Win32/Neshta, also known as Neshuta, is a Windows file-infecting virus. Documented variants prepend viral code to executable files and alter the system's EXE launch handling so the virus can run when programs start. One active infection can modify many legitimate applications across local and writable connected drives.
How Neshta infects Windows executables
Microsoft describes Virus:Win32/Neshta.C as a prepending file virus. Instead of merely dropping a separate Trojan beside an application, it adds its code to the beginning of executable host files. When an infected program starts, the viral code runs first and then launches a clean copy of the original host behavior.
- An infected EXE is launched.
- Neshta places its main component in the Windows environment and changes EXE launch handling.
- The virus searches eligible drives for more Windows executable files.
- Its code is prepended to those files, changing their size and hash.
- Running or copying infected executables continues the cycle on other systems.
Historical variants used names such as svchost.com and modified the registry command used to open EXE files. These are useful investigation clues for matching variants, but responders should rely on current security telemetry rather than delete files based only on a familiar name.
Neshta vs a standalone Trojan
| Standalone Trojan | Neshta file infector |
|---|---|
| Often removed by quarantining one malicious executable and its persistence | May have modified many legitimate executable host files |
| Clean applications usually remain unchanged | Applications can become carriers and be detected later |
| Restoring one removed file may be sufficient | Restored EXEs can be reinfected while the resident component remains active |
| Scope follows the payload's installed files | Scope includes local drives, writable shares, removable media, and executable backups |
Warning signs
- many unrelated EXE files are detected as Neshta or Neshuta;
- application files change size or modification time without a vendor update;
- clean installers or programs become detected again after restoration;
- detections appear on writable shared storage or external drives;
- programs stop launching after security software removes infected host files;
- the EXE open command or related Windows settings change unexpectedly.
How to remove Neshta safely
- Contain writable locations. Disconnect the affected system from network shares and removable storage. Restrict write access to contaminated software repositories.
- Separate data from programs. Preserve documents, photos, and other non-executable personal data. Do not carry EXE, SCR, installers, scripts, or unknown archives into the clean backup set without scanning.
- Scan from a trusted environment. Use an approved offline or boot-time scanner so the active component cannot keep modifying restored files.
- Follow vendor remediation. Some products can disinfect supported host files, while others quarantine or delete them. Review the action before accepting mass deletion.
- Replace programs from known-good sources. Reinstall Windows components and applications from official media, clean deployment images, or verified downloads.
- Scan the entire scope. Check other endpoints, shared folders, removable drives, archives, and backups that contain executables.
- Restart and verify. Perform another full scan and monitor file changes before reconnecting the system to writable shares.
When to reimage the computer
A clean reinstall is safer when system files are widely modified, reliable disinfection is unavailable, programs repeatedly break after cleanup, or the integrity of the operating system cannot be demonstrated. In a business environment, rebuild all affected endpoints from a known-good image and clean software-distribution sources before returning them to service.
Do not erase the only disk before preserving irreplaceable non-executable data and the evidence needed to understand which shares or devices were exposed.
Frequently asked questions
Can Neshta infect documents and photos?
Its defining targets are Windows executable files. Personal documents are not the same type of carrier, but scan them before restoration because another malware family may be present.
Why do detections keep returning?
An active resident component, infected executable, writable share, removable drive, old installer, or backup can reintroduce the virus. All carriers must be handled together.
Should I manually delete svchost.com?
Do not delete a file solely by name. Confirm its path, hash, detection, and role with a trusted scanner; manual removal can miss the launch modification and infected host files.