what this notice -->> C:\recycle\SVCHOST.EXE
- Thread starter haikal
- Start date
- Status
- Joined
- Mar 8, 2007
- Messages
- 3
- Reaction score
- 0
notice --->> Windows cannot find "C:\recycled\SVCHOST.EXE"
hi there..please help me solve my problem... Windows cannot find "C:\recycled\SVCHOST.EXE" Make sure you typed the name correctly, and then try again.
After i download, and run HJT. save a log file and log file like this... i still can't solve my problem.. pls..TQ
-
Logfile of HijackThis v1.99.1
Scan saved at 11:24:40 AM, on 3/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\Fonts\*Explorer.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - Global Startup: BlueSoleil.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
hi there..please help me solve my problem... Windows cannot find "C:\recycled\SVCHOST.EXE" Make sure you typed the name correctly, and then try again.
After i download, and run HJT. save a log file and log file like this... i still can't solve my problem.. pls..TQ
-
Logfile of HijackThis v1.99.1
Scan saved at 11:24:40 AM, on 3/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\Fonts\*Explorer.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - Global Startup: BlueSoleil.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{1280BDED-817E-4EF9-B121-103B672C94AF}: NameServer = 202.188.0.133,202.188.1.5
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
Last edited:
- Joined
- Jul 18, 2008
- Messages
- 6
- Reaction score
- 0
C:\recycle\svchost.exe
Hi,
The chances are you had a virus which was detected and deleted and the message C:\recycle\svchost.exe is one of the left overs of the virus references.
It is not detected by the antivirus or registry cleaners simply because the name "svchost.exe" is a valid operating system file and therefore is ignored by the tools. Here is how to remove it. I assume you are using windows
NB: You will need to remove the reference manually from the registry. But first export your copy of the registry for backup.
1. Click on Start run
2. type in regedit and cling on OK
3. Find the "C:\recycle\svchost.exe"
4. Delete its occurance and more so the one next to explorer key.
Tell me about your experience.
Your success is my concern.
Tshidiso Medupe
Hi,
The chances are you had a virus which was detected and deleted and the message C:\recycle\svchost.exe is one of the left overs of the virus references.
It is not detected by the antivirus or registry cleaners simply because the name "svchost.exe" is a valid operating system file and therefore is ignored by the tools. Here is how to remove it. I assume you are using windows
NB: You will need to remove the reference manually from the registry. But first export your copy of the registry for backup.
1. Click on Start run
2. type in regedit and cling on OK
3. Find the "C:\recycle\svchost.exe"
4. Delete its occurance and more so the one next to explorer key.
Tell me about your experience.
Your success is my concern.
Tshidiso Medupe
- Joined
- Jul 3, 2008
- Messages
- 407
- Reaction score
- 0
Tshidiso Medupe said:
Scary stuff this....
A full scan would scan this file and report if it's a virus or not.
Personally I wouldn't remove entries of this from the registry. SVCHOST is a binding process used to run all essiential components of windows... one mistake and bye bye windows.
Instead go to nortons online virus scan (link is on this site somewhere), once it reports what virus it is/was download the fix (from symantec... they got loads) and run it. It will remove/ repair the damage for you.
- Joined
- Jul 18, 2008
- Messages
- 6
- Reaction score
- 0
True, that the SVChost.exe is an important file and in no way am I proposing that you delete the SVChost.exe file.
What I suggest you delete is explorer's reference to "C:\recycle\svchost.exe" which is no longer available in your computer (it could be that it was deleted by your antivirus); but its reference is invoked everytime explorer(windows) start up.
Virus writers use the same name that you know for the Operating System as this files might be ignored by other antivirus or spyware's due to their names, other antivirus trace the patterns and thereby detect and remove this files like it did in this instance but its reference is not removed and here you are just removing the reference. This has been tried, tested and it has proven to work; but this is in no way forcing solution. The choice is in your hands.
(You'll find that the occurance of the "C:\recycle\svchost.exe" is not as many as you might like to believe as the occurance of "svchost.exe" which is not to be deleted.
What I suggest you delete is explorer's reference to "C:\recycle\svchost.exe" which is no longer available in your computer (it could be that it was deleted by your antivirus); but its reference is invoked everytime explorer(windows) start up.
Virus writers use the same name that you know for the Operating System as this files might be ignored by other antivirus or spyware's due to their names, other antivirus trace the patterns and thereby detect and remove this files like it did in this instance but its reference is not removed and here you are just removing the reference. This has been tried, tested and it has proven to work; but this is in no way forcing solution. The choice is in your hands.
(You'll find that the occurance of the "C:\recycle\svchost.exe" is not as many as you might like to believe as the occurance of "svchost.exe" which is not to be deleted.
- Joined
- Nov 19, 2008
- Messages
- 2
- Reaction score
- 0
Problem with C:\Recycled\SVCHost.exe
Did u say C:\Recycled\SVCHost.exe
The message is caused normally by a string left by a virus variant W32/Rungbu-A which was cured or quarantined by an Anti Virus. To get rid of this, you need a bit of registry editing.
For beginners-Go to Run in start menu and type 'regedit' then enter. You will get the windows registry opened. Navigate to HKEY_CURRENT_USER and expand it. Now further expand it till you reach SOFTWARE > MICROSOFT > WINDOWS NT > CURRENT VERSION >EXPLORER > WINLOGON.
NB: In some case the >EXPLORER> case may not be available
Click on the WINLOGON key on the left pane and on the right pane you can see an entry named Shell.
Double click on it and a box appears with the Value of the String.
In the Value box you will see Explorer.exe C:\Recycled\Svchost.exe. Now carefully select the text starting from C:\Recycled\Svchost.exe and delete it. The value box should have only Explorer.exe.
Press OK.
Close the Registry Editor and restart your machine.
That should solve the problem.
Did u say C:\Recycled\SVCHost.exe
The message is caused normally by a string left by a virus variant W32/Rungbu-A which was cured or quarantined by an Anti Virus. To get rid of this, you need a bit of registry editing.
For beginners-Go to Run in start menu and type 'regedit' then enter. You will get the windows registry opened. Navigate to HKEY_CURRENT_USER and expand it. Now further expand it till you reach SOFTWARE > MICROSOFT > WINDOWS NT > CURRENT VERSION >EXPLORER > WINLOGON.
NB: In some case the >EXPLORER> case may not be available
Click on the WINLOGON key on the left pane and on the right pane you can see an entry named Shell.
Double click on it and a box appears with the Value of the String.
In the Value box you will see Explorer.exe C:\Recycled\Svchost.exe. Now carefully select the text starting from C:\Recycled\Svchost.exe and delete it. The value box should have only Explorer.exe.
Press OK.
Close the Registry Editor and restart your machine.
That should solve the problem.
- Joined
- Nov 19, 2008
- Messages
- 2
- Reaction score
- 0
Svcost.exe
Hey Raghav, I'm glad this helped you. It's been years since I posted it. I'm now at www.openuganda.com
see u there then
mr.raghav said:Thanks bro... I had same problem on our office PC (ofcourse I am using it for personal purposes)... Found this forum in Google search... My issue is solved...
Thanks again
Raghav
Hey Raghav, I'm glad this helped you. It's been years since I posted it. I'm now at www.openuganda.com
see u there then
- Status