How to remove the svchost process windows 7. Removing the svchost exe virus from the Windows system. Why do you see too many processes of the same name in the Task Manager?

Threat name

Name executable file:

Threat type:

Affected OS:

Trojan Svchost

hlhtxo.exe

Spyware/Trojan

Win32 (Windows XP, Windows Vista, Windows Seven, Windows 8)



Trojan Svchost infection method

Trojan Svchost copies its file(s) to yours HDD. Typical file name hlhtxo.exe. Then it creates a startup key in the registry with the name Trojan Svchost and meaning hlhtxo.exe. You can also find it in the process list with the name hlhtxo.exe or Trojan Svchost.

If you have additional questions regarding Trojan Svchost, please fill out and we will contact you shortly.


Download the removal utility

Download this program and remove Trojan Svchost and hlhtxo.exe (download will start automatically):

* SpyHunter was developed by the American company EnigmaSoftware and is capable of removing Trojan Svchost in automatic mode. The program was tested on Windows XP, Windows Vista, Windows 7 and Windows 8.

Functions

The program is able to protect files and settings from malicious code.

The program can fix browser problems and protects browser settings.

Removal is guaranteed - if SpyHunter fails, free support is provided.

24/7 anti-virus support is included in the package.


Download the Trojan Svchost removal utility from the Russian company Security Stronghold

If you are not sure which files to delete, use our program Trojan Svchost removal utility.. Trojan Svchost removal tool will find and completely remove Trojan Svchost and all problems associated with the Trojan Svchost virus. A fast, easy-to-use Trojan Svchost removal tool will protect your computer from the Trojan Svchost threat that harms your computer and violates your privacy. Trojan Svchost removal tool scans your hard disks and registry and removes any manifestation of Trojan Svchost. Regular antivirus software is powerless against malicious programs such as Trojan Svchost. Download this simplified removal tool specifically designed to solve problems with Trojan Svchost and hlhtxo.exe (the download will start automatically):

Functions

Removes all files created by Trojan Svchost.

Removes all registry entries created by Trojan Svchost.

The program can fix browser problems.

Immunizes the system.

Removal is guaranteed - if the Utility fails, free support is provided.

24/7 antivirus support via GoToAssist is included in the package.

Our support team is ready to solve your problem with Trojan Svchost and remove Trojan Svchost right now!

Leave detailed description your problem with Trojan Svchost in the section. Our support team will contact you and provide you with step by step solution Trojan Svchost problems. Please describe your problem as accurately as possible. This will help us provide you with the most effective method Trojan Svchost removal.

How to remove Trojan Svchost manually

This problem can be resolved manually by deleting registry keys and files associated with Trojan Svchost, removing it from the startup list and de-registering all related DLLs files. In addition, missing DLL files must be restored from the OS distribution if they were damaged Trojan Svchost.

In order to get rid of Trojan Svchost, You need:

1. Terminate the following processes and delete the corresponding files:

Warning: you need to delete only files whose checksums are in the list of malicious ones. Your system may have necessary files with the same names. We recommend using this to solve the problem safely.

2. Delete the following folders:

3. Delete the following registry keys and/or values:

Warning: If registry key values ​​are specified, you should delete only the specified values ​​and leave the keys themselves intact. We recommend using this to solve the problem safely.

4. Reset browser settings

Trojan Svchost can sometimes affect your browser settings, such as changing search and home page. We recommend that you use free feature"Reset browser settings" in "Tools" in the program to reset all browsers at once. Please note that before this you need to delete all files, folders and registry keys belonging to Trojan Svchost. To reset browser settings manually, use these instructions:

For Internet Explorer

    If you are using Windows XP, click Start, And Open. Enter the following in the field Open without quotes and press Enter: "inetcpl.cpl".

    If you are using Windows 7 or Windows Vista, click Start. Enter the following in the field Search without quotes and press Enter: "inetcpl.cpl".

    Select a tab Additionally

    Under Reset settings Internet browser Explorer, click Reset. And press Reset again in the window that opens.

    Select checkbox Remove personal settings to delete history, restore search and home page.

    After Internet Explorer has completed the reset, click Close in the dialog box.

Warning: Reset browser settings V Tools

For Google Chrome

    Find the folder Google installations Chrome at: C:\Users\"username"\AppData\Local\Google\Chrome\Application\User Data.

    In folder User Data, find the file Default and rename it to DefaultBackup.

    Launch Google Chrome and it will be created new file Default.

