How to remove Systemservice.vbs (update)

This brief article is created to help those users who encountered the mysterious SystemService.vbs infection on their computers. Now we’ll explain what is SystemService.vbs, from where it came and where it went. We will also clarify the question of your system’s security.


 Systemservice.vbs pop-up


Let’s start from the very beginning: from the red flag of infection. Usually, users are starting to notice the virus in the system when something goes wrong. Viruses are very stealthy, and when they’re working properly the device is functioning in a regular mode, but when some mistake occurs – the virus starts to lag and generate failures, as any common program does. In case of SystemService.vbs users are starting to see a notification, right after the system boot. The notification says that the SystemService.vbs scenario can’t be executed. It goes on each time you start the PC, but you can’t find the reason, as the specified folder is empty. By the way, the name of the scenario might be different, but it will always have .vbs extension, which means that it’s a Visual Basic script. And, by the way, you shouldn’t worry, as there is no virus on your PC. Well, maybe there are some, but the SystemService.vbs is already removed.


You might get interested right now, so here’s the catch: you see the notification because the virus is already removed. Now, when the crypto-currency is on its rise, many people started to distribute the illegal mining programs that are wasting your computer’s power and the electricity that you pay for, and mine Bitcoins or some other coins for these so-called “hackers”. Most likely, you had some sort of a mining program, but it was deleted by the daily cleaning process, initiated by your AV tool. Then why do you see a window? It’s simple: the virus is gone, but to execute it, scammers created a scheduled task that will launch a virus after each boot of the system.


You might have an antivirus, or a system optimizer tool (something like CCleaner) that, most possible, removed the initial SystemService.vbs virus. Unfortunately, not all AV-tools are able to clean the scheduled tasks, and the one left to irritate you. It is set to launch the virus each time when you boot the system, and it doesn’t care about the absence of the virus itself – it still tries to launch something. That’s why you see the notification that bothers you. Such task can be found in the Task Scheduler, and the actual cure against the SystemService.vbs virus is to go to the Task Scheduler (just type “task” in the Windows search bar and pick the first option), and search for a suspicious task. Usually, the number of tasks depends on the quantity of programs that you have in the system. On an average home PC, you’d expect to see between five and ten of them. If you have more – you should check each of them, and inspect the files and folders to which they approach. If you see a task with a misspelled name or with unclear purpose – it’s probably the one that you need. Just check the related folders, and if they’re empty – delete the task and perform another cleanup on your AV-tool.


We hope that our article helped you to understand what SystemService.vbs virus is and how it appeared on your device. Actually, the virus itself appeared there in a usual way: through the bundled installation, with the pirated media content or software from untrusted websites or torrents. Even more, the virus functioned in the system for who-knows-how-long, until it was accidentally removed by your antivirus, and within the time of its work, it might make lots of money for scammers, using your electricity and the resources of your computer. We strongly recommend you to be more attentive on the Web and to think twice before you download any program that’s not licensed and doesn’t come from an official website.

Virus removal instruction

Step 1. Boot the system into safe mode

  • Press Start
  • Type Msconfig and press Enter

Safe mode. Step 1


  • Select Boot tab

Safe mode. Step 2



  • Select Safe boot and press Ok

More information about Safe mode: What is Safe Mode and how to boot computer in Safe Mode


Step 2. Show all hidden files and folders

  • Press Start
  • Click on Control Panel

Show hidden files. Step 1


  • Select Appearance and Personalization

Show hidden files. Step 2


  • Click on Folder Options
  • Select View tab
  • Select Show hidden files, folders and drives

Show hidden files. Step 3


  • Press Ok


Step 3. Remove virus files


Check next folders to find suspicious files:

  • %TEMP%
  • %ProgramData%


Step 4. Fix hosts file

  • Go to %SystemRoot%\System32\drivers\etc\ folder



  • Open hosts file using Notepad or other text editor
  • Delete suspicious elements
  • Basic hosts file looks like this:



Step 5. Clean registry (for experienced users)

  • Click Start
  • Type Regedit.exe and press Enter
  • Clean startup registry keys
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunServices
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Step 6. Scan computer with antivirus


Here comes a safe and efficient way to delete Trojans using Spyhunter AV program. This tool will not only clean the device of all currently available undesired software on it, but in the same time secure it from other similar problems. Spyhunter operates without customer involved, and to remove Systemservice.vbs you will only have to purchase the program, set it up and start it. We think that this technique is a priority, because it is difficult for an ordinary customer to find which of the folders in the system is dangerous. By deleting the system file, you might easily affect the PC, and provoke its critical fault. If you doubt the efficiency of Spyhunter, you can check the program yourself by getting a free scanner.


Special Offer

Download Spyhunter - Anti-malware scanner

We advise downloading SpyHunter to see, if it can detect malware for you.

Spyhunter has a biggest malware database

It protects the system against all kinds of threats: Trojans, adware and hijackers

24/7 Free Support Team

SpyHunter scanner detects threats and malware for free, but to remove infected elements you need to purchase a full version of program for 39.99$. More information about Spyhunter, EULA and Privacy policy.


Step 7. Disable Safe Mode and restart computer

  • Press Start
  • Type Msconfig and press Enter
  • Select Boot tab
  • Remove the check near Safe boot


Video with trojan virus





Share your feedback to help other people
1 1 1 1 1 1 1 1 1 1 Rating 0.00 [0 Votes]

Add comment

Security code



Acronis suggestion to CrashPlans users

Around a month ago, there was an accident with CrashPlans backup software.

What is MicTrayDebugger and is it dangerous

This is a brief entry about MicTrayDebugger: what is it, how it appeared in the system, is it dangerous and how to get rid of it.

What is HoeflerText and is it dangerous?


This article is dedicated to the fraud scheme that is called HoeflerText font wasn't found. We will explain you what is this scheme and how to avoid it.

What is Wpad.dat virus and how it is used

The topic of our today's article is a script that had been unjustly called a virus. It’s Wpad.dat, and it is not a virus. We will explain what is Wpad.dat and how to prevent fraudsters to deceive yourself with its help.


Cancer virus trollware

This is an article about crazy Cancer virus and the madness that it brings to victim's computer.

This website uses cookies to improve your experience