Annoying backdoor virus

[-Peper-]

Yesterday I had to reinstall Windows. When I logged in, everything was laggy. And check it out, 109 processes! There are 80 svchost.exe process and the REAL one was only 7 (it's ran by system).
I encountered this before, but not 80. I thought to myself 'Be patient, I'll just use the microsoft malware removal tool.' and heck, I couldn't even right click (because of laggy) and forced me to restart it.
I booted in safe mode, which only had 10 processes. I scanned using Avira, spybot, and microsoft malware removal tool. But no detections (because it's on safe mode?) couldn't run those on normal mode, too laggy.
Any suggestion?

 

[Ironside]

Well if what you say is true, then you installed a backdoored Windows installation.
In which case just get another Windows installation, as a backdoored one is not worth the effort of fixing (some might not even be possible to remove depending on how well the OS was backdoored).

 

[Tleno]

Well if what you say is true, then you installed a backdoored Windows installation.
In which case just get another Windows installation, as a backdoored one is not worth the effort of fixing (some might not even be possible to remove depending on how well the OS was backdoored).

So you say that, well, he has a pirated version of Windows?

 

[-Peper-]

Nope, original CD which I borrowed.
Now I had to always run in safe mode in order to evade them.

 

[Tleno]

Still, if it still is acting like infected after reinstall, it means it's, as Ironside told you, backdoor'd.

 

[Ironside]

Nope, original CD which I borrowed.
Now I had to always run in safe mode in order to evade them.

Chances are that your friend is lying (about the it's original or he was tricked, ...).
Anyway as said, if anything is wrong after a fresh format then the OS is backdoored, so I suggest getting another Windows installation.

 

[-Peper-]

It seems the installation itself that backdoored. But strangely when I first installed windows (using the same cd) the files were okay.
Could Windows Update relieve this? (as the important svchost.exe infected)

 

[Ironside]

It seems the installation itself that backdoored. But strangely when I first installed windows (using the same cd) the files were okay.
Could Windows Update relieve this? (as the important svchost.exe infected)

Look, if it wasn't the same the first time, then you downloaded or got infected somehow else.

 

[Dr Super Good]

Its normal for windows to have a gazillion svchosts.

I have 13 running at the moment on this very machine. My old computer had like 30.
A lot of them are created by antivirus software.

 

[-Peper-]

Its normal for windows to have a gazillion svchosts.

I have 13 running at the moment on this very machine. My old computer had like 30.
A lot of them are created by antivirus software.

The 80 were running under my Username, and I can stop it without warning (the real one will warn you). But then they came again.

 

[Tleno]

The 80 were running under my Username, and I can stop it without warning (the real one will warn you). But then they came again.

If it's not System, Local Service or Network Service, but your username, then yes, those are viruses. Definetly.

Oh, so it's ok for Windows to have lots of svchosts, DSG? Thanks, I was kinda concerned about those... I don't have much of them, but they do draw some suspicion from time to time.

 

[Ironside]

If it's not System, Local Service or Network Service, but your username, then yes, those are viruses. Definetly.

Oh, so it's ok for Windows to have lots of svchosts, DSG? Thanks, I was kinda concerned about those... I don't have much of them, but they do draw some suspicion from time to time.

Yes, DSG is right, let me warn you though, local service svchost can be a virus too. I don't remember for the other two you mentioned currently.

 

[Tleno]

Well, I checked them and stuff and they all are fine... no suspicious activities, checked them with specific software for their action... nothing that would tell it's a malware.

 

[Ironside]

Well, I checked them and stuff and they all are fine... no suspicious activities, checked them with specific software for their action... nothing that would tell it's a malware.

Well, then you're safe .

 

[s4nji]

Maybe this could help?
http://svchostviewer.codeplex.com/

 

[-Peper-]

@S4nji
It didn't hold them off, anyway thanks.
Guys this is awkward, safe mode isn't really safe. The virus disabled Task manager and regedit. Luckily my local antivirus got an option to force open them. Killed them with Windows Malware remover.
Now, only the 80 svchost left.

 

[Tleno]

Well, good news with that at least, I guess.

 

[-Peper-]

Believe or not, I killed it myself.
It was running from C: WINDOWS - System32(the real one is here) - install - svchost.exe and I disable the process on msconfig.

 

[Ironside]

Believe or not, I killed it myself.
It was running from C: WINDOWS - System32(the real one is here) - install - svchost.exe and I disable the process on msconfig.

Look at that, you were infected by a Cybergate server after all.
Anyway well done

 

[-Peper-]

Whoa, he is not alone. Everytime I deleted it, a new one came. It was from C:\Doc and Settings\Peper\Application data\install\svchost.exe.
Deleted it and I saved the day

 

[Ironside]

Whoa, he is not alone. Everytime I deleted it, a new one came. It was from C:\Doc and Settings\Peper\Application data\install\svchost.exe.
Deleted it and I saved the day

Off course, cybergate will recreate itself whenever deleted. There are ways around it though.