    Google Chrome settings reset

Warning: In case this doesn't work use free option Reset browser settings V Tools in the Stronghold AntiMalware program.

For Mozilla Firefox

    Open Firefox

    From the menu, select Help > Problem Solving Information.

    Click the button Reset Firefox.

    After Firefox finishes, it will show a window and create a folder on your desktop. Click Complete.

Warning: This way you will lose your passwords! We recommend using the free option Reset browser settings V Tools in the Stronghold AntiMalware program.

Detailed guide to removing the svchost.exe virus.

Navigation

Users desktop computers or laptops that from time to time suffer from a sharp decrease in the performance of their devices and freezing operating system Windows 7, trying to solve this problem disabling unnecessary processes. When they launch Task Manager, they find an incredible number of active processes. svchost.exe, which devour all processor resources, clog RAM and thereby significantly reduce the performance of the device.

Most users have no idea how to get out of this unpleasant situation and therefore resort to the most radical measures. We will try to tell you in as much detail as possible about how to permanently solve the problem with the consumption of computer resources by a virus. svchost.exe and restore it to its former performance.

  • Svchost.exe is considered an important executable file that initiates the launch of a number of vital services and functions for the operating system, and also allows you to run user installed applications, programs and games. Standard system process does not cause any damage to the computer, does not load the processor and RAM and is available in " Task Manager» several active processes svchost.exe not yet a reason to panic. This is done by viruses that have penetrated the device and take the form svchost.exe, and thereby complicate the process of their removal.
  • File svchost.exe located in the partition of the disk on which the operating system was installed, in the folder /Windows/System32, while malware that takes on its guise is often located in the “ Windows», « Program Files" And " Documents and Settings" In addition, viruses are often embedded in system folders " drivers», « config», « system" and others.

Official process svchost.exe can only be run as SYSTEM, LOCAL SERVICE or NETWORK SERVICE. In order to determine on whose behalf the process was launched, do the following:

  • Step 1. Click right click mouse over the free space on the taskbar and in the window that opens, select the line “ Launch Task Manager", or press the combination of buttons on the keyboard at the same time Ctrl + Shift + Esc.

  • Step 2. In the window that appears, go to the section “ Processes"and for convenience, sort the processes by name. Find processes " svchost.exe"and look carefully on behalf of which user or service they were activated. If opposite the process is your name account, then you clearly have a virus program in front of your eyes, which prevents the operating system from functioning correctly.

How to neutralize the svchost.exe virus using standard tools in the Windows 7 operating system?

If you find among your processes malware, disguised as svchost.exe, then you can try to get rid of it using standard operating system tools Windows 7. To do this, do the following:

  • Step 1. The first step is to disable the service that causes the virus to activate. Open " Task Manager" and find the malicious process in the list svchost.exe. Right-click on it and in the window that appears, select the line “ Go to services».

Figure 1. How to neutralize the svchost.exe virus using standard operating system tools Windows systems 7?

  • Step 2. In the window that opens, the services that enable the malicious software will be highlighted. software. You need to remember their names, and then open “ Control Panel" and go to the section " Administration».

  • Step 3. In chapter " Administration"you need to go to the tab " Services"and among full list find by name those that activate the virus. In the column " Startup type» set the state « Disable" for each of the services, then click the buttons " Apply" And " OK».

  • Step 4. Now go back to " Task Manager", right-click on the malicious process and select the line " End the process" After these steps and restarting the computer, the virus will no longer be activated. However, it will still remain on the computer. In order to completely remove it, you need to resort to third-party software.

Preventing the virus from starting by disabling operating system services is only a temporary measure. Even if you manage to find a program infected with a virus and remove it, the system will still contain files created by this program, which are also infected. To get rid of them, you need to resort to the help of specialized programs.

Unfortunately, most modern free antivirus programs are ineffective, and some people simply may not have the money for paid ones. However, there is a free utility " Dr. Web CureIt ", which performs a deep scan of the disk, scans files for viruses and successfully “cures” them. You can download it from official website manufacturer according to this link. To get rid of the virus svchost.exe Using this utility, do the following:

  • Step 1. Program " Dr.Web CureIt"does not require installation, so just download it from official website and run it. Next, open on your computer “ Task Manager" and find the malicious process. Right-click on it and select the line “ Open file storage location».

  • Step 2. The folder containing the virus-infected file will open. At the top of the window you can see the exact address of its location. Remember this address and switch to the window with the utility.

