Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Svchost.exe Not Found In Registry


  • Please log in to reply
12 replies to this topic

#1 0.0vijay

0.0vijay

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 17 February 2008 - 01:36 AM

Hey, I just need someones help on what to do for fixing svchost.exe on my laptop.
I was just adjusting the transperancy of the windows with choas crystal, then after i needed to install avast since mcafee was expired, after rebooting, avast alerts me of viruses like perlovag and [MEW] in C:\ and D:\ with "copy.exe"
So I scheduled a boot-time to remove these with avast. I deleted one thing taht was infected by Trj "autorun.inf" and the rest were moved to chest. When the computer had loaded two message boxes poped up saying that "Windows cannot find C:\WINDOWS\svchost.exe" then the next box says that It could not load or run C:\WINDOWS\svchost.exe in specifed registry; to make sure it exists and remove reference to it in the registry. I have located where svchost.exe is but I don't know what to do.
So please and thanks for helping

BC AdBot (Login to Remove)

 


#2 0.0vijay

0.0vijay
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 18 February 2008 - 09:52 PM

Laptop is Acer Windowsxp sp2
Is it possible that someone could help with this?

#3 0.0vijay

0.0vijay
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 22 February 2008 - 03:13 AM

These are the messages that show when the laptop has turned on Posted Image

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 32,544 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 PM

Posted 22 February 2008 - 08:36 AM

Svchost.exe is a generic host process name for a group of services that are run from dynamic-link libraries (DLLs). It is not unusual for multiple instances of Svchost.exe running at the same time.

Determining whether a file is malware or a legitimate process sometimes depends on the location (path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file. However, it then places itself in a different location on your computer.

If svchost.exe is running as a startup (shows in msconfig), it can be bad as shown here and here. Make sure the spelling is correct. If it is scvhost.exe], then your dealing with a Trojan.

You can download and use Process Explorer or System Explorer to investigate all running processes and gather additional information to identify and resolve problems. These tools will show the process CPU usage, a description and its path location. If you right-click on the file in question and select properties, you will see more details about the file.

In your case, this file was added as a startup created by the Salga-A, or Perlovga virus.

The "Cannot find...", "Could not run..." or "Error loading..." message is usually related to a program (or malware) that was set to run at startup but has been deleted. Windows is trying to load this file but cannot locate it since the file was mostly likely removed during an anti-virus or anti-malware scan. However, an associated orphaned registry entry remains and is telling Windows to load the file when you boot up.

When Windows loads, it looks for any files associated with registry entries for programs that are set to run at startup. If the file was removed but not the registry entry, Windows will display an error message. You need to remove this registry entry so Windows stops searching for the file when it loads.

To resolve this, download Autoruns, search for the related entry and then delete it.
  • Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click here if your not sure how to do this.)
  • Open the folder and double-click on autoruns.exe to launch it.
  • Please be patient as it scans and populates the entries.
  • When done scanning, it will say Ready at the bottom.
  • Scroll through the list and look for a startup entry related to the file(s) in the error message.
  • Right-click on the entry and choose delete.
  • Reboot your computer and see if the startup error returns.
Then download and run the "PRT-Perlovga-Removal-Tool".

After doing that, download Flash_Disinfector.exe by sUBs and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that is plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.
Microsoft MVP - Consumer Security 2007-2014 MVP.gif

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#5 0.0vijay

0.0vijay
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 22 February 2008 - 03:46 PM

Thank you very much, i appreciate your help

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 32,544 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 PM

Posted 22 February 2008 - 06:10 PM

Your welcome. Any more signs of infection.
Microsoft MVP - Consumer Security 2007-2014 MVP.gif

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#7 0.0vijay

0.0vijay
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 22 February 2008 - 06:57 PM

Just when I start up their is an error message sound, but no problem running

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 32,544 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 PM

Posted 22 February 2008 - 10:23 PM

You will need to be more specific as to what you mean by error message sound? Is there an actual error message that is displayed? Are you hearing beeping noises?
Microsoft MVP - Consumer Security 2007-2014 MVP.gif

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#9 0.0vijay

0.0vijay
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 23 February 2008 - 01:48 AM

There is no error messaged displayed, but a sound as if there is an error message

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 32,544 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 PM

Posted 23 February 2008 - 11:41 AM

Then you need to describe the sound - beeping, popping, clicking, etc - and when exactly do you start to hear it.
Microsoft MVP - Consumer Security 2007-2014 MVP.gif

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#11 0.0vijay

0.0vijay
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 23 February 2008 - 05:00 PM

its about 5-8 seconds after start up and the windows theme sound, then two dings (du-do) sound Like as if a windows message popped up

Edited by 0.0vijay, 23 February 2008 - 05:05 PM.


#12 0.0vijay

0.0vijay
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:17 AM

Posted 24 February 2008 - 11:47 PM

perhaps its nothing, anyways thanks for your help

#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 32,544 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 PM

Posted 25 February 2008 - 08:30 AM

I have not heard complaints of such a sound as you describe so I'm not sure what it is. Maybe others reading this thread may reply with more feedback.
Microsoft MVP - Consumer Security 2007-2014 MVP.gif

Member of UNITE, Unified Network of Instructors and Trusted Eliminators




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users