Svchost.exe Virus Unable to clean Help

[keencomputer]

I have bunch of SVChost.exe running- Avg says it is Trojan and Malwarebytes is unable to clean them Any suggestions. Cheers.

Tapas Shome System Software Engineer Keen Computer Solutions 1408 Erin Street Winnipeg, Manitoba Canada R3E 2S8 http://www.keencomputer.com www.ias-research.com/blog

[Dario Solera]

I say we take off and nuke from orbit. That's the only way to be sure. Really, I would format the system and reinstall everything from scratch.

If you truly believe you need to pick a mobile phone that "says something" about your personality, don't bother. You don't have a personality. A mental illness, maybe, but not a personality. [Charlie Brooker] ScrewTurn Wiki, Continuous Localization and My Startup

[DaveAuld]

I would start in SafeMode, then start with a check using usual candidates; ccCleaner, HiJackThis and AdAware, then full system scan. Check the System/System32 etc. for recent files (sort by date) with strange names and/or strange file properties and rename/nuke Check msconfig, to see what is in the startup/run. Check Registry for files in the Run, RunOnce and other similiar locations.

Dave Don't forget to rate messages!
Find Me On: Web|Facebook|Twitter|LinkedIn
Waving? dave.m.auld[at]googlewave.com

[leppie]

Go into Services, and look for suspicious services. Disable them. Delete the service executables (or registry entries). Delete the service entries. If you have a rootkit, go into Device Manager, click 'show hidden devices', go into Non-Plug-and-Play, and do the same as above. Note: Dont delete anything, unless you are 100% sure. So check the executables, etc.

xacc.ide
IronScheme - 1.0 RC 1 - out now!
((λ (x) `(,x ',x)) '(λ (x) `(,x ',x))) The Scheme Programming Language – Fourth Edition

[Mark_Wallace]

DELETE! DELETE! WE DON' NEED NO STEENKIN' LIBRARIES!!!

I wanna be a eunuchs developer! Pass me a bread knife!

[LloydA111]

Do all of the above suggestions :) And, I would recommend using SysInternals Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx[^] It shows you what applications svchost.exe is running :)

---

Programming is 10% science, 20% ingenuity, and 70% getting the ingenuity to work with the science. WYSIWYMGIYRRLAAGW: What You See Is What You Might Get If You’re Really Really Lucky And All Goes Well.

[Lost User]

Nukes are so old fashioned, pull a couple of asteroids out and turn thme into dinosaur killers. :cool:

Join the cool kids - Come fold with us[^]

[Lost User]

Use this [^] tool to examine dlls loaded into each process and look for suspicious ones.Use this[^] to see list of installed drivers and look for suspicious ones.See nodes under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key which contains programs started automatically on OS start-up.Open task manager and look for processes which names are very close to standard windows processes names- for example (L)lsass.exe is Local security authentication server but (I)Isass.exe is well-known trojan.

Life is a stage and we are all actors!

[RugbyLeague]

I had something a while back which caused svchost.ece to run at 99% of cpu - AVG didn't know what to do with it so I booted in safe mode and installed and ran microsoft's security essentials anti-virus - it cleared it up.

[Yusuf]

Another couple of tools which I found very useful ComboFix [^]and SdFix[^]

Yusuf May I help you?