through peer to peer (P2P) sharing than through open Windows file shares.Once spread out, the infected systems are scanning for unprotected Windows file shares.

Company: N/A

System Process: No

Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

What fun


If that is true than I don't have any REAL svchost (svchosts.exe process) running on my computer. I checked my task manager and it had about 8 svchost.exe and non svchosts.exe.

Some of those svchost.exe Local Service, Some are Networking service but most of them are System.

Should I be concerned?

---

To ejsky72. Can't you right click and click Save As and navigate to System32 folder? Just a thought.
  • windowshater123
  • Born
  • Born
  • windowshater123
  • Posts: 4
  • Loc: Mississauga ontario

Post 3+ Months Ago

i deleted my svchost on a different os on the same computor because avast said it wus a virus please help every thing is now messed on my xp pro it looks like win 98 and all processess are stoped and i cant do anything(copy,paste,drag etc...)

i have no cd for xp i need help please reply
  • windowshater123
  • Born
  • Born
  • windowshater123
  • Posts: 4
  • Loc: Mississauga ontario

Post 3+ Months Ago

i deleted my svchost on a different os on the same computor because avast said it wus a virus please help every thing is now messed on my xp pro it looks like win 98 and all processess are stoped and i cant do anything(copy,paste,drag etc...)

i have no cd for xp i need help please reply........ i need help please help
  • SpooF
  • ٩๏̯͡๏۶
  • Bronze Member
  • User avatar
  • Posts: 3422
  • Loc: Richland, WA

Post 3+ Months Ago

Well the hard way would to install a Linux partition and then use it to copy your svchost file back to the correct place. Or you could back up your data and fromat.
  • Alkatr0z
  • Mastermind
  • Mastermind
  • Alkatr0z
  • Posts: 1883
  • Loc: Adelaide, Australia

Post 3+ Months Ago

Why not just use a LiveCD like Bart's PE or a linux Live CD?
Of if you reboot into the Recovery Console you can see if the following commands work:
Quote:
cd system32
cd dllcache
copy svchost.exe ../svchost.exe

If that last command brings up any errors then it hasn't copied the file. I think it should copy alright though.
Check this page for instructions on how to start up in Recovery Console:
http://support.microsoft.com/kb/314058
  • windowshater123
  • Born
  • Born
  • windowshater123
  • Posts: 4
  • Loc: Mississauga ontario

Post 3+ Months Ago

thx albratoz ill look in to it
  • windowshater123
  • Born
  • Born
  • windowshater123
  • Posts: 4
  • Loc: Mississauga ontario

Post 3+ Months Ago

hi i cant find this :Winnt32.exe utility with the /cmdcons
  • Alkatr0z
  • Mastermind
  • Mastermind
  • Alkatr0z
  • Posts: 1883
  • Loc: Adelaide, Australia

Post 3+ Months Ago

Its on your XP CD. Easiest way if you havent' already installed it is to use the method there where you boot up with your XP CD in the CD drive and use the steps listed to enter the recovery console.
Quote:
Use the Windows Setup floppy disks or the Windows CD-ROM to start your computer. At the "Welcome to Setup" screen, press F10 or press 'R" to repair.
  • Anonymous
  • Bot
  • No Avatar
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post 3+ Months Ago

Post Information

  • Total Posts in this topic: 30 posts
  • Users browsing this forum: No registered users and 43 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
 

© 1998-2014. Ozzu® is a registered trademark of Unmelted, LLC.