DriverGuide
English Português Español Deutsch Français 中国 Italiano 日本語 Translate
  


DriverGuide Forums



Go Back   Free Drivers Download | Request and Support Forums > Operating System Forums > Windows XP

  #1  
Old 12-14-2004
Unregistered
 
Posts: n/a
Question XP cannot find c:\windows\system32\svohost.exe message

after scanning this hdd for virus, i attached the hdd back into its own pc
and upon restart, got the following message under the heading

"c:\windows\system32\svohost.exe"
'windows cannot find c:\windoes\system32\svohost.exe. make sure you type the name correctly and then try again. to search for a file....'

i did a search by typing 'svohost.exe' and it give me the following result.
-found in folder c:\windows\prefetch
svohost.exe-2FA3EB46.pf

when i go to msconfig, i found
1/ svchostx svchostx.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVer.
2/ svchost c:\WINDOWS\svchost....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVer.

whe i unchecked these 2 boxes, the message still remains upon restart.

i updated the windows but the message still appears. (i have many other
sotware programs in the pc and do not wish to re-install them.) i have the
Product Recvery CD. what must i do to stop the message fr appearing. your prompt advice is much appreciated. many thanks
Reply With Quote
Sponsored Links
    
  #2  
Old 12-14-2004
Santa
 
Posts: n/a
Default

[url]http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21113859.html[/url]
Reply With Quote
  #3  
Old 12-15-2004
Unregistered
 
Posts: n/a
Question

santa,

many thanks. i have been out of work for a long time now and unable to afford it. do i disbable system restore,rescan and put back the S.R.? Appreciate if you can help, many thanks
Reply With Quote
  #4  
Old 12-16-2004
Unregistered
 
Posts: n/a
Default

svohost.exe is a virus!
Virus name W32/Turta.A
Alias Turta, Win32.Turta.A, Win32/Turta.A, Win32/Mimail.Variant.Worm, I-Worm.Turta.a, Win32.Feat.A

Win32.Turta.A is a worm that spreads via e-mail. It arrives as an attachment to a message claiming to be information on the Sasser worm, with the spoofed sender address of [email]support@microsoft.com[/email]. It has been distributed as an 8,880-byte, FSG-packed, Win32 executable. Note: This threat is proactively detected as Win32/Mimail.Variant.Worm when using the InoculateIT engine.When executed, Turta.A copies itself to:
%System%\swchost.exe
%System%\svohost.exe

It modifies the registry to ensure that swchost.exe runs at each Windows start:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run \load32 = "%System%\swchost.exe"

It also changes system.ini on Win9x systems, so that the worm is executed when Explorer is launched:

[boot ]
shell=explorer.exe %System%\svohost.exe

Note: On Windows NT/2000/XP/2003 systems, this change is translated by the operating system to this registry entry:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe %System%\svohost.exe"
You will need to go into the registry and delete this entry!
Any good antivirus program should have caught this!
Reply With Quote
  #5  
Old 12-29-2004
Unregistered
 
Posts: n/a
Default

When I go to this registry;
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe %System%\svohost.exe"

When I highlighed the 'winlogon' on the left pane, there are many entries on the right pane. Among them is "shell' REG_SZ (under the type classification) and Explorer.exe (under data classification). I suppose I right click "shell" and delete it. Am I correct, please advice. Mnay thanks
Reply With Quote
  #6  
Old 03-26-2005
Unregistered
 
Posts: n/a
Default

Quote:
Originally Posted by Unregistered
after scanning this hdd for virus, i attached the hdd back into its own pc
and upon restart, got the following message under the heading

"c:\windows\system32\svohost.exe"
'windows cannot find c:\windoes\system32\svohost.exe. make sure you type the name correctly and then try again. to search for a file....'

i did a search by typing 'svohost.exe' and it give me the following result.
-found in folder c:\windows\prefetch
svohost.exe-2FA3EB46.pf

when i go to msconfig, i found
1/ svchostx svchostx.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVer.
2/ svchost c:\WINDOWS\svchost....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVer.

whe i unchecked these 2 boxes, the message still remains upon restart.

i updated the windows but the message still appears. (i have many other
sotware programs in the pc and do not wish to re-install them.) i have the
Product Recvery CD. what must i do to stop the message fr appearing. your prompt advice is much appreciated. many thanks

I have the same problem, and it seems there are virus in it (backdoor and worm) how can i replace the svchost.exe?where can i find it to download?
Reply With Quote
  #7  
Old 03-26-2005
Unregistered
 
Posts: n/a
Default

You must disable system restore, boot into safe mode and run your virus scan, reboot and see what happens! Go to the prefetch folder and delete all the files!
Reply With Quote
Reply [Upload Driver/Firmware]



Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Can't Find Program.exe Unregistered Windows 98 0 11-25-2004 02:43 AM
I Need help to find a Motherboard! I need a tip CPUs & Motherboards 2 10-01-2004 04:25 AM
help me find device driver thongyoi Audio & Multimedia 6 04-06-2004 06:00 PM
Help! My oldie comp has on-board audio and I cannot find the manufacurer or anything PeridoTCG Audio & Multimedia 3 03-17-2004 03:26 AM
dllhost.exe --> where can i find it?? Paul Windows 2000 1 11-14-2003 12:34 PM


All times are GMT. The time now is 04:03 PM.



2017 DriverGuide is an iCentric Corporation Company.     All rights reserved.    


Powered by vBulletin Version 3.0.1
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.