Sign in with
Sign up | Sign in
Your question

SCVHOST or SVCHOST?

Tags:
  • Support
  • Svchost.Exe
  • Microsoft
  • Windows XP
Last response: in Windows XP
Share
Anonymous
March 12, 2005 9:33:02 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Are Scvhost.exe and Svchost.exe the same thing or are they different.
I get the error from Windows can't find scvhost.exe, but I see others are
asking for help on svchost.exe.
Help!!
Thanks
Barb

More about : scvhost svchost

Anonymous
March 12, 2005 11:34:19 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

No they aren't the same. Quiet and quite aren't the same, are they?

Svchost.exe is a legit XP file.

scvhost.exe is a process which is registered as the W32/Agobot-S virus. This
Trojan allows attackers to access your computer, stealing passwords and
personal data.

You might want to update your anti virus software a run a full system scan.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
Barb <Barb@discussions.microsoft.com> hunted and pecked:
> Are Scvhost.exe and Svchost.exe the same thing or are they different.
> I get the error from Windows can't find scvhost.exe, but I see
> others are asking for help on svchost.exe.
> Help!!
> Thanks
> Barb
Anonymous
March 13, 2005 10:21:02 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

OK.. I understand now.. but let me ask you.. I found it when I went into
regedit. Can I delete this without hurting my computer. I have updated my
virus program and everything is cleaned. I also rean CClean. Also have
Adware now.
Everything is ok..
Thanks..
Barb

"Wesley Vogel" wrote:

> No they aren't the same. Quiet and quite aren't the same, are they?
>
> Svchost.exe is a legit XP file.
>
> scvhost.exe is a process which is registered as the W32/Agobot-S virus. This
> Trojan allows attackers to access your computer, stealing passwords and
> personal data.
>
> You might want to update your anti virus software a run a full system scan.
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
> Barb <Barb@discussions.microsoft.com> hunted and pecked:
> > Are Scvhost.exe and Svchost.exe the same thing or are they different.
> > I get the error from Windows can't find scvhost.exe, but I see
> > others are asking for help on svchost.exe.
> > Help!!
> > Thanks
> > Barb
>
>
March 13, 2005 10:35:02 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

"Barb" wrote:

> OK.. I understand now.. but let me ask you.. I found it when I went into
> regedit. Can I delete this without hurting my computer. I have updated my
> virus program and everything is cleaned. I also rean CClean. Also have
> Adware now.
> Everything is ok..
> Thanks..
> Barb
>
> "Wesley Vogel" wrote:
>
> > No they aren't the same. Quiet and quite aren't the same, are they?
> >
> > Svchost.exe is a legit XP file.
> >
> > scvhost.exe is a process which is registered as the W32/Agobot-S virus. This
> > Trojan allows attackers to access your computer, stealing passwords and
> > personal data.
> >
> > You might want to update your anti virus software a run a full system scan.
> >
> > --
> > Hope this helps. Let us know.
> >
> > Wes
> > MS-MVP Windows Shell/User
> >
> > In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
> > Barb <Barb@discussions.microsoft.com> hunted and pecked:
> > > Are Scvhost.exe and Svchost.exe the same thing or are they different.
> > > I get the error from Windows can't find scvhost.exe, but I see
> > > others are asking for help on svchost.exe.
> > > Help!!
> > > Thanks
> > > Barb
> >
> >

Where in regedit did you find it???
Anonymous
March 13, 2005 11:09:01 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Under:
My Computer
Windows NT
Current Version
Run
Here I have :

Name Type Data
ab (Default) REG_SZ (Value not set)
ab Generic Host Process REG_SZ C:\Windows\system32\scvhost.exe

Thanks for any help you can give.. I really appreciate it..
Barb

"MAP" wrote:

