@Charlez

Thanks for visiting the site. I’m glad I could be of help.

@newbie_14

Thanks for the visit.

@Siva sankaran

Thanks for the comment. Originally, I was planning to do a thorough guide for this topic. Unfortunately, I have little time to make it so I just made this simpler guide.

@anasansari

If you want a true free antivirus, you can get one at http://free.grisoft.com they have the AVG anti-virus software and AVG anti-spyware software.

And for free anti-spyware programs. Try using these products:
Lavasoft Ad-Aware
Spybot - Search and Destroy

You can search for their websites in your search engines.

@Rhamil

Hello Rhamil, the guide above contains instructions on removing the SSCVIHOST.exe on your hard drive.

To remove the one in your USB/portable/flash storage device, just follow STEP 4 (you don’t need to boot in safe mode).

From your Tools, Folder options menu, select “Show Hidden files and folders” and uncheck “Hide protected operating system files.”

Then delete these files in your removable drive.
SSCVIHOST.exe
blastclnnn.exe
New Folder.exe
autorun.inf (Be careful in deleting this, there are some portable storage device that actually use this. To check, open the file in notepad, if it has words like SSCVIHOST or blastclnnn then delete it).

Unfortunately when you plug your USB drive in another computer that is affected by the virus, it will again get contaminated. See my post here

USB flash drive or Portable card reader?

Also to stop AUTORUN (and autorunning the virus) when you plug your infected device in another computer, press and hold the SHIFT key. Autorun in windows is dangerous because this is when the virus spreads.

@MARK ARVYN BAUTISTA

Thanks for visitng kababayan.

@Upie

1. UnHookExec.inf (that was created by Symantec) should work it’s way through your registry, thus enabling CTRL+ALT+DEL and regedit. In safe mode, you must be running as administrator, then right click and install UnHookExec.inf file.

2. “Command” is the same as “cmd”, you must be using a different version of Windows. The guide above, assumes that you are using Windows XP.

3. Same as my answer to #1.

You can’t delete “SSCVHOST.exe” yet because it might still be running in the background. Like I’ve said, your CTRL+ALT+DEL (Task Manager) should be working.

Feel free to comment again if you have any problems. Good luck.

@Deo

If your 3 PC is in a network, then check every PC with the virus. It will spread through the network, and any USB flash drive you insert in a computer that is already infected. I suggest using an anti-virus software to prevent it from coming back.

Shutdown first the other two, then check each PC one by one. You have to remove the virus file, specially the autorun.inf file that is related to the virus.

Don’t remove the SVCHOST.exe (check spelling) because it is being used by your computer. It’s not the same as the SSCVIHOST.exe virus.

@Deo
Also remember to update your anti-spyware software regularly for it to be able to detect new spywares.

@diginode & GREG
Thanks too. I’m glad my simple guide solved your SSCVIHOST.exe virus problems.

@Mannuella

You have to right click the file then select Install, double clicking it won’t work. The file should work (and it’s made by Symantec).

If it is only in your flashdisk, insert it in your USB drive while holding the SHIFT key to prevent it from autorunning. When the drive shows up in My Computer, delete the files related to the virus. Just follow the FOURTH step I mentioned above.

Please post back here again if you are still having problems. Anyway I’m planning to make a registry file to enable the task manager and regedit, if the file from Symantec still doesn’t work.

@Manuella
I suggest you create a backup of your whole registry in case something goes wrong. There are a lot of free Registry backup softwares available on the Internet.

Anyway here is the registry file I created to enable your Registry Editor and Task Manager. Just right click, then choose save as. Enable-Reg-Task.reg After downloading the file, double click it, then select Yes to modify the registry.

I created this by exporting the registry entry from my system. I’m using Win XP SP2, if you are using a different OS, I’m not sure if this will work. If it does work, then just follow the steps above to remove the virus.

@KingPin/Jason
If it keeps appearing after you’ve already deleted it then the virus is already in your system. I cannot identify what type of virus you have because I don’t know what programs are running in your PC. Anyway if you could list all the running programs in your Task Manager (ctrl+alt+del), we could probably identify the culprit.

I also suggest to get a decent anti-virus software to remove it. See my post here… What’s the better anti-virus software?