  • Step 3. Since the program may miss some infected files during a full scan, it is best to scan the computer in separate directories. We should start with the one in which our infected file is located. To do this, on the main screen of the program, click on the button “ Select objects to scan».

  • Step 4. In the window that opens, standard directories for scanning will appear, including RAM, the Windows root directory, documents and much more. You must click on the " Click to select files and folders", manually find the directory with the infected file, mark it with a checkmark and press the button " OK».

  • Step 5. After selecting the directory, click the " Run scan" and wait for the process to complete. If the utility cannot “cure” virus-infected files, it will automatically send them to quarantine. After a spot check of directories, you can perform a full scan of your computer. It is recommended to check your computer with this program at least once a week. " Dr. Web CureIt» is constantly improving and updating virus databases. Therefore, with each update you will have to download the program again from official website .

IMPORTANT: The processes and services depicted in the screenshots are not viral and are taken as an example only. Do not under any circumstances delete or disable them on your computer!

VIDEO: svchost loads the processor. Solution

Users of the seventh modification of Windows very often encounter a problem when a certain Windows process 7 Svchost.exe loads the processor. The solution to fix the problem, as it turns out, lies on the surface. However, in order to determine exactly what technique to use to correct the situation, you first need to understand what it is this process and related service components, since disabling some of them can provoke not only incorrect operation OS, but also the appearance of more unpleasant symptoms (even blue screen is not excluded).

Svchost: what is this process?

Since problems with increased load by this service are most often observed in Windows 7, and are almost never encountered in systems of later releases, when considering all aspects we will start from the seventh modification.

What kind of component is this that it consumes such an incredible amount? system resources? This is a specialized tool for launching system and user programs, which, according to developers from Microsoft, should, in theory, reduce the load on the system when launching programs and their executable components, for example, presented in the form dynamic libraries, loaded at the start of the executable component as additional objects into RAM.

To put it in simpler and more understandable terms, in Windows 7 the system itself does not need to run each application as a separate process, since for this only one main component is used, due to which all programs start, being, as it were, tied to it. And the Svchost process is a kind of intermediary bridge between the launched program and the main system component responsible for its start. That is, all starting programs and processes through this component are connected to a single launch service.

Why do I see too many processes of the same name in the Task Manager?

But the main start service is not displayed in the same “Task Manager”. In it you can see just the Svchost processes of the same name, which in normal condition inaction can be about four, and in the presence of working programs - even more.

Thus, if Svchost loads the processor and memory, Windows 7 simply this moment handles too many active background (system) and user applications. But many of them can be quite resource-intensive (take at least AutoCAD or programs for real-time video processing). In such situations, usually in Windows 7 Svchost loads the processor by 50% (maybe a little more). If peak loads are noticed, when the operating system freezes and stops responding to any user actions, you will have to find out the reasons why this is happening.

Windows 7: Svchost loads the processor at 100%. Why?

As for the reasons themselves, there can be quite a lot of them, and such situations cannot always be provoked by system failures (although, unfortunately, they cannot be avoided).

But let's return to the situation when in Windows 7 Svchost.exe loads the processor too much. The most likely reasons for this phenomenon are the following:

  • short-term failures of system processes;
  • viral infection;
  • problems with the system update service;
  • too many or failures of related services and system components;
  • incorrect operation of the tunnel adapter;
  • problems with the SuperFetch component;
  • a large amount of computer garbage.

The list shows only the main aspects, which will be discussed further. And for situations where in Windows 7 Svchost.exe loads the processor, a solution for each specific case will be proposed precisely based on what was the root cause of such an unpleasant situation. But first things first.

Windows 7: Svchost (netsvcs) loads the processor: a solution to quickly reduce the load

Many users quite rightly believe that the simplest way to reduce the load is by ending all Svchost processes in the Task Manager. Yes, indeed, this can be done. But in this case, this is just a temporary measure (and in the presence of viruses, it does not help at all).

The same applies to a regular reboot of the operating system. After the restart, of course, there will be no increased resource consumption, but the process itself in the form of four (at least) executable files will still be present in the Task Manager. This system component It boots up with the system automatically, and it is impossible to disable it using standard methods, say, using the startup menu.

Checking the system for viruses

But there are worse situations. Suppose in Windows 7 Svchost loads the processor. What to do if the user sees a dozen and a half lines in the “Task Manager” with a link to the same executable file, and the CPU load reaches its maximum peak values?

Apparently, this is the first sign of a virus attack, since many threats are disguised as just a system process and are capable of simultaneously launching several copies of themselves. This will require manual user intervention by launching some powerful portable utility to deeply scan your computer for viruses.

