Mysterious Svchost.exe Files

Discussion in 'malware problems & news' started by ervz, Apr 16, 2008.

Thread Status:
Not open for further replies.
  1. ervz

    ervz Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    6
    Hello,

    I posted the other day on the other page but I think this is the right one.

    Ok, something hit my PC last week and eventually crashed. I noticed some mysterious files like svchost.exe, pagefile (taking huge file size), and some new folders like RECYCLER & Sys.Vol.Info. - And they are all protected, I cannot delete them!

    I suspected something is wrong because they appear on all of my drives just outside the folders. also, I noticed that I cannot open my drives by double-clicking it. I have to view in folders mode or explore menu.

    I tried scanning with ESET (updated!) but it cannot find anything wrong!

    I thought everything will be back to normal after a fresh reformat of my system drive. BUT IT IS HAPPENING AGAIN!

    What is causing this?
    How can I get rid of this?

    Please, help me!

    ----------------
    WinXP Pro, SP2
    Pentium4, 3.20 GHz, 2 Gig RAM
     

    Attached Files:

    Last edited: Apr 16, 2008
  2. ervz

    ervz Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    6
    I submitted the same file to VIRUSTOTAL and this is the result.
    Please explain this to me.

    EC edit: Removed Virustotal results. Please read our TOS.
     
    Last edited by a moderator: Apr 17, 2008
  3. osip

    osip Registered Member

    Joined:
    Oct 25, 2006
    Posts:
    610
    Everything with the name of svchost.* which is to be found outside *\windows\system32 has to be regarded as malware. Try Trojan remover to get rid of it !(Pagefile.sys,sys vol info are legit and can´t be removed)
     
  4. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    I can see autorun.inf files. Probably u got it from a removable media, most likely an infected USB memory stick. Culprit is svchost. Pagefile, Sys.Vol.Info and Recycler are legitimate.

    U can run a scan with Antivir free or AVG AS free.
     
  5. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    Is it detected by NOD32? If not, scan with Bitdefender Online Scanner (if you don't want to install another security application).

    thanatos
     
  6. ervz

    ervz Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    6
    thanks guys.

    you're right Aigle. I think I got it from a USB flash disk that I tried to clean last week. I noticed the same monkey icon (svchost.exe)!

    So you think AVG or other apps can kill it? Will they actually remove those files and bring my hard drives back to normal functionality?

    we bought several ESET licenses for our office. In order to try others, I guess I need to uninstall it, right?

    I actually downloaded a free VGA already, just in case.

    Thank you.


    ervz
     
  7. osip

    osip Registered Member

    Joined:
    Oct 25, 2006
    Posts:
    610
    Can you boot ? If you can´t boot up you have to try with a AV rescue cd...In these cases it´s wise to have a fresh image to restore to...
     
  8. ervz

    ervz Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    6
    I can boot fine right now but i know there is something wrong with my system.
    I am now uninstalling ESET to try AVGfree.
     
  9. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    Check on VirusTotal, if Dr.Web is detecting it, u can use DrWeb Cureit. It,s free and does not need an install.

    I sent u a PM.
     
  10. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    I think so. Try AVG Antispyware.
     
  11. osip

    osip Registered Member

    Joined:
    Oct 25, 2006
    Posts:
    610
Loading...
Thread Status:
Not open for further replies.