@Rommel
I’m sorry to say that my guide is for Windows XP. I created it because my system got infected and created this steps on how I removed it.

In Win98 this is the system folder the virus resides
C:\Windows\System\

About the registry, I’m not sure if it is located in a different path. But you can search for the file names I mentioned inside the registry. Just run your registry editor, then click Edit, then Find. Type the file names of the virus then if found just delete the entry. Press F3 to continue searching.

Also I suggest changing your anti-virus software. See my post here… What’s the better anti-virus software?

@KingPin/Jason

Based on the files running in your task manager, I assume you have Internet Explorer running, along with Apache, AVG anti-virus, your Bluetooth driver, and all the others are windows components, including the lsass.exe.

According to Symantec the name of the virus is W32.Sasser. It is a worm virus that corrupts lsass.exe

However, lsass.exe is a system process of the Microsoft Windows security mechanisms. It specifically deals with local security and login policies. This program is important for the stable and secure running of your computer and should not be terminated. Link.

The lsass.exe file included with Microsoft Windows is not spyware, a trojan, or a virus. However, like any file on your computer it can become corrupted by a virus or trojan. antivirus programs can detect and clean this file if it has become infected. Because this file is part of Microsoft Windows users should never delete or remove this file if they think it is infected, let the antivirus program handle it. Link.

So basically, we can’t just terminate the lsass.exe file. Instead you can try to use the removal tool designed to remove the W32.Sasser worm virus. Download tool here and instructions for removal. Try the removal tool first if it works.

Good luck

@KingPin/Jason

Good luck in removing the virus, I hope it does work. Anyway, I’m a former user of Symantec Norton Anti-virus for many years. And I didn’t have any problems about the product except for one thing, it uses up too many system resources (memory). You can read my story about it here. It is a highly recommended product among the AV softwares.

@KingPin/Jason

Maybe it’s another type of virus, but with the same name.

@Rommel

Congrats The Folder options is in the Windows Explorer menu. So it’s just right.

@Cricket

Thanks also for visiting my site

@jake ilustre

thanks also for visiting the site

@Manuella
you can show it again by going to your registry editor (run regedit). then follow this path

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
“NofolderOptions” = “1″
(set to zero (0) to enable)

@Rahul

Hi. Thanks also for visiting.

@Bily

Don’t worry, you will remove the virus in no time.

@zyril

You can follow the steps I mentioned above to enable your task manager and regedit. Or alternatively, you can download the registry file I made…
Enable-Reg-Task.reg

You can also read my post about anti-virus… here

@Kenneth

Try this file I made. Download, then double click so that it will merge to your registry
Enable-Reg-Task.reg

@zebeye

Thanks for the additional info. I also use the tools provided by sysinternals, in fact I always use “autoruns” and “regmon” tool that they have. Their autoruns tool shows you all the processes that autoruns when your computer starts up. This is where I first found the SSCVIHOST.exe worm.

@Juju

Thanks also for visiting.

@KingPin

I’ll also like to try that Avira anti-virus. Thanks for the suggestion.

@Khaye

You can get Avira AV at their official site at http://www.avira.com. You can try the software for 30 days, and purchase if you are satisfied.

@KingPin

I haven’t encountered that virus yet, but according to my research there is a safe and unsafe form of killer.exe.

There is a ‘legit’ program that runs killer.exe to stop web popups by minimizing them. Unfortunately, the one that your friend have is the trojan virus. Killer.exe also has many names, and it depends on the accompanying file. It means that not only the killer.exe process you should eliminate, but also the other files that come with it.

I can’t discuss all the types here since there are so many, but I’ll mention the two most common.

If you removed the killer.exe file and your system is restored, and there are no other after-effects, we can assume that it is the single killer.exe named KILLAV-FK TROJAN. [pcreview.co.uk]

Another variant is from an infected file called funnyUSTscandal.avi.exe, take note that this is not a legit video (avi) file because of the .exe extension. There are many, who got infected by this virus because ‘they’ thought that it was actually a video. Double clicking the file executes the virus. Too bad for those who are looking for scandals.

Anyway, aside from killer.exe, it also loads two files; lsass.exe and smss.exe. All three must be deleted and removed. The steps to remove this is much like my instructions above.