It is best to use a Dr. scanner. Web CureIt!, but the best option will boot from removable media with the Kaspersky Rescue Disk utility recorded on it. This program is the undisputed leader, since it starts even before the OS boots and can identify and neutralize threats that are deeply embedded not only in the operating system, but also in RAM.

You can determine that the selected process is a virus threat using the additional username attribute. There can only be two of them: either NETWORK SERVICE or LOCAL. If the user observes any other description, the conclusion is obvious: this is a virus disguised as the original process. Basically, before using antivirus utilities, you can use RMB to access the directory where the accompanying process file is located and, if possible, delete it manually.

Troubleshooting system update problems

But viruses are not always the reason why Svchost (netsvcs) loads the processor in Windows 7. Very often this is due to failures of the offline update installer (“Update Center”).

For example, some package was under-downloaded during download. So it turns out that the system service is trying to load it (at the same time the Svchost process corresponding to it is launched), but there is no result. On the other hand, the Update Center itself may, for some reason, not work correctly. It may require a restart.

In this case, the services section (services.msc) is first called, in which you need to find the corresponding component, enter the editing section, stop the service and set its startup type to disabled. After this, the system needs to be rebooted and the service reactivated with an automatic start type.

Disable or stop related services

If none of the suggestions helped, and in Windows 7 Svchost loads the processor, the solution may come down to looking at exactly which processes are associated with the executable file and, if possible, disabling them.

To do this, use the same “Task Manager”, in which, through RMB on each process, you need to look at the corresponding service, go to the main section and temporarily disable all processes, as was shown just above.

Fixing tunnel adapter problems

Not often, but sometimes there can be non-standard situations related to the operation of the so-called It is because of its incorrect operation in Windows 7 that Svchost loads the processor. The solution is to adjust its parameters or even turn it off completely.

To do this, it is best to use the command console, called through the “Run” menu cmd command. Next, the lines shown in the image above are written in the console, and after they are executed, a complete reboot is performed computer system.

from garbage

There are more simple problem, but just as intrusive. If in Windows 7 Svchost loads the processor, the solution may have something to do with computer garbage, for example, in terms of the lack of free disk space for the normal functioning of the operating system itself (usually in system partition It is recommended to keep approximately 10% of the total volume free).

First you can do a disk cleanup standard tool, if you access the partition properties through the RMB menu in Explorer. On the other hand, some residual files after uninstalling programs are not deleted in this way. But finding them yourself is quite problematic. Alternatively, you can use special cleaning programs or optimizers (CCleaner, Advanced System Care, Glary Utilities or something similar).

SuperFetch problems

Many experts call problems with the SuperFetch service another of the most common situations. To disable it, you can use the methods suggested above by entering the services section, stopping the process and changing the startup type.

However, most often the problem is not even this, but the overflow of the corresponding Prefetch directory, which is located in the root of the system. It is because of this that Svchost loads the processor in Windows 7. The solution is the simplest: delete the directory yourself, end all Svchost.exe processes in the Task Manager and reboot. After the restart, there is no need to reactivate the disabled service. Most users, in general, do not need it at all, and among other things, it is quite “voracious” in terms of consumption of system resources, which leads to dire consequences on weak computer configurations.

If in the “Task Manager” you observe the activation of a process with the name of the executable file wuauclt.exe, you need to find the SoftwareDistribution directory (the root directory of the OS) and delete all subfolders and files from it, and then, as usual, restart the computer. You can also rename the original directory itself, giving it a name with the addition “.old” and reboot immediately, even without deleting it.

Brief summary

That's all regarding the main reasons for the appearance of increased loads on the central processor and RAM, as well as the main methods for eliminating them. True, in a certain sense, it is very difficult to say immediately what provoked such a phenomenon. This can be done with confidence only in case of a virus infection or in the case when even manual checking of updates or their installation does not work in the Update Center. In all other situations, you will have to perform each action separately. Apart from possible failures or damage to the hardware (in particular, this applies to RAM strips), at least one technique will give a positive effect in any case.

Just in case, many experts recommend clearing the system event log, which stores LOG files. It can be called through the “Run” console using the eventvwr line, after which use the cleanup items for the application, system, security and installation sections via RMB. After completing all actions, the system must be rebooted.

If the proposed methods do not work for some reason, identical actions can be performed in Safe Mode by pressing F8 at startup.