>
>
> "Barb" wrote:
>
> > OK.. I understand now.. but let me ask you.. I found it when I went into
> > regedit. Can I delete this without hurting my computer. I have updated my
> > virus program and everything is cleaned. I also rean CClean. Also have
> > Adware now.
> > Everything is ok..
> > Thanks..
> > Barb
> >
> > "Wesley Vogel" wrote:
> >
> > > No they aren't the same. Quiet and quite aren't the same, are they?
> > >
> > > Svchost.exe is a legit XP file.
> > >
> > > scvhost.exe is a process which is registered as the W32/Agobot-S virus. This
> > > Trojan allows attackers to access your computer, stealing passwords and
> > > personal data.
> > >
> > > You might want to update your anti virus software a run a full system scan.
> > >
> > > --
> > > Hope this helps. Let us know.
> > >
> > > Wes
> > > MS-MVP Windows Shell/User
> > >
> > > In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
> > > Barb <Barb@discussions.microsoft.com> hunted and pecked:
> > > > Are Scvhost.exe and Svchost.exe the same thing or are they different.
> > > > I get the error from Windows can't find scvhost.exe, but I see
> > > > others are asking for help on svchost.exe.
> > > > Help!!
> > > > Thanks
> > > > Barb
> > >
> > >
>
> Where in regedit did you find it???
>
Anonymous
March 13, 2005 1:21:13 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Barb,

You can see the path on the bottom toolbar. I.e. My
Computer\HKEY_LOCAL_MACHINE or what ever it may be at the time.

You can pretty much ignore the My Computer reference. I think this only
shows that you aren't accessing a registry on a remote machine.

You can also copy the key name and paste it into your message, Notepad or
whatever.

Right click the key whose name you want to copy.
Select Copy Key Name.
Paste this where ever.

This is a key name copied and pasted...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Is this the key that you posted???

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run

Or this one??

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Run

Regardless.

Right click Generic Host Process in the right hand pane of the Registry
Editor (regedit).
Select Delete.
Answer Yes.

You may want to double check that scvhost.exe is gone from
C:\Windows\system32

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:3D01E51A-93C2-419C-BE65-DE914CB31518@microsoft.com,
Barb <Barb@discussions.microsoft.com> hunted and pecked:
> Under:
> My Computer
> Windows NT
> Current Version
> Run
> Here I have :
>
> Name Type Data
> ab (Default) REG_SZ (Value not set)
> ab Generic Host Process REG_SZ
> C:\Windows\system32\scvhost.exe
>
> Thanks for any help you can give.. I really appreciate it..
> Barb
>
> "MAP" wrote:
>
>>
>>
>> "Barb" wrote:
>>
>>> OK.. I understand now.. but let me ask you.. I found it when I went
>>> into regedit. Can I delete this without hurting my computer. I
>>> have updated my virus program and everything is cleaned. I also
>>> rean CClean. Also have Adware now.
>>> Everything is ok..
>>> Thanks..
>>> Barb
>>>
>>> "Wesley Vogel" wrote:
>>>
>>>> No they aren't the same. Quiet and quite aren't the same, are
>>>> they?
>>>>
>>>> Svchost.exe is a legit XP file.
>>>>
>>>> scvhost.exe is a process which is registered as the W32/Agobot-S
>>>> virus. This Trojan allows attackers to access your computer,
>>>> stealing passwords and personal data.
>>>>
>>>> You might want to update your anti virus software a run a full
>>>> system scan.
>>>>
>>>> --
>>>> Hope this helps. Let us know.
>>>>
>>>> Wes
>>>> MS-MVP Windows Shell/User
>>>>
>>>> In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
>>>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
>>>>> Are Scvhost.exe and Svchost.exe the same thing or are they
>>>>> different. I get the error from Windows can't find scvhost.exe,
>>>>> but I see others are asking for help on svchost.exe.
>>>>> Help!!
>>>>> Thanks
>>>>> Barb
>>>>
>>>>
>>
>> Where in regedit did you find it???
Anonymous
March 13, 2005 9:11:02 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi Wes,
This is the one that I found it in:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
I deleted the generic host process and still get the error message when I
start Windows XP.
I can't find scvhost.exe anywhere now on the computer..
It is driving me crazy..
Any help will be greatly appreciated..
Thanks..
Barb

"Wesley Vogel" wrote:

