what this notice -->> C:\recycle\SVCHOST.EXE

[haikal]

what this notice -->> C:\recycled\SVCHOST.EXE

I need help about this notice after i started pc.... its show like this

" C:\recycled\SVCHOST.EXE ".. how can i fix n solve this problems.. pls help

 

[murdoch]

Run an anti virus check on your pc, followed my a programe such as ad-aware to delete offending item.

 

[haikal]

hello.. after i was scan my pc with AVG antivirus and notice me C:\recycled\SVCHOST.EXE after started windows.. its virus ? because AVG detact as virus...may someone help me

 

[murdoch]

Does AVG not delete it for you?

 

[V_R]

Go here, download, and run HJT. save a log file, then copy and paste the text in a new post here and we'll have a look.

 

[haikal]

notice --->> Windows cannot find "C:\recycled\SVCHOST.EXE"

hi there..please help me solve my problem... Windows cannot find "C:\recycled\SVCHOST.EXE" Make sure you typed the name correctly, and then try again.

After i download, and run HJT. save a log file and log file like this... i still can't solve my problem.. pls..TQ
-
Logfile of HijackThis v1.99.1
Scan saved at 11:24:40 AM, on 3/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\Fonts\*Explorer.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - Global Startup: BlueSoleil.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

 

[Tshidiso Medupe]

C:\recycle\svchost.exe

Hi,

The chances are you had a virus which was detected and deleted and the message C:\recycle\svchost.exe is one of the left overs of the virus references.

It is not detected by the antivirus or registry cleaners simply because the name "svchost.exe" is a valid operating system file and therefore is ignored by the tools. Here is how to remove it. I assume you are using windows

NB: You will need to remove the reference manually from the registry. But first export your copy of the registry for backup.

1. Click on Start run
2. type in regedit and cling on OK
3. Find the "C:\recycle\svchost.exe"
4. Delete its occurance and more so the one next to explorer key.

Tell me about your experience.

Your success is my concern.

Tshidiso Medupe

 

[JaLing]

Hi,

The chances are you had a virus which was detected and deleted and the message C:\recycle\svchost.exe is one of the left overs of the virus references.

It is not detected by the antivirus or registry cleaners simply because the name "svchost.exe" is a valid operating system file and therefore is ignored by the tools. Here is how to remove it. I assume you are using windows

NB: You will need to remove the reference manually from the registry. But first export your copy of the registry for backup.

1. Click on Start run
2. type in regedit and cling on OK
3. Find the "C:\recycle\svchost.exe"
4. Delete its occurance and more so the one next to explorer key.

Tell me about your experience.

Your success is my concern.

Tshidiso Medupe

Scary stuff this....
A full scan would scan this file and report if it's a virus or not.
Personally I wouldn't remove entries of this from the registry. SVCHOST is a binding process used to run all essiential components of windows... one mistake and bye bye windows.

Instead go to nortons online virus scan (link is on this site somewhere), once it reports what virus it is/was download the fix (from symantec... they got loads) and run it. It will remove/ repair the damage for you.

 

[Tshidiso Medupe]

True, that the SVChost.exe is an important file and in no way am I proposing that you delete the SVChost.exe file.

What I suggest you delete is explorer's reference to "C:\recycle\svchost.exe" which is no longer available in your computer (it could be that it was deleted by your antivirus); but its reference is invoked everytime explorer(windows) start up.

Virus writers use the same name that you know for the Operating System as this files might be ignored by other antivirus or spyware's due to their names, other antivirus trace the patterns and thereby detect and remove this files like it did in this instance but its reference is not removed and here you are just removing the reference. This has been tried, tested and it has proven to work; but this is in no way forcing solution. The choice is in your hands.

(You'll find that the occurance of the "C:\recycle\svchost.exe" is not as many as you might like to believe as the occurance of "svchost.exe" which is not to be deleted.

 

[matkellie1]

Problem with C:\Recycled\SVCHost.exe

Did u say C:\Recycled\SVCHost.exe


The message is caused normally by a string left by a virus variant W32/Rungbu-A which was cured or quarantined by an Anti Virus. To get rid of this, you need a bit of registry editing.

For beginners-Go to Run in start menu and type 'regedit' then enter. You will get the windows registry opened. Navigate to HKEY_CURRENT_USER and expand it. Now further expand it till you reach SOFTWARE > MICROSOFT > WINDOWS NT > CURRENT VERSION >EXPLORER > WINLOGON.

NB: In some case the >EXPLORER> case may not be available

Click on the WINLOGON key on the left pane and on the right pane you can see an entry named Shell.

Double click on it and a box appears with the Value of the String.

In the Value box you will see Explorer.exe C:\Recycled\Svchost.exe. Now carefully select the text starting from C:\Recycled\Svchost.exe and delete it. The value box should have only Explorer.exe.
Press OK.

Close the Registry Editor and restart your machine.
That should solve the problem.

 

[mr.raghav]

@ matkellie1

Thanks bro... I had same problem on our office PC (ofcourse I am using it for personal purposes )... Found this forum in Google search... My issue is solved...

Thanks again

Raghav

 

[matkellie1]

Svcost.exe

Thanks bro... I had same problem on our office PC (ofcourse I am using it for personal purposes )... Found this forum in Google search... My issue is solved...

Thanks again

Raghav

Hey Raghav, I'm glad this helped you. It's been years since I posted it. I'm now at www.openuganda.com
see u there then