A little while ago my home machine got hit and I was able to clean out just about everything except this one process. I can't find the origin but it shows in my process manager as scvhost.net by the SYSTEM user. It gradually takes up more of my memory and sometimes plays what seem like random audio tracks. I can shut down the process but within a minute it will start up again. I've tried several fixes I found through google searches but nothing seems to work. Any ideas?
closed as off topic by Gilles, Rook, Scott Pack, Terry Chia, Iszi Nov 5 '12 at 14:30
Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.
If you are able to see the process and even terminate it, it's not protecting itself too well. Even if the only way to be sure you're eradicated the virus is a clean reinstall, chances are that the infection isn't technically very advanced and may be eliminated with "reasonable" certainty.
I assume you already tried with System Restore and had no luck. If you didn't try, verify whether you can revert the system to a state preceding the infection. If you could, that would be something you might want to try (but see at bottom for a caveat).
Otherwise, start by grabbing a tool like Process Explorer and display the process tree after a clean (well, dirty...) reboot. You will be able to see the
So first you check the scvhost object.
If its parent is an "unknown" binary, not part of the Windows system, you can "suspend" both parent and child. Neither will react, since you killed neither (yet). If the parent is "services.exe" (and it's the real services.exe), then your infection has disguised itself as a service, and you need to suspend the child only.
In the service scenario, open the Services console, set it to "Do not restart if terminated", and disable the service so it doesn't run at boot. Then kill the child process (having been suspended, it shouldn't be able to notice the settings being changed and change them back), and try rebooting. See the note at bottom for a caveat first, though.
If it wasn't a service, look on the disk for the parent process (Process Explorer usually tells you where the process started from). In these setups, the parent has the only tasks of launching the child and overwatching, and trying not to attract attention. You might not find the child executable (might not even be a file on its own), but you should be able to remove the parent. Look for its name in the usual places in the Registry (or you might want to also try Autoruns).
Before doing this, verify you do have a current backup of your data files. It is conceivable that the infection might have either rendered the system unstable, or purposely booby-trapped it, and this rather brutal removal might trigger something unpleasant.
Check for the parent process( process tree) and end it. Be sure to download applications from only trusted sites and ALWAYS have an updated Anti virus.
I think you'll find this type of question more suited to superuser or similar site for tech-level work. That said, when I was more involved with malware removal, there were some basic tactics.
First, be sure of the exact OS version you're using (for example if windows xp, then home, pro, etc. or if win 7, then which home, pro, ultimate, etc.). Some older OS's are more prone to corruption and other issues. This will also help you decide which tools specifically to download to deal with that particular malware.
Second, figure out what service pack of the OS you've got versus what is the most recent version of that. Any lapse (at all) in updates, hotfixes, etc can leave your machine almost totally at the mercy of something new that isn't picked up by heuristics on an AV. In fact, updates are typically more important than AV in securing a machine and I've seen issues that kept returning after AV scans but were successfully neutralized after updates and hotfixes were installed.
Third, don't keep downloading every little app to try to fight it since those can be cleverly disguised versions of other viruses or just simply not work and leave you with spyware or other inconveniences. Similarly, be careful what you do on that machine as it could be hiding other malware that could be doing more than just playing music at inconvenient times (for example, logging your passwords, etc.).
There's entire chapters of books written about dealing with viruses and other malware, so it's somewhat beyond the scope of this post. But you can start with this.
This question is probably not a good fit for this site, as it is too narrow and localized (not likely to be of relevance to others), and it doesn't provide enough information to diagnose the problem.
That said, generally speaking, the procedure is as follows: