Member Avatar for mexemexe

I had the svchost.exe virus detected by AVG and me being so smart :rolleyes: just went and used regedit to get rid of it. We'll I got rid of it alright but now I can't even see or setup any network conections. Just wondering if reinstalling is my only opption? I'm using XP on that destop!


Thank-you in advance!

Bertomexe

  • 3 Contributors
  • 2 Replies
  • 291 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by Catweazle

Dani AI

Generated

Quick summary and what likely happened: svchost.exe is a legitimate Windows host process that runs many services — removing its service registry keys or the real executable will break networking and other system services. If AVG found a malicious file that looked like svchost, check AVG’s Virus Vault (quarantine) first — legitimate svchost.exe lives in %SystemRoot%\System32, and the quarantined item can usually be restored if it was a false positive. (learn.microsoft.com)

Fast checks (do these first)

  • Look for C:\Windows\System32\svchost.exe.
  • Open AVG and restore any quarantined svchost/related files.
  • Try Last Known Good Configuration (press F8 at boot) and then System Restore from Safe Mode (Start -> All Programs -> Accessories -> System Tools -> System Restore) if restore points exist.
  • Run these from an elevated command prompt or Recovery Console as appropriate:
    chkdsk /r
sfc /scannow

    System Restore/Recovery Console methods are standard fixes for a registry/service-hive problem. (learn.microsoft.com)

If you cannot boot / restore
Boot the XP CD and choose Recovery Console (press R). back up the current hives, then replace them from the repair copy or System Restore temporary copies. Example Recovery Console sequence (adapt if Windows is on a different drive):

md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
( repeat for SOFTWARE, SAM, SECURITY, DEFAULT )
del c:\windows\system32\config\system
copy c:\windows\repair\system c:\windows\system32\config\system
( repeat for SOFTWARE, SAM, SECURITY, DEFAULT )
exit

This is the documented manual registry-recovery approach; it can recover a system ruined by deleted service keys. (pchell.com)

If that still fails
An in-place repair (repair install) reinstalls Windows system files and rebuilds service registrations while keeping programs and data — you’ll need the original XP media and should back up personal files first. This is the next step if registry hives or service entries are irretrievably damaged. (hlab.stanford.edu)

Notes and cautions

  • If you exported a .reg before editing, import it instead (double-click the .reg file).
  • Recovery Console and registry copying have risks (OEM installs and some restore options can cause login issues); back up data before attempting repair steps. (learn.microsoft.com)

Relevant posts: — the problem sounds like deleted service entries; was right to mention System Restore but only if restore points exist; ’s repair-install suggestion is valid when other recovery steps fail.

Recommended Answers

All 2 Replies

Member Avatar for BountyX

u cant get rid of svchost, thats an important part of window's network abilities! Its a generic host process...don't worry use the system rollback option and go to the last check point. This time use Trend Micros scan online, they will get rid of it for you.

Member Avatar for Catweazle

heh heh...

If you've got 'System Restore' disabled on that system, just do an 'In-Place Upgrade'.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.