How to remove the svchosts virus

Most antivirus programs identify svchosts.exe as malware, e.g. Sophos identifies it as Mal/Resdro-A, and Microsoft identifies it as TrojanDownloader:Win32/Agent or Trojan:Win32/Matcash.
The free file information forum can help you find out how to remove it. If you know more about this file, please leave a comment or a hint for other users.

Click to Run a Free Virus Scan for the svchosts.exe malware

Svchosts.exe file information

The process known as Generic Host Process for Win32 Services or Ject.exe or Microsoft or Serv-U FTP Server

appears to be part of software COM+ Messages or Client IP-IPX or Ject or Ject.exe or Windows Update or VLTKMagic or PornCleanser or Projekt1

by Microsoft (www.microsoft.com) or Information Technology or Rhino Software (www.rhinosoft.com) (version +1(262) 560-9627) or L. F. Grundy Software Co or BIE.

Description: svchosts.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 36,864 bytes (85% of all occurrences), 32,768 bytes and 17 more variants.
It is not a Windows system file. There is no file information. The program is not visible. The file is an unknown file in the Windows folder. svchosts.exe is able to monitor applications. Therefore the technical security rating is 72% dangerous, however also read the users reviews.

Recommended: Identify svchosts.exe related errors

If svchosts.exe is located in the folder C:\Windows, the security rating is 76% dangerous. The file size is 84,481 bytes (25% of all occurrences), 360,448 bytes and 6 more variants. There is no file information. The program has no visible window. File svchosts.exe is located in the Windows folder, but it is not a Windows core file. The file is not a Windows core file. The application uses ports to connect to a LAN or the Internet.

If svchosts.exe is located in a subfolder of C:\Windows\System32, the security rating is 79% dangerous. The file size is 679,936 bytes (33% of all occurrences), 397,312 bytes, 132,096 bytes or 364,544 bytes. Program starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run). The file is not a Windows core file. svchosts.exe is able to manipulate other programs, monitor applications, record inputs and hide itself.
You could also remove the entire program NVIDIA Drivers using Windows Control Panel.

If svchosts.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 74% dangerous. The file size is 13,179,660 bytes (40% of all occurrences), 474,211 bytes, 108,544 bytes or 516,608 bytes.

If svchosts.exe is located in a subfolder of C:\Windows, the security rating is 81% dangerous. The file size is 769,536 bytes (25% of all occurrences), 32,768 bytes, 806,912 bytes or 2,109,440 bytes.

If svchosts.exe is located in a subfolder of "C:\Program Files", the security rating is 53% dangerous. The file size is 148,480 bytes (25% of all occurrences), 5,342,720 bytes, 156,354 bytes or 13,179,660 bytes.

If svchosts.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 100% dangerous. The file size is 86,016 bytes.

If svchosts.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 64% dangerous. The file size is 76,288 bytes.

If svchosts.exe is located in C:\, the security rating is 52% dangerous. The file size is 212,992 bytes.

External information from Paul Collins:
There are different files with the same name:

"Generic host proccess for windows" definitely not required. Added by an unidentified VIRUS, WORM or TROJAN!
"Internet Config" definitely not required. Added by the SDBOT TROJAN!
"Windows Services" definitely not required. Added by the AGOBOT-KL TROJAN!
"[random name]" definitely not required. Added by the SDBOT.N TROJAN!
"®Windows Update" definitely not required. Added by the FRUCTA TROJAN!

Important: Some malware camouflages itself as svchosts.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the svchosts.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.

Score

User Comments

dunno trying to remove no-beba-el-agua

Unlike svchost, the svchosts is malware related. It gathers info from your PC but I'm yet to see it generate traffic in- or outwards.
Pierre

From what ive heard this one with an "s" at the end is a threat/virus. The correct microsoft file generichost process is svchost with no "s" on the end.
annep

this file is a threat to your internet connection as it opens up loads of connection and clogs up your internet to the point it stops working - deleted and no problems

Seems to open communication port...... doesn't seem armfull but it is not a well intentioned program. It's installed from a MSN messenger update mail....
Paulo

I serached the text for "http" and this file has the websites http://www.vamper.com and http://www.giddiup.com - both of which are no good marketing sites - Definitely delete it or quarantine it.
Tim

it is dangerous process. my computer stopp ed opening sites
ajmer singh mann

its a keylogger
Nick

I opened the task manager and found five processes of svchosts.exe so i tried ending them. i was able to remove three before my computer activated an automatic system shut down.
Shin

They can sometime dominate most of my cpu power
Beth

in excel & word it appears and automatically written various things
Mayur

I loose this file and my windows keep asking for this file every time I turn on my pc
Kwachii

well annep is rite svchost is a windows file..... svchosts the trojan is usually present in pirated windows version
ann

It is a trojan that generate plenty of unwanted files to degrade computer performance, spread by remoable drive, eg: thumbdrive
Chu Teik

Summary: Average user rating of svchosts.exe: based on 13 votes with 14 reviews.

1 user think it's probably harmless. 1 user think it's neither essential nor dangerous. 3 users suspect danger. 8 users think svchosts.exe is dangerous and recommend removing it. 3 users doesn't grade svchosts.exe ("not sure about it").

Svchosts scanner

Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

MalwareBytes detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.

Other processes