If any of the readers here are looking for instructions on how to remove killer.exe created by funnyUSTscandal.avi.exe, you can visit a great tutorial made by dindin.
iamdindin.multiply.com

@Khaye

I can’t answer that coz I still haven’t tried the software yet.

@KingPin

Khaye has a question for you, 3 posts above, and the one directly above.

@KingPin

Regarding Windows customization, which part of Windows do you want to customize? Background, icons, folder icons?

Yes, lsass.exe and smss.exe is a part of windows, that’s why it is commonly targeted by viruses. Even the real SVCHOST.exe is a primary target of most trojans. Trojans (like the horse in the story of Troy), must hide inside your system unnoticed to be able to ‘attack’ your system without you knowing it.

Mac OS and Linux OS are much safer to use rather than Windows. But it doesn’t mean that windows have a lot of security holes. It’s just that Windows is the most commonly used OS in the world, that’s why it is always a target for viruses and cracks. Regular updates and patches fixes these holes. Unfortunately for those users of Windows XP (like me) we only have until April this year before Microsoft stop making updates. When Win XP service pack 3 (not the release candidate, but the official release) arrives, it is the last support we will get from Microsoft.

As for password protecting your folders, you’ll have to rely on third party softwares for that. I don’t know if there is an internal function for that in the native Win XP.

Oh and feel free to comment and ask questions anytime

@ail

Thanks also for visiting.

@faheem

I guess you won’t encounter any more problems in your PC since the virus was removed. I use the same anti-virus as yours, although instead of NOD32, I use ESET Smart Security with the included NOD32 plus a firewall. Also aside from Spybot, install Lavasoft Ad-aware anti-spyware. And use Mozilla Firefox browser, instead of Internet Explorer.

@Meku

It keeps re-appearing because (1) the virus is still running in the background, check your task manager and (2) the virus auto executes itself or another file to replicate the one you’ve deleted.

Check the tools found at sergiwa.com if it can remove the virus for you, if not, you really need to plug your USB drive into a computer with an updated anti-virus.

When plugging a USB drive and you know it is infected, press and hold the SHIFT key immediately after you plug it, this is to prevent it from autorunning.

@faheem

Thanks for visiting

@Vashiel

I’m glad my guide helped. Back then when I wasn’t knowledgeable about this kinds of stuff, I usually resort to reformat.

@Nikko

You can just use the file I made to enable regedit and task manager, it only works for Windows XP.

Right click here and save as to download. Once downloaded, double click the file and it will edit your registry, remember you have to be in safe mode.

If you are still having problems, comment back here.

@Nikko

It is because of the virus (or maybe something else?). I haven’t encountered the auto closing window. Anyway, I really do suggest using UnHookExec.inf first, and if that doesn’t work, try the file I made.

BTW, you can view the contents of the file I made if you open it in notepad, just to see what changes it will make to your registry.

@momopi

That’s one of the problem of AVG. I once use AVG sometime ago, but I changed to another anti-virus software because the program is detecting too many ‘false positives’

You can read about it at my post here

@Ms. mendoza

I’m glad my post helped in removing the virus from your computer. If you still have problems or questions, just comment back here.

Salamat sa pag bisita dito.

@madhu

There are a few reasons why this happens.
1. The SSCVIHOST.exe file is called in your autorun. Type msconfig in your run box then go to startup tab. If there is a line there with the said filename, delete it.
2. It is still called in the registry. Type regedit in your run box. Then press CTRL+F on the Registry Editor. Type SSCVIHOST.exe and start searching. If found, delete the entry. Keep pressing F3 to continue searching the whole registry.
3. You have an autorun.inf file at the root of your drive. Delete it.

In addition to #1. Sometimes the system doesn’t see the file. You have to use a tool created by Microsoft for this. It is called autoruns and you can download this free small program at sysinternals.

Once downloaded, just run the file autoruns.exe and you can see all the programs that automatically runs from your system.

@madhu

In the case of USB flash drives, MP3 players (like your iPod and Creative), and external USB devices which have a storage here’s what you have to do.

