hi all,
i had some worm problems: scvhost.exe
to remove do the following:
Overview
Scvhost.worm spreads over Windows network shares. The worm's main file is called scvhost.exe, trying to mimic the legitimate svchost.exe file is located in %SystemDir%. Note: Do not delete %SystemDir%\svchost.exe.
Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Classification
Worm
Files
scvhost.exe
Log references
Log 283
Detection
Bazooka Adware and Spyware Scanner detects Scvhost.worm. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms, etc. Read more »
Manual removal
Please follow the instructions below if you would like to remove Scvhost.worm manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If Scvhost.worm remains on your system after stepping through the removal instructions, please double-check by stepping through them again.
Start your computer in safe mode.
Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
Browse to the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
In the right pane, delete the value called 'Config Loader', if it exists.
Browse to the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunServices'
In the right pane, delete the value called 'Config Loader', if it exists.
Exit the registry editor.
Restart your computer.
Start Windows Explorer and delete:
%SystemDir%\scvhost.exe
Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
for more information go to:
http://www.kephyr.com/spywarescanner/library/scvhost.worm/index.phtml
i had some worm problems: scvhost.exe
to remove do the following:
Overview
Scvhost.worm spreads over Windows network shares. The worm's main file is called scvhost.exe, trying to mimic the legitimate svchost.exe file is located in %SystemDir%. Note: Do not delete %SystemDir%\svchost.exe.
Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Classification
Worm
Files
scvhost.exe
Log references
Log 283
Detection
Bazooka Adware and Spyware Scanner detects Scvhost.worm. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms, etc. Read more »
Manual removal
Please follow the instructions below if you would like to remove Scvhost.worm manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If Scvhost.worm remains on your system after stepping through the removal instructions, please double-check by stepping through them again.
Start your computer in safe mode.
Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
Browse to the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
In the right pane, delete the value called 'Config Loader', if it exists.
Browse to the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunServices'
In the right pane, delete the value called 'Config Loader', if it exists.
Exit the registry editor.
Restart your computer.
Start Windows Explorer and delete:
%SystemDir%\scvhost.exe
Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
for more information go to:
http://www.kephyr.com/spywarescanner/library/scvhost.worm/index.phtml