> Barb,
>
> You can see the path on the bottom toolbar. I.e. My
> Computer\HKEY_LOCAL_MACHINE or what ever it may be at the time.
>
> You can pretty much ignore the My Computer reference. I think this only
> shows that you aren't accessing a registry on a remote machine.
>
> You can also copy the key name and paste it into your message, Notepad or
> whatever.
>
> Right click the key whose name you want to copy.
> Select Copy Key Name.
> Paste this where ever.
>
> This is a key name copied and pasted...
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>
> Is this the key that you posted???
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
>
> Or this one??
>
> HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Run
>
> Regardless.
>
> Right click Generic Host Process in the right hand pane of the Registry
> Editor (regedit).
> Select Delete.
> Answer Yes.
>
> You may want to double check that scvhost.exe is gone from
> C:\Windows\system32
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:3D01E51A-93C2-419C-BE65-DE914CB31518@microsoft.com,
> Barb <Barb@discussions.microsoft.com> hunted and pecked:
> > Under:
> > My Computer
> > Windows NT
> > Current Version
> > Run
> > Here I have :
> >
> > Name Type Data
> > ab (Default) REG_SZ (Value not set)
> > ab Generic Host Process REG_SZ
> > C:\Windows\system32\scvhost.exe
> >
> > Thanks for any help you can give.. I really appreciate it..
> > Barb
> >
> > "MAP" wrote:
> >
> >>
> >>
> >> "Barb" wrote:
> >>
> >>> OK.. I understand now.. but let me ask you.. I found it when I went
> >>> into regedit. Can I delete this without hurting my computer. I
> >>> have updated my virus program and everything is cleaned. I also
> >>> rean CClean. Also have Adware now.
> >>> Everything is ok..
> >>> Thanks..
> >>> Barb
> >>>
> >>> "Wesley Vogel" wrote:
> >>>
> >>>> No they aren't the same. Quiet and quite aren't the same, are
> >>>> they?
> >>>>
> >>>> Svchost.exe is a legit XP file.
> >>>>
> >>>> scvhost.exe is a process which is registered as the W32/Agobot-S
> >>>> virus. This Trojan allows attackers to access your computer,
> >>>> stealing passwords and personal data.
> >>>>
> >>>> You might want to update your anti virus software a run a full
> >>>> system scan.
> >>>>
> >>>> --
> >>>> Hope this helps. Let us know.
> >>>>
> >>>> Wes
> >>>> MS-MVP Windows Shell/User
> >>>>
> >>>> In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
> >>>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
> >>>>> Are Scvhost.exe and Svchost.exe the same thing or are they
> >>>>> different. I get the error from Windows can't find scvhost.exe,
> >>>>> but I see others are asking for help on svchost.exe.
> >>>>> Help!!
> >>>>> Thanks
> >>>>> Barb
> >>>>
> >>>>
> >>
> >> Where in regedit did you find it???
>
>
Anonymous
March 14, 2005 9:42:47 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi Barb,

scvhost.exe seems to be created by a bunch of different viruses.

A reference (or more than one) to scvhost.exe is still in your registry.
The number of places that things can start from in the registry is too
numerous for me to count.

You may know this already, to do a Find (search) in the registry, hit your
F3 key, type or paste scvhost.exe in the Find What box, click the Find Next
button. When/if scvhost.exe is found delete the Value Name in the right
hand pane. Hit F3 again to Find Next and keep hitting F3 until you get a
message to the effect that you've reached the end of the registry. After
deleting all references to scvhost.exe. I don't remember the exact
message.
-----

As an example...

W32/Agobot-S creates the following registry entries...

HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\Config Loader = scvhost.exe

and

HKLM\Software\Microsoft\Windows\CurrentVersion\
RunServices\Config Loader = scvhost.exe

On Windows NT, 2000 and XP W32/Agobot-S may run itself as a new service
called Cfgldr.
-----