1. First, open Folder Options from the Tools menu, in your explorer or any open folder.
2. Click the View tab and select the option Show hidden files and folders and uncheck Hide protected operating system files.
3. Click Apply, then Ok.
4. Plug your USB device while holding and pressing the SHIFT key from your keyboard. This is to prevent it from auto-running and spreading the virus. Wait until it stops reading before you release the SHIFT key.
5. Go to My Computer, and right-click the USB device from there. Choose the option explore, don’t choose autorun or open.
6. After opening the portable USB device. You can see the files related to the virus there. Delete the files that have names like these:

autorun.inf
SSCVIHOST.exe
blastclnnn.exe
New Folder.exe
__.vbs
__.exe
__.reg
funnyUSTscandal.avi.exe

or any other suspicious files you see.

After doing this, reset the setting I mentioned on #2.

The first four files above are from the Blaster Worm virus, and Sohana-D worm virus. Other files I’ve mentioned are from other types of worms and trojans that I’ve encountered in other infected USB devices. Remember that if you see any autorun.inf file in any type of external device like MP3 players, USB drives, memory cards, digital cameras and even mobiles phones, you have to delete it.

Sometimes, there are some devices that actually use this file. As a precaution, you can open autorun.inf in notepad to see its contents. If the filenames mentioned inside the files are suspicious, then look and find these named files, and then delete it.

If you are not sure if the autorun.inf file from your portable device is from a virus or a legit file. You can zip/rar (compress) it, as a backup, then delete it. That way if anything goes wrong, like your device doesn’t play anymore, you can restore it.

@madhu

It keeps coming back because the virus is actively running in the background and you haven’t entirely removed it. You have to do the process I mentioned in safe mode (the whole removal process of SSCVIHOST.exe).

Also you have to check your registry (regedit) and autorun (use the autoruns file from sysinternals I mentioned above) to remove and prevent it from auto-running.

You have to do all of this with your USB devices not plugged in. Make sure that the virus files are gone, use process explorer from sysinternals to check all active running processes..

@akash

I think you have another type of virus, since SSCVIHOST.exe doesn’t affect the hidden files settings. In any case, you can use the Remove Restrictions Tool by downloading it at sergiwa.com

@akash

I couldn’t guess what type of virus you have because there are many viruses with similar effect that you have now. Did you try out the tool I mentioned in my reply above? You really have to enable show hidden files and folders.

In DOS prompt, there is a way to see the hidden files. Just type dir/p/a:h then press enter

Thanks for that tool suggestion Rouie

@Rouie

May I ask from what source?

@Robin

The virus file SSCVIHOST.exe is removed, but Windows is still looking for the file because it is trying to load it. You have to manually remove the entry in your registry to stop the error.

To do this just follow the THIRD step I mentioned in the above guide in editing the registry.

@Robin

There are many causes for that error. The ones I can think of are: (1) some of your Windows system file is corrupted, and need to be replaced or re-installed, (2) there is a program that doesn’t exit properly and it is causing a stuck-up at shutdown, (3) a hard disk problem, try defragmenting or using scan disk.

I’ve encountered that problem a few years back, but I can’t seem to remember what I did to fix it. Or it just fixed it self.

@dorxie

I’ve done a quick research regarding your problem. Anyway, most of what you’ve already mentioned are true.

- The newfolder.exe on your desktop is definitely a virus. And any other “folder type” that has a .exe ,.com, or .bat, so it’s best to remove it.

- autorun.inf that exists in your root folder like c:\ is always a virus. Before you remove it, open it in notepad and make a note on which filenames it is executing, then delete it.

- twinz.exe (if my sources are correct) that is being executed by the autorun.inf file is a virus. According to various sources it is a custom made virus, that is why there are a lot of anti-virus softwares that hasn’t detected this virus yet.

- I did a search on the keyword “vanzame” and it didn’t return any relevant results. In short, it is not a legit file.

Regarding spools.exe

File spools.exe is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 2125312 bytes (37% of all occurrence), 260608 bytes, 64000 bytes, 671232 bytes, 1777152 bytes, 729088 bytes.
The file is a file without information about the maker of this file. It is not a Windows core file. The program is not visible. File spools.exe is an unknown file in the Windows folder. The program uses ports to connect to LAN or Internet. The process is loaded during the Windows boot process (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run). spools.exe is able to hide itself, record inputs, monitor applications, manipulate other programs. Therefore the technical security rating is 88% dangerous, however also read the users reviews.