For none of Windows users It’s no secret that when your computer freezes or slows down, you first need to look at the “Task Manager” in order to end the processes that are weighing down the system. The task, let’s say, is for first-graders: it seems like we were swimming and we know what’s there and how. However, looking once again into the notorious dispatcher, many users, to their surprise, notice almost for the first time that overload central processor runs a process like svchost.exe, which, please note, is displayed not in one, but in 4 or even more lines at once:

Well, think for yourself, what other reaction could there be at this moment, other than panic at the thought that a virus has settled on your favorite PC? In my memory, there has never been a time when system processes were duplicated in the “Task Manager”! However, before looking in horror for a solution on how to quickly remove svchost.exe from your computer, you need to figure out whether it is actually a virus or not.

Step No. 1: Detecting viruses

Perhaps it’s worth noting right away that the svchost.exe process itself does not pose any threat to Windows, no matter how strange it may seem. In fact, it is designed to run services built into the system, services and various programs that use special DLL libraries in their work. However, based on the fact that such system services There are often quite a few on a computer; executing them in one process can be very difficult. This is why svchost.exe is often launched several times, servicing individual Windows services.

It is clear that deleting such processes does not make any sense, since to disable them it will be enough to simply restart the computer. In the same time complete removal system file svchost.exe may cause crashes in Windows work, the appearance of all sorts of errors and other problems with Windows. That’s why, having found a whole fan of svchost.exe in the “Task Manager”, there is no need to rush to say goodbye to it right away: everything can be much simpler.

However, you shouldn’t relax in this case either. The fact is that viruses often disguise themselves as svchost.exe, bringing with them very unpleasant gifts in the form of:

  • random exit of the computer from sleep mode;
  • appearance system error when launching applications, opening the drive or reading a disc;
  • automatic reboot of Windows;
  • turning off the computer for no reason;
  • PC slowdown due to CPU load of more than 90%;
  • spontaneous opening of applications, etc.

The question arises, how can you determine in this case where the virus is and where the normal system process svchost.exe is? The answer is simple - take a closer look at it.

So, the first sign that svchost.exe is a virus will be the execution of this process on behalf of the user (normally it is launched on behalf of LOCAL SERVICE, SYSTEM (system) or NETWORK SERVICE). To determine this, just press Ctrl+Shift+Esc on your keyboard at the same time, thereby calling up the “Task Manager”, then select the “Processes” tab in the window that opens and, finally, look at the data specified in the “User” column for the process svchost.exe:

I note that for the same purpose, if desired, you can use a special program Process Explorer, which displays full information about all processes running on the computer, including svchost.exe:

At the same time, the location of such a file can help determine whether there is a threat from svchost.exe. Remember: normally it is stored only in one of 4 folders located on the hard drive, namely in the directory:

  • WINDOWS\Prefetch
  • WINDOWS\ServicePackFiles\i386
  • WINDOWS\system32
  • WINDOWS\winsxs

Accordingly, if svchost.exe is located in some other place, for example, separately in the WINDOWS folder, rest assured: this is a real virus. At the same time, the “Task Manager” can again help you check whether this is actually the case. In this case, after starting it, you will need to right-click on the line with the process name svchost.exe, select the “Properties” item in the menu that opens, and then pay attention to the “Location” field:

In addition, the name of the process itself can be a clue. Thus, any deviations from the spelling of svchost.exe in the image name can be safely regarded as a hidden virus threat. Therefore, if you see in the “Task Manager” processes such as svhost.exe, svehost.exe, svxhost.exe, svchos1.exe, svchest.exe, svch0st.exe and other misspelled values, you can safely delete them: these are viruses.

Step No. 2: Remove viruses from svchost.exe

It must be said that due to the numerous varieties of svchost.exe viruses, there is currently no universal way to remove them from a computer. In particular, a complete Windows check installed on PC antivirus program. The main thing in this case is not to forget before starting it:

  • disconnect from local network and the Internet;
  • end suspicious svchost.exe processes in the Task Manager;
  • clear startup of svchost.exe files. In this case, we first need to press ÿ+R on the keyboard, then enter the msconfig task into the “Run” utility that appears, click OK, and then after selecting the “Startup” tab in the window that opens, check for the presence of svchost.exe in it:

At the same time, so that the effect of treating your computer does not turn out to be temporary, you must take care of installing and updating the Windows powerful antivirus and firewall. This is the only way to be sure that the problem with the malicious Trojan file svchost.exe will not return to the system.



2024 wisemotors.ru. How it works. Iron. Mining. Cryptocurrency.