Annoying backdoor virus

-Peper- · Jun 13, 2011

Yesterday I had to reinstall Windows. When I logged in, everything was laggy. And check it out, 109 processes! There are 80 svchost.exe process and the REAL one was only 7 (it's ran by system).
I encountered this before, but not 80. I thought to myself 'Be patient, I'll just use the microsoft malware removal tool.' and heck, I couldn't even right click (because of laggy) and forced me to restart it.
I booted in safe mode, which only had 10 processes. I scanned using Avira, spybot, and microsoft malware removal tool. But no detections (because it's on safe mode?) couldn't run those on normal mode, too laggy.
Any suggestion?

Ironside · Jun 13, 2011

Well if what you say is true, then you installed a backdoored Windows installation.
In which case just get another Windows installation, as a backdoored one is not worth the effort of fixing (some might not even be possible to remove depending on how well the OS was backdoored).

Tleno · Jun 13, 2011

Ironside said:
Well if what you say is true, then you installed a backdoored Windows installation.
In which case just get another Windows installation, as a backdoored one is not worth the effort of fixing (some might not even be possible to remove depending on how well the OS was backdoored).

So you say that, well, he has a pirated version of Windows?

-Peper- · Jun 13, 2011

Nope, original CD which I borrowed.
Now I had to always run in safe mode in order to evade them.

Tleno · Jun 13, 2011

Still, if it still is acting like infected after reinstall, it means it's, as Ironside told you, backdoor'd.

Ironside · Jun 13, 2011

-Peper- said:
Nope, original CD which I borrowed.
Now I had to always run in safe mode in order to evade them.

Chances are that your friend is lying (about the it's original or he was tricked, ...).
Anyway as said, if anything is wrong after a fresh format then the OS is backdoored, so I suggest getting another Windows installation.

-Peper- · Jun 13, 2011

It seems the installation itself that backdoored. But strangely when I first installed windows (using the same cd) the files were okay.
Could Windows Update relieve this? (as the important svchost.exe infected)

Ironside · Jun 13, 2011

-Peper- said:
It seems the installation itself that backdoored. But strangely when I first installed windows (using the same cd) the files were okay.
Could Windows Update relieve this? (as the important svchost.exe infected)

Look, if it wasn't the same the first time, then you downloaded or got infected somehow else.

Dr Super Good · Jun 15, 2011

Its normal for windows to have a gazillion svchosts.

I have 13 running at the moment on this very machine. My old computer had like 30.
A lot of them are created by antivirus software.

-Peper- · Jun 15, 2011

Dr Super Good said:
Its normal for windows to have a gazillion svchosts.

I have 13 running at the moment on this very machine. My old computer had like 30.
A lot of them are created by antivirus software.

The 80 were running under my Username, and I can stop it without warning (the real one will warn you). But then they came again.

Tleno · Jun 15, 2011

-Peper- said:
The 80 were running under my Username, and I can stop it without warning (the real one will warn you). But then they came again.

If it's not System, Local Service or Network Service, but your username, then yes, those are viruses. Definetly.

Oh, so it's ok for Windows to have lots of svchosts, DSG? Thanks, I was kinda concerned about those... I don't have much of them, but they do draw some suspicion from time to time.

Ironside · Jun 15, 2011

tleno said:
If it's not System, Local Service or Network Service, but your username, then yes, those are viruses. Definetly.

Oh, so it's ok for Windows to have lots of svchosts, DSG? Thanks, I was kinda concerned about those... I don't have much of them, but they do draw some suspicion from time to time.

Yes, DSG is right, let me warn you though, local service svchost can be a virus too. I don't remember for the other two you mentioned currently.

Tleno · Jun 15, 2011

Well, I checked them and stuff and they all are fine... no suspicious activities, checked them with specific software for their action... nothing that would tell it's a malware.

Ironside · Jun 15, 2011

tleno said:
Well, I checked them and stuff and they all are fine... no suspicious activities, checked them with specific software for their action... nothing that would tell it's a malware.

Well, then you're safe :thumbs_up:

.

s4nji · Jun 15, 2011

Maybe this could help?
http://svchostviewer.codeplex.com/

-Peper- · Jun 15, 2011

@S4nji
It didn't hold them off, anyway thanks.
Guys this is awkward, safe mode isn't really safe. The virus disabled Task manager and regedit. Luckily my local antivirus got an option to force open them. Killed them with Windows Malware remover.
Now, only the 80 svchost left.

Tleno · Jun 15, 2011

Well, good news with that at least, I guess.

-Peper- · Jun 18, 2011

Believe or not, I killed it myself.
It was running from C: WINDOWS - System32(the real one is here) - install - svchost.exe and I disable the process on msconfig.

Ironside · Jun 18, 2011

-Peper- said:
Believe or not, I killed it myself.
It was running from C: WINDOWS - System32(the real one is here) - install - svchost.exe and I disable the process on msconfig.

Look at that, you were infected by a Cybergate server after all.
Anyway well done :thumbs_up:

-Peper- · Jun 18, 2011

Whoa, he is not alone. Everytime I deleted it, a new one came. It was from C:\Doc and Settings\Peper\Application data\install\svchost.exe.
Deleted it and I saved the day

Ironside · Jun 18, 2011

-Peper- said:
Whoa, he is not alone. Everytime I deleted it, a new one came. It was from C:\Doc and Settings\Peper\Application data\install\svchost.exe.
Deleted it and I saved the day

Off course, cybergate will recreate itself whenever deleted. There are ways around it though.

Annoying backdoor virus

Similar threads