I will post the possible solution on my next reply here.

@dorxie

Removing the twinz.exe virus, including newfolder.exe and spools.exe

The virus is both a trojan and a worm.

Here’s what you should do. But first remove any USB drives that are infected. And also you need to have the programs (1) Autoruns and (2) Process Explorer from sysinternals.

1. Start windows in Safe mode (F8).

2. Start regedit, then do a complete search. To do this, highlight My Computer on the regedit panel, then press CTRL+F. Remember to press F3 to continue searching. Search for these keywords:
newfolder.exe
twinz.exe
autorun.inf
If found, delete the entry. Just highlight it, then press DELETE key.

3. Start Process Explorer. Look at the running processes. If the above mentioned files exists, kill it. Also check if spools.exe is running, if it is highlight it to check if it is a legit Windows file or not. Read my comment above this one regarding spools.exe.

4. Start Autoruns. Look for the process that are running/executing the above mentioned files, including spools.exe. If they are found, delete it. Be careful in deleting spools.exe, if its publisher is Microsoft Corporation, then it is a legit file.

Check the spelling, sometimes virus makers tags a virus with almost the same spelling like Micro$oft Corp. or Yahoo Messengger. Always check the spelling.

5. You will have to delete the files from your hard drive very much like the SECOND and FOURTH steps I mentioned in the above guide (in removing SSCVIHOST.exe). But instead look for these files:
newfolder.exe
twinz.exe
autorun.inf

The SECOND method is using DOS mode. Since I don’t know exactly where the files are located you have to find them yourself. You can use the method similar in the FOURTH step since it is windows based and your folder options are already running.

5.1 Next, search your hard drive for the file: spools.exe. We can’t be too sure if it is legit or not, but just to be on the safe side, I would suggest you backup the file before deleting it. One way to back it up is to compress it in a .ZIP or .RAR file, that way it won’t execute easily.

5.2 Also check your other drive d:\ e:\ f:\ and so on for these files. Then SHIFT+DEL it so it won’t go to the recycle bin. Remember your root drive c:\ d:\ e:\ etc must not have any autorun.inf file

5.3 Remove the files from your USB devices like: USB drive, memory card, digital camera, mp3 players, and even your mobile phone. All of these can also be infected, believe me when I say that my MP4 player always got infected, and a friend’s mobile phone.

Remember to hold the SHIFT key when inserting USB devices to stop them from auto running and infecting your computer. All of the USB devices I mentioned above must not have an autorun.inf file on its root folder. But be careful, because there are some USB devices that actually use a legit autorun.inf file. So make a backup (ZIP/RAR), or check its contents by opening it in notepad.

6. Now all the registry entires, autoruns, processes, and the actual files are deleted, you can re start your windows normally.

————–
Also, like I always do, make a backup if you are not sure about what you are deleting. To backup the whole registry, just highlight my computer (in regedit), then select export on the file menu. So if anything happens, like you are getting errors and stuff, you can use the import (or just double click the exported file) function. To backup files, just ZIP or RAR it.

I also suggest using The Ultimate Troubleshooter. It shows all the process that are running, and also the startups. What I like about this program, is that it gives additional info and every little details on the known programs that are currently running. It is free and no installation needed.

Oh and please give a feedback of the results or anything that I’ve missed. I haven’t got a chance to encounter the virus you mentioned so I’m not entirely sure if the process I made is complete.

@Jan

What operating System are you using? Is that Windows XP, or another version of Windows? or another O.S.?

@geelah

Sorry for the late reply

1. A quick solution for your first problem (first post) is use Autoruns from Sysinternals, which you can download for free at technet.microsoft.com.

After you download the file, just double-click the file to start it. Then look for entries that match “DelFolders.exe” and “SSCVIHOST.exe” then disable it, or better yet delete it. You have to look in each tab and make sure you remove it.

2. The F8 menu appears on every version of Windows. Try restarting your computer then keep pressing F8 until a menu appears, and before Windows starts. If nothing happens, tell me what showed up on your screen.

3. Hmmm… I usually open this site early morning and late night, so I’ll be replying here. And yes I’m a Filipino.

Pahabol…

There are two possibilities I can think of regarding the F8 malfunction (not working).