I don't know what virus you had, you may need to F3 for Config Loader and/or
Cfgldr.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:3908ADAD-A8E3-48CE-B282-C2B752799CA4@microsoft.com,
Barb <Barb@discussions.microsoft.com> hunted and pecked:
> Hi Wes,
> This is the one that I found it in:
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
> I deleted the generic host process and still get the error message
> when I start Windows XP.
> I can't find scvhost.exe anywhere now on the computer..
> It is driving me crazy..
> Any help will be greatly appreciated..
> Thanks..
> Barb
>
> "Wesley Vogel" wrote:
>
>> Barb,
>>
>> You can see the path on the bottom toolbar. I.e. My
>> Computer\HKEY_LOCAL_MACHINE or what ever it may be at the time.
>>
>> You can pretty much ignore the My Computer reference. I think this
>> only shows that you aren't accessing a registry on a remote machine.
>>
>> You can also copy the key name and paste it into your message,
>> Notepad or whatever.
>>
>> Right click the key whose name you want to copy.
>> Select Copy Key Name.
>> Paste this where ever.
>>
>> This is a key name copied and pasted...
>>
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>>
>> Is this the key that you posted???
>>
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
>>
>> Or this one??
>>
>> HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Run
>>
>> Regardless.
>>
>> Right click Generic Host Process in the right hand pane of the
>> Registry Editor (regedit).
>> Select Delete.
>> Answer Yes.
>>
>> You may want to double check that scvhost.exe is gone from
>> C:\Windows\system32
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:3D01E51A-93C2-419C-BE65-DE914CB31518@microsoft.com,
>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
>>> Under:
>>> My Computer
>>> Windows NT
>>> Current Version
>>> Run
>>> Here I have :
>>>
>>> Name Type Data
>>> ab (Default) REG_SZ (Value not set)
>>> ab Generic Host Process REG_SZ
>>> C:\Windows\system32\scvhost.exe
>>>
>>> Thanks for any help you can give.. I really appreciate it..
>>> Barb
>>>
>>> "MAP" wrote:
>>>
>>>>
>>>>
>>>> "Barb" wrote:
>>>>
>>>>> OK.. I understand now.. but let me ask you.. I found it when I
>>>>> went into regedit. Can I delete this without hurting my
>>>>> computer. I have updated my virus program and everything is
>>>>> cleaned. I also rean CClean. Also have Adware now.
>>>>> Everything is ok..
>>>>> Thanks..
>>>>> Barb
>>>>>
>>>>> "Wesley Vogel" wrote:
>>>>>
>>>>>> No they aren't the same. Quiet and quite aren't the same, are
>>>>>> they?
>>>>>>
>>>>>> Svchost.exe is a legit XP file.
>>>>>>
>>>>>> scvhost.exe is a process which is registered as the W32/Agobot-S
>>>>>> virus. This Trojan allows attackers to access your computer,
>>>>>> stealing passwords and personal data.
>>>>>>
>>>>>> You might want to update your anti virus software a run a full
>>>>>> system scan.
>>>>>>
>>>>>> --
>>>>>> Hope this helps. Let us know.
>>>>>>
>>>>>> Wes
>>>>>> MS-MVP Windows Shell/User
>>>>>>
>>>>>> In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
>>>>>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
>>>>>>> Are Scvhost.exe and Svchost.exe the same thing or are they
>>>>>>> different. I get the error from Windows can't find scvhost.exe,
>>>>>>> but I see others are asking for help on svchost.exe.
>>>>>>> Help!!
>>>>>>> Thanks
>>>>>>> Barb
>>>>>>
>>>>>>
>>>>
>>>> Where in regedit did you find it???
Anonymous
March 14, 2005 5:21:01 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Thanks Wes,
That worked.. Let me ask you another question. Every time I tried to run
Windows firewall, it tells me this:
Windows cannot start the Windows Firewall/Internet Connection Sharing (ICS)
Service.
Do I need to change something in my internet connection. I had the firewall
up once before, so I don't know if this has something too do with the virus
or not.
Thanks
Barb

"Wesley Vogel" wrote:

