SVCHOST.EXE denied access to files. Is it a virus?

[Hellen Keller: American Sniper]

Posting here is my last resort so I apologize.

I opened my pc and was given a notification saying that svchost.exe was blocked from accessing my files, (I have the option to manually allow and disallow things from editing files turned on) I looked up the problem and the most numerous answer was that svchost.exe was a legitimate process, it handles background stuff and 3rd party processes. I found its likely that svchost.exe, and probably some other processes, was infected by a virus. Since my computer's built-in virus detection (Microsoft defender) did not work. Does anyone know what I should do? How to find out specifically what svchost.exe is trying to access and what is making svchost.exe try to access those files? Is it possible that it was blocked from trying to encrypt files? I already plan to install malwarebytes in a bit, but before I do that I want to wait for any tips coming from this discussion post.

My PC runs on windows 10 and is currently shut off. I switched the power switch on the back of the box.

[Vince ✟]

You shouldn't be manually doing anything if you're asking questions like this. Digging in a PC is OK, but if it's your "last resort" it sounds like you're stressing over protection you likely don't need and likely doesn't work anyway. Just my opinion.

As for the task... its associated with a service you should likely allow.

Open your resource manager and associate the process id's with the tasks. Heck...I'm fairly certain task manager tells you what it's doing with a drop-down, hence my thoughts that this may be you causing your own stressful problems for yourself.

Resource manager will tell you. Sorry not trying to sound like a ♥♥♥♥. I'm sure there are more opinions to follow.


Services.msc will provide all running services you might be able to stop.

[Hellen Keller: American Sniper]

Początkowo opublikowane przez SOWER:

You shouldn't be manually doing anything if you're asking questions like this. Digging in a PC is OK, but if it's your "last resort" it sounds like you're stressing over protection you likely don't need and likely doesn't work anyway. Just my opinion.

As for the task... its associated with a service you should likely allow.

Open your resource manager and associate the process id's with the tasks. Heck...I'm fairly certain task manager tells you what it's doing with a drop-down, hence my thoughts that this may be you causing your own stressful problems for yourself.

Resource manager will tell you. Sorry not trying to sound like a ♥♥♥♥. I'm sure there are more opinions to follow.

I guess thanks for putting some of my anxiety to ease but, it's still really suspicious.

[Ⓥenom Ⓢnake 🐍]

If you are that worried, reboot in safe mode after you get malware bytes, run it, and if you have an alt AV, run it as well, then reboot. Svchost is exactly what you looked up says it is. It handles a collection of automated background services.

What it COULD be doing is trying to create a log in an administrative protected folder. It would need admin access to so that. But that really depends on your security settings.

[Kiddiec͕̤̱͋̿͑͠at 🃏]

SVC Host is the host process for services on Windows - so the issue isn't SVC Host itself but one of the services that you have installed & scheduled, which may be accessing stuff that it shouldn't be.

...or maybe your anti-virus or program permissions got confused about some things that were fine.

As annoying as it is, running some scans in safe mode shouldn't hurt.
If there's anything severe installed as a service, such as a rootkit, then the anti-virus scanners should be able to catch it ...probably. Chances are it was just some things that got mixed up, though.


You might want to also consider opening the start menu, typing "Run", choosing the "Run" program, and then typing "msconfig"; from there, you can check the "Services" & "Startup" tabs to see what sort of services your computer is running on schedules & at startup.

You should probably just check that box that says "Hide all Microsoft services" as you almost certainly don't want to turn off ANY of those.
I turned off 2 services & 1 startup item - because some of the stuff that comes installed with extra software that you add on to your computer is rather unnecessary.
Make sure you always understand what you're turning on or off before changing anything, though, otherwise you might find that you can no longer connect to your printer (although, this is usually as easy to fix as just turning the service back on later).

[Barney, from Black Mesa.]

Either you've blacklisted something crucial that is needed to function properly on your Windows system and has caused it to freak out; or that the question could be too broad to answer due to how broad the problem is and how many unknowns you could be experiencing right now.

Your best bet is to run safe-mode and backup your important files on an external hard-drive just in case it is some sort of ransomware that could possibly corrupt or lock you out of your personal files. Also, while you're on safe-mode see if anything unordinary is still happening to your system. If it is, then that means it is more likely safer to assume that it was because you've modified a permission or file within the system that you shouldn't have touched and it has caused the system to operate in a dysfunctional manner.

The solution to this problem might be too technically specific to fix as we don't know what you have manually allowed or disallowed within on your system or what software you've downloaded ("and granted full-access") that has edited system permissions or specific files. I wouldn't personally disallow the system from interacting with potentially important files or if you've modified svchost.exe to operate in a specific way and block certain files.

Your best course of action due to how unknown this situation is that I'd recommend to you after you've backed up your important files (through safe-mode) is to do one of two things:

1. Factory reset your computer. "This will remove all of your personal edits, permissions & possibly interfering viruses - however this will solve your issue at the cost of losing all of your files if you haven't backed them up already."
   
   
2. Take it to a computer repair shop. "This will cost you money but if you paid someone who is specialised in Windows repairs to dig through your PC to identify the problem then this result could be as equally effective without having to Factory reset the computer because your problem seems to be too broad or specific to what has happened within on your computer."

I would recommend just doing a factory reset through safe-mode because what-ever you've done on your computer and the options that you've supposedly explored on the internet hasn't worked and this might be a problem that is beyond anyone could offer to help you because it was a problem that was possibly caused by you editing the system permissions and we don't know what you've touched so we can't give you more specific answers.

No virus scanning software will help you solve this issue, Windows Defender is pretty A-grade for its ability to identify malware & viruses within the Windows platform. If this virus has bypassed Windows Defender & the Microsoft safety scanner then you can guarantee that this Malwarebytes or any-other paid virus services are not going to work more in you favour.

If you're dead-set on using an alternative virus scan then you'd be better off just using https://www.virustotal.com/gui/home/upload to scan individual files that you suspect are infected to identify this problem, but I doubt that it is a virus problem if you've tinkered with crucial system permissions.

[↑↑↓↓←→←→BASelect]

Launch the command prompt as an Administrator and navigate through the tree of folders you need to fix. Then launch the command ICACLS * /T /Q /C /RESET . ICACLS will reset the permissions of all the folders, files and subfolders. After a while, depending on the number of file, the permissions will be fixed.