But before we get to that, first try to boot normally in Windows, then Start your Run box, and type msconfig. Then go to BOOT.INI tab and check the box /SAFEBOOT

When you restart your computer, it will go into safe mode. Just do the process again in Windows safe mode, and uncheck the box to start back to normal Windows.

———-

If the above method doesn’t work…

1. You are using a USB keyboard, and not the old PS/2 type. If this is true, you have to go to your BIOS then go to setup utility and enable the USB legacy support. That should fix F8 key not working.

To go inside your BIOS, just restart your computer and as soon as the first message appear on your screen look down at the bottom part to see which key opens your BIOS, it can either be the DEL key or F2, or sometimes other keys. Press it as soon as you see it.

2. Another possible reason is the NTLDR file is missing or corrupted. Here is an excerpt on how to restore this.

to restore your missing NTLDR, boot from your XP installaton CD into the Recovery Console, at the command prompt type the following two commands, pressing Enter after each one:

copy d:\i386\ntldr c:\

copy d:\i386\ntdetect.com c:\

(In the command listed above, d: represents the drive letter assigned to the optical drive that your Windows XP CD is currently in. While this is most often d, your system could assign a different letter. Also, c:\ represents the root folder of the partition that Windows XP is currently installed on. Again, this is most often the case but your system could be different.)

If you’re prompted to overwrite either of the two files, press Y.

Take out the Windows XP CD, type exit and then press Enter to restart your PC.

Source: computing.net

@geelah

You can try using the tool above, but some anti-virus software detect the tool as trojan, which is just a false positive.

But to be safe, just follow the long instructions above. You can “save as” this page so you can open it when you are in safe mode, or you can just copy this in your notepad.

As an alternative, if you don’t want to use the Restrictions tool above, you can just download a registry entry I made to enable Regedit, Folder options and task manager.

Right-click and save target as…

Enable-Reg-Task.reg
Enable-Explorer-FolderTools.reg

After downloading, just double-click to merge it into your registry. And you can skip the second half of the Third step above.

About naman sa SSCVIHOST.exe babalik talaga yan hanggat hindi mo naalis lahat ng files niya sa computer mo. Yung tinanggal mo sa autorun, instructions lang yun para hindi umaandar yung virus, pero yung virus nandyan pa rin.

Just do the step-by-step process above to remove the virus completely.

Feel free to ask again anytime.

@geelah

Hello again

Since you’ve already managed to login under safe mode then that means you can do the necessary steps to remove the virus.

Don’t worry about the dialog boxes that appear since by the time you have removed traces of the virus it will be gone as well.

1. In your Msconfig, just go to the first tab (General) and select Normal Startup to revert to the original settings. ANd also go to BOOT.INI tab and uncheck /safeboot if you are not going to boot into safe mode.

2. Na disable ng virus yung task manager. Use the registry file I made. Yung link nasa top the comment mo ang names ay:

Enable-Reg-Task.reg
Enable-Explorer-FolderTools.reg

3. Para malaman mo na ikaw talaga yung administrator. Sa start menu, click mo lang yung image/picture sa tabi ng name mo. Yung nakalagay sa maliit na square sa taas ng start menu. Yung lalabas na window, click mo yung Home. Then “Computer Administrator” dapat nakalagay sa baba ng name mo.

4. Yung files na namention ko sa steps above yung kailangan alisin. Since yung SSCVIHOST.exe is a worm virus, hindi naman nya sisirain yung files mo, unless modified version yun. So wag mo na alisin yung mga files ng computer mo except yung virus files.

Yung delfolders.exe ay kasama ng virus, dapat alisin mo yung file manually sa safe mode. Yung SECOND step sa procedure ko sa taas, i-add mo dun sa steps na aalisin na files yung delfolders.exe like this

attrib -h -r -s delfolders.exe
del delfolders.exe

@geelah

Piliin mo lang yung hard disk mo, ST340014A then press mo ulit F8 para lumabas yung menu na galing sa Windows.

@Sylune

Yes, the spelling of the virus is often changed so that it would be a little harder to detect.

Anyway, to remove the virus from your PSP, here is what you should do.