> Hi Barb,
>
> scvhost.exe seems to be created by a bunch of different viruses.
>
> A reference (or more than one) to scvhost.exe is still in your registry.
> The number of places that things can start from in the registry is too
> numerous for me to count.
>
> You may know this already, to do a Find (search) in the registry, hit your
> F3 key, type or paste scvhost.exe in the Find What box, click the Find Next
> button. When/if scvhost.exe is found delete the Value Name in the right
> hand pane. Hit F3 again to Find Next and keep hitting F3 until you get a
> message to the effect that you've reached the end of the registry. After
> deleting all references to scvhost.exe. I don't remember the exact
> message.
> -----
>
> As an example...
>
> W32/Agobot-S creates the following registry entries...
>
> HKLM\Software\Microsoft\Windows\CurrentVersion\
> Run\Config Loader = scvhost.exe
>
> and
>
> HKLM\Software\Microsoft\Windows\CurrentVersion\
> RunServices\Config Loader = scvhost.exe
>
> On Windows NT, 2000 and XP W32/Agobot-S may run itself as a new service
> called Cfgldr.
> -----
>
> I don't know what virus you had, you may need to F3 for Config Loader and/or
> Cfgldr.
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:3908ADAD-A8E3-48CE-B282-C2B752799CA4@microsoft.com,
> Barb <Barb@discussions.microsoft.com> hunted and pecked:
> > Hi Wes,
> > This is the one that I found it in:
> > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
> > I deleted the generic host process and still get the error message
> > when I start Windows XP.
> > I can't find scvhost.exe anywhere now on the computer..
> > It is driving me crazy..
> > Any help will be greatly appreciated..
> > Thanks..
> > Barb
> >
> > "Wesley Vogel" wrote:
> >
> >> Barb,
> >>
> >> You can see the path on the bottom toolbar. I.e. My
> >> Computer\HKEY_LOCAL_MACHINE or what ever it may be at the time.
> >>
> >> You can pretty much ignore the My Computer reference. I think this
> >> only shows that you aren't accessing a registry on a remote machine.
> >>
> >> You can also copy the key name and paste it into your message,
> >> Notepad or whatever.
> >>
> >> Right click the key whose name you want to copy.
> >> Select Copy Key Name.
> >> Paste this where ever.
> >>
> >> This is a key name copied and pasted...
> >>
> >> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> >>
> >> Is this the key that you posted???
> >>
> >> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
> >>
> >> Or this one??
> >>
> >> HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Run
> >>
> >> Regardless.
> >>
> >> Right click Generic Host Process in the right hand pane of the
> >> Registry Editor (regedit).
> >> Select Delete.
> >> Answer Yes.
> >>
> >> You may want to double check that scvhost.exe is gone from
> >> C:\Windows\system32
> >>
> >> --
> >> Hope this helps. Let us know.
> >>
> >> Wes
> >> MS-MVP Windows Shell/User
> >>
> >> In news:3D01E51A-93C2-419C-BE65-DE914CB31518@microsoft.com,
> >> Barb <Barb@discussions.microsoft.com> hunted and pecked:
> >>> Under:
> >>> My Computer
> >>> Windows NT
> >>> Current Version
> >>> Run
> >>> Here I have :
> >>>
> >>> Name Type Data
> >>> ab (Default) REG_SZ (Value not set)
> >>> ab Generic Host Process REG_SZ
> >>> C:\Windows\system32\scvhost.exe
> >>>
> >>> Thanks for any help you can give.. I really appreciate it..
> >>> Barb
> >>>
> >>> "MAP" wrote:
> >>>
> >>>>
> >>>>
> >>>> "Barb" wrote:
> >>>>
> >>>>> OK.. I understand now.. but let me ask you.. I found it when I
> >>>>> went into regedit. Can I delete this without hurting my
> >>>>> computer. I have updated my virus program and everything is
> >>>>> cleaned. I also rean CClean. Also have Adware now.
> >>>>> Everything is ok..
> >>>>> Thanks..
> >>>>> Barb
> >>>>>
> >>>>> "Wesley Vogel" wrote:
> >>>>>
> >>>>>> No they aren't the same. Quiet and quite aren't the same, are
> >>>>>> they?
> >>>>>>
> >>>>>> Svchost.exe is a legit XP file.
> >>>>>>
> >>>>>> scvhost.exe is a process which is registered as the W32/Agobot-S
> >>>>>> virus. This Trojan allows attackers to access your computer,
> >>>>>> stealing passwords and personal data.
> >>>>>>
> >>>>>> You might want to update your anti virus software a run a full
> >>>>>> system scan.
> >>>>>>
> >>>>>> --
> >>>>>> Hope this helps. Let us know.
> >>>>>>
> >>>>>> Wes
> >>>>>> MS-MVP Windows Shell/User
> >>>>>>
> >>>>>> In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
> >>>>>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
> >>>>>>> Are Scvhost.exe and Svchost.exe the same thing or are they
> >>>>>>> different. I get the error from Windows can't find scvhost.exe,
> >>>>>>> but I see others are asking for help on svchost.exe.
> >>>>>>> Help!!
> >>>>>>> Thanks
> >>>>>>> Barb
> >>>>>>
> >>>>>>
> >>>>
> >>>> Where in regedit did you find it???
>
>
Anonymous
March 14, 2005 7:21:20 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi Barb,

