English | Deutsch


How to remove the svchosts virus


Most antivirus programs identify svchosts.exe as malware, e.g. Sophos identifies it as Mal/Resdro-A, and Microsoft identifies it as TrojanDownloader:Win32/Agent or Trojan:Win32/Matcash.
The free file information forum can help you find out how to remove it. If you know more about this file, please leave a comment or a hint for other users.

Click to Run a Free Virus Scan for the svchosts.exe malware


Svchosts.exe file information

The process known as Generic Host Process for Win32 Services or Ject.exe or Microsoft or Serv-U FTP Server

appears to be part of software COM+ Messages or Client IP-IPX or Ject or Ject.exe or Windows Update or VLTKMagic or PornCleanser or Projekt1

by Microsoft (www.microsoft.com) or Information Technology or Rhino Software (www.rhinosoft.com) (version +1(262) 560-9627) or L. F. Grundy Software Co or BIE.

Description: svchosts.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 36,864 bytes (85% of all occurrences), 32,768 bytes and 17 more variants. http://www.file.net/process/svchosts.exe.html 
It is not a Windows system file. There is no file information. The program is not visible. The file is an unknown file in the Windows folder. svchosts.exe is able to monitor applications. Therefore the technical security rating is 72% dangerous, however also read the users reviews.

Recommended: Identify svchosts.exe related errors

If svchosts.exe is located in the folder C:\Windows, the security rating is 76% dangerous. The file size is 84,481 bytes (25% of all occurrences), 360,448 bytes and 6 more variants. There is no file information. The program has no visible window. File svchosts.exe is located in the Windows folder, but it is not a Windows core file. The file is not a Windows core file. The application uses ports to connect to a LAN or the Internet.

If svchosts.exe is located in a subfolder of C:\Windows\System32, the security rating is 79% dangerous. The file size is 679,936 bytes (33% of all occurrences), 397,312 bytes, 132,096 bytes or 364,544 bytes. Program starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run). The file is not a Windows core file. svchosts.exe is able to manipulate other programs, monitor applications, record inputs and hide itself.
You could also remove the entire program NVIDIA Drivers using Windows Control Panel.

If svchosts.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 74% dangerous. The file size is 13,179,660 bytes (40% of all occurrences), 474,211 bytes, 108,544 bytes or 516,608 bytes.

If svchosts.exe is located in a subfolder of C:\Windows, the security rating is 81% dangerous. The file size is 769,536 bytes (25% of all occurrences), 32,768 bytes, 806,912 bytes or 2,109,440 bytes.

If svchosts.exe is located in a subfolder of "C:\Program Files", the security rating is 53% dangerous. The file size is 148,480 bytes (25% of all occurrences), 5,342,720 bytes, 156,354 bytes or 13,179,660 bytes.

If svchosts.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 100% dangerous. The file size is 86,016 bytes.

If svchosts.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 64% dangerous. The file size is 76,288 bytes.

If svchosts.exe is located in C:\, the security rating is 52% dangerous. The file size is 212,992 bytes.

External information from Paul Collins:
There are different files with the same name:

  • "Generic host proccess for windows" definitely not required. Added by an unidentified VIRUS, WORM or TROJAN!
  • "Internet Config" definitely not required. Added by the SDBOT TROJAN!
  • "Windows Services" definitely not required. Added by the AGOBOT-KL TROJAN!
  • "[random name]" definitely not required. Added by the SDBOT.N TROJAN!
  • "®Windows Update" definitely not required. Added by the FRUCTA TROJAN!

Important: Some malware camouflages itself as svchosts.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the svchosts.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.



Score

User Comments

dunno trying to remove no-beba-el-agua
   
Unlike svchost, the svchosts is malware related. It gathers info from your PC but I'm yet to see it generate traffic in- or outwards.
  Pierre  
From what ive heard this one with an "s" at the end is a threat/virus. The correct microsoft file generichost process is svchost with no "s" on the end.
  annep  
this file is a threat to your internet connection as it opens up loads of connection and clogs up your internet to the point it stops working - deleted and no problems
   
Seems to open communication port...... doesn't seem armfull but it is not a well intentioned program. It's installed from a MSN messenger update mail....
  Paulo  
I serached the text for "http" and this file has the websites http://www.vamper.com and http://www.giddiup.com - both of which are no good marketing sites - Definitely delete it or quarantine it.
  Tim  
it is dangerous process. my computer stopp ed opening sites
  ajmer singh mann  
its a keylogger
  Nick  
I opened the task manager and found five processes of svchosts.exe so i tried ending them. i was able to remove three before my computer activated an automatic system shut down.
  Shin  
They can sometime dominate most of my cpu power
  Beth  
in excel & word it appears and automatically written various things
  Mayur  
I loose this file and my windows keep asking for this file every time I turn on my pc
  Kwachii  
well annep is rite svchost is a windows file..... svchosts the trojan is usually present in pirated windows version
  ann  
It is a trojan that generate plenty of unwanted files to degrade computer performance, spread by remoable drive, eg: thumbdrive
  Chu Teik  
Rating chart


Summary: Average user rating of svchosts.exe: based on 13 votes with 14 reviews.
1 user think it's probably harmless. 1 user think it's neither essential nor dangerous. 3 users suspect danger. 8 users think svchosts.exe is dangerous and recommend removing it. 3 users doesn't grade svchosts.exe ("not sure about it").


Do you have additional information?
What do you know about svchosts.exe: 
How do you rate it: 
Link for more info's: 
Your Name: 


Svchosts scanner


Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

MalwareBytes detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.


Other processes


svchosts.exe [all]