一、手工清除SVCHOST.EXE病毒

查看：svchost.exe進程是什么

在開始菜單的運行中輸入cmd，出現(xiàn)命令行提示，輸入命令“tasklist /svc >c:\1.txt”（例如：C:\Documents and Settings\Administrator>tasklist /svc >c:\1.txt），就會在C盤根目錄生成1.txt文件，打開1.txt可以看到如下內(nèi)容：
查找svchost.exe的PID值和服務(wù)名稱。
******************************************************************************
圖像名                       PID 服務(wù)                                        
========================= ====== =============================================
System Idle Process            0 暫缺                                        
System                         4 暫缺                                        
smss.exe                    1168 暫缺                                        
csrss.exe                   1228 暫缺                                        
winlogon.exe                1260 暫缺                                        
services.exe                1308 Eventlog, PlugPlay                          
lsass.exe                   1320 PolicyAgent, ProtectedStorage, SamSs        
ibmpmsvc.exe                1484 IBMPMSVC                                    
ati2evxx.exe                1520 Ati HotKey Poller                           
svchost.exe                 1544 DcomLaunch, TermService                     
svchost.exe                 1684 RpcSs                                       
svchost.exe                  380 AudioSrv, BITS, Browser, CryptSvc, Dhcp,    
                                 EventSystem, FastUserSwitchingCompatibility,
                                 helpsvc, lanmanserver, lanmanworkstation,   
                                 Netman, Nla, RasMan, Schedule, seclogon,    
                                 SENS, SharedAccess, ShellHWDetection,       
                                 TapiSrv, Themes, TrkWks, W32Time, winmgmt,  
                                 wscsvc, wuauserv, WZCSVC                    
btwdins.exe                  420 btwdins                                     
ati2evxx.exe                 456 暫缺                                        
EvtEng.exe                   624 EvtEng                                      
S24EvMon.exe                 812 S24EventMonitor                             
svchost.exe           &nbsp