Glad you got that problem sorted out. :-)

I do not have SP2. I do not use Windows Firewall. I use ZoneAlarm
firewall.

That said. Without much more to go on, anything would be a guess. Guesses
are at the bottom. ;-)

Look in the Event Viewer for the Windows cannot start the Windows
Firewall... error.

Event ID & the Event Source are very important. With those two items anyone
can research the error message.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Event Viewer overview
http://www.microsoft.com/resources/documentation/window...

This can also be very useful.
You need to have the Event ID & the Event Source.

To view Windows XP Events and Errors, type the Source (for example, Print)
and/or the Event code (for example, 20) into the ID field, then click the Go
button. Source and Event codes may be found in the Event Viewer logs.

Windows XP Home/Professional Events and Errors
http://www.microsoft.com/technet/support/ee/search.aspx...

-----

Guesses here...

Make sure that all of these services are set Automatic. The links are there
to provide more info if you care to look.

What services Windows Firewall/Internet Connection Sharing (ICS) needs to
function properly:

Network Connections
http://www.blackviper.com/WinXP/service411.htm#Network_...

Remote Procedure Call (RPC)
This service is rather vital. Practically everything depends on this service
to be running.
http://www.blackviper.com/WinXP/service411.htm#Remote_P...(RPC)

Windows Management Instrumentation
http://www.blackviper.com/WinXP/service411.htm#Windows_...

Event Log
http://www.blackviper.com/WinXP/service411.htm#Event_Lo...