1. Plug your PSP USB to your computer, while pressing and holding the SHIFT key so that the autorun won’t execute.

2. Then open it in your My Computer. Take note that DO NOT double-click the removable drive (which is your PSP drive). You have to right-click on the icon and choose explore. Double-clicking it will sometimes execute the virus.

3. Your Folder options settings should show all hidden files, and uncheck the hide system files . Just like the FOURTH step on the procedure above.

4. Delete autorun.inf on the root folder of your PSP, and any other file you see there. If my observations are correct on my own PSP, there wasn’t any file on the root drive of the PSP, except the two files (I forgot the name) which has a zero byte filesize.

5. Check also the other folders on your PSP if there are any file that has a .exe (Application) extension. You can see it if you view the files using Detailed View. Also check for dubious folders, there are some folders that have a .exe extension which is related to the virus.

6. Also be careful in deleting files. If you are unsure if the file should be deleted or not, just compress it using zip or rar so that you can restore it again. Delete the file in question and keep the compressed file as a backup.

@geelah

1. Yung svchost.exe normal lang yun, windows ang gumagamit nun kaya wag mo delete or end task.

2. yup pwede mo na skip yun

sa tingin ko ok na naman yung pc mo since yung mga files ng virus na dapat i delete mo ay wala na

@geelah

baka kailangan ng i maintenance yang PC mo, like reformat or defragment para bumilis. anyway, gawin mo yung step five sa taas para maalis yang error message na yan.

@micoh

it is because of a virus. if you want to use the cmd at the run box, just open another run box and type in

shutdown -a

don’t click Ok or press enter, just leave the box there, and just open another run box then type cmd to go to the dos box.

oh and that is caused by another type of virus, unfortunately, I forgot its name.

@Zef

1. You can download the file again and save it to your c:\ so you can easily locate it.

or as an alternative you can use the file I created Enable-Reg-Task.reg

Just richt-click, save file as, and when it is in your desktop, just double click it.

2. To check if the virus is still there you can use a free scanner like Malwarebytes.org

or check your registry by doing the 3rd step above and the fourth step above..

3. Since you are not getting the error anymore, It may also mean that the virus is gone. If you are running an anti-virus software, update it then scan your whole computer.

If you don’t have one, you can download a free trial of ESET NOD32 (which I highly recommend) then scan your laptop.

@Zef

As far as I know RRT doesn’t need to be installed. You can just delete the file where you placed it. also check your system tray if it is there. just right click on it, then select exit/quit.

If it is showing a popup window when your computer starts, check the following:

1. Your startup. Type msconfig in your run box, then go to startup tab. just uncheck it, if it is there.

2. Run regedit, then click edit, then find, and type the executable name of RRT. do a search, if it is found then delete the entry.

if you still have more questions feel free to post back

@jjmaki

That happens because the executable file is still being called from an autorun command.

1. First you have to enable your task manager and regedit.
Enable-Reg-Task.reg

right click the file above, save it, then double click the file to merge it to your registry. it should enable both the process.

2. go to safe mode. and follow the third and fifth step. task manager should be working as well as regedit.

jjmaki

It should work. BTW are you using Windows XP or some other OS?

@Super Genius

Try mo sa torrent sites. or search mo sa google yung keyphrase na “photoelf full crack”

@Super genius

thanks for the greeting.

@Zef

You can do the second and forth step (while in safe mode), but instead of searching for the SSCVIHOST.exe you can search for the virus file asdsdsd.exe

feel free to comment back here again

@geoffrey

from the third step above, you shouldn’t have deleted the explorer.exe from your registry. just do the third step above and add again explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
“Shell” = “Explorer.exe SSCVIHOST.exe”
(edit and remove the word SSCVIHOST.exe leaving only Explorer.exe, if you screw this up windows shell won’t show on your next boot)

to start your taskbar manually, press CTRL+ALT+DEL, then click File, New task run, then type, explorer.exe

@jjmaki

I can’t find the exact name of the virus you’ve got. But what exactly does the virus do? does it creates many files? is your folder options or task manager still working?

You can actually remove this virus on your computer if you log in to Safe Mode. Then make a thorough search on your computer by searching its filename and deleting it and also searching for the same name on your registry.

Feel free to ask again here, for more support