一、手工清除SVCHOST.EXE病毒

查看：svchost.exe进程是什么

在开始菜单的运行中输入cmd，出现命令行提示，输入命令“tasklist /svc >c:\1.txt”（例如：C:\Documents and Settings\Administrator>tasklist /svc >c:\1.txt），就会在C盘根目录生成1.txt文件，打开1.txt可以看到如下内容：
查找svchost.exe的PID值和服务名称。
******************************************************************************
图像名                       PID 服务                                        
========================= ====== =============================================
System Idle Process            0 暂缺                                        
System                         4 暂缺                                        
smss.exe                    1168 暂缺                                        
csrss.exe                   1228 暂缺                                        
winlogon.exe                1260 暂缺                                        
services.exe                1308 Eventlog, PlugPlay                          
lsass.exe                   1320 PolicyAgent, ProtectedStorage, SamSs        
ibmpmsvc.exe                1484 IBMPMSVC                                    
ati2evxx.exe                1520 Ati HotKey Poller                           
svchost.exe                 1544 DcomLaunch, TermService                     
svchost.exe                 1684 RpcSs                                       
svchost.exe                  380 AudioSrv, BITS, Browser, CryptSvc, Dhcp,    
                                 EventSystem, FastUserSwitchingCompatibility,
                                 helpsvc, lanmanserver, lanmanworkstation,   
                                 Netman, Nla, RasMan, Schedule, seclogon,    
                                 SENS, SharedAccess, ShellHWDetection,       
                                 TapiSrv, Themes, TrkWks, W32Time, winmgmt,  
                                 wscsvc, wuauserv, WZCSVC                    
btwdins.exe                  420 btwdins                                     
ati2evxx.exe                 456 暂缺                                        
EvtEng.exe                   624 EvtEng                                      
S24EvMon.exe                 812 S24EventMonitor                             
svchost.exe           &nbsp