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:D A30F141-F37E-443D-8E35-55DE9AB394D5@microsoft.com,
Barb <Barb@discussions.microsoft.com> hunted and pecked:
> Thanks Wes,
> That worked.. Let me ask you another question. Every time I tried
> to run Windows firewall, it tells me this:
> Windows cannot start the Windows Firewall/Internet Connection Sharing
> (ICS) Service.
> Do I need to change something in my internet connection. I had the
> firewall up once before, so I don't know if this has something too do
> with the virus or not.
> Thanks
> Barb
>
> "Wesley Vogel" wrote:
>
>> Hi Barb,
>>
>> scvhost.exe seems to be created by a bunch of different viruses.
>>
>> A reference (or more than one) to scvhost.exe is still in your
>> registry. The number of places that things can start from in the
>> registry is too numerous for me to count.
>>
>> You may know this already, to do a Find (search) in the registry,
>> hit your F3 key, type or paste scvhost.exe in the Find What box,
>> click the Find Next button. When/if scvhost.exe is found delete the
>> Value Name in the right hand pane. Hit F3 again to Find Next and
>> keep hitting F3 until you get a message to the effect that you've
>> reached the end of the registry. After deleting all references to
>> scvhost.exe. I don't remember the exact message.
>> -----
>>
>> As an example...
>>
>> W32/Agobot-S creates the following registry entries...
>>
>> HKLM\Software\Microsoft\Windows\CurrentVersion\
>> Run\Config Loader = scvhost.exe
>>
>> and
>>
>> HKLM\Software\Microsoft\Windows\CurrentVersion\
>> RunServices\Config Loader = scvhost.exe
>>
>> On Windows NT, 2000 and XP W32/Agobot-S may run itself as a new
>> service called Cfgldr.
>> -----
>>
>> I don't know what virus you had, you may need to F3 for Config
>> Loader and/or Cfgldr.
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:3908ADAD-A8E3-48CE-B282-C2B752799CA4@microsoft.com,
>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
>>> Hi Wes,
>>> This is the one that I found it in:
>>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
>>> I deleted the generic host process and still get the error message
>>> when I start Windows XP.
>>> I can't find scvhost.exe anywhere now on the computer..
>>> It is driving me crazy..
>>> Any help will be greatly appreciated..
>>> Thanks..
>>> Barb
>>>
>>> "Wesley Vogel" wrote:
>>>
>>>> Barb,
>>>>
>>>> You can see the path on the bottom toolbar. I.e. My
>>>> Computer\HKEY_LOCAL_MACHINE or what ever it may be at the time.
>>>>
>>>> You can pretty much ignore the My Computer reference. I think this
>>>> only shows that you aren't accessing a registry on a remote
>>>> machine.
>>>>
>>>> You can also copy the key name and paste it into your message,
>>>> Notepad or whatever.
>>>>
>>>> Right click the key whose name you want to copy.
>>>> Select Copy Key Name.
>>>> Paste this where ever.
>>>>
>>>> This is a key name copied and pasted...
>>>>
>>>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>>>>
>>>> Is this the key that you posted???
>>>>
>>>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
>>>>
>>>> Or this one??
>>>>
>>>> HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Run
>>>>
>>>> Regardless.
>>>>
>>>> Right click Generic Host Process in the right hand pane of the
>>>> Registry Editor (regedit).
>>>> Select Delete.
>>>> Answer Yes.
>>>>
>>>> You may want to double check that scvhost.exe is gone from
>>>> C:\Windows\system32
>>>>
>>>> --
>>>> Hope this helps. Let us know.
>>>>
>>>> Wes
>>>> MS-MVP Windows Shell/User
>>>>
>>>> In news:3D01E51A-93C2-419C-BE65-DE914CB31518@microsoft.com,
>>>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
>>>>> Under:
>>>>> My Computer
>>>>> Windows NT
>>>>> Current Version
>>>>> Run
>>>>> Here I have :
>>>>>
>>>>> Name Type Data
>>>>> ab (Default) REG_SZ (Value not set)
>>>>> ab Generic Host Process REG_SZ
>>>>> C:\Windows\system32\scvhost.exe
>>>>>
>>>>> Thanks for any help you can give.. I really appreciate it..
>>>>> Barb
>>>>>
>>>>> "MAP" wrote:
>>>>>
>>>>>>
>>>>>>
>>>>>> "Barb" wrote:
>>>>>>
>>>>>>> OK.. I understand now.. but let me ask you.. I found it when I
>>>>>>> went into regedit. Can I delete this without hurting my
>>>>>>> computer. I have updated my virus program and everything is
>>>>>>> cleaned. I also rean CClean. Also have Adware now.
>>>>>>> Everything is ok..
>>>>>>> Thanks..
>>>>>>> Barb
>>>>>>>
>>>>>>> "Wesley Vogel" wrote:
>>>>>>>
>>>>>>>> No they aren't the same. Quiet and quite aren't the same, are
>>>>>>>> they?
>>>>>>>>
>>>>>>>> Svchost.exe is a legit XP file.
>>>>>>>>
>>>>>>>> scvhost.exe is a process which is registered as the
>>>>>>>> W32/Agobot-S virus. This Trojan allows attackers to access
>>>>>>>> your computer, stealing passwords and personal data.
>>>>>>>>
>>>>>>>> You might want to update your anti virus software a run a full
>>>>>>>> system scan.
>>>>>>>>
>>>>>>>> --
>>>>>>>> Hope this helps. Let us know.
>>>>>>>>
>>>>>>>> Wes
>>>>>>>> MS-MVP Windows Shell/User
>>>>>>>>
>>>>>>>> In news:A391C6C4-E784-4A6E-84B9-46DE93863DB3@microsoft.com,
>>>>>>>> Barb <Barb@discussions.microsoft.com> hunted and pecked:
>>>>>>>>> Are Scvhost.exe and Svchost.exe the same thing or are they
>>>>>>>>> different. I get the error from Windows can't find
>>>>>>>>> scvhost.exe, but I see others are asking for help on
>>>>>>>>> svchost.exe.
>>>>>>>>> Help!!
>>>>>>>>> Thanks
>>>>>>>>> Barb
>>>>>>>>
>>>>>>>>
>>>>>>
>>>>>> Where in regedit did you find it???
!