Infection I can't shut down, disguises process as scvhost.exe [closed]

Question

A little while ago my home machine got hit and I was able to clean out just about everything except this one process. I can't find the origin but it shows in my process manager as scvhost.net by the SYSTEM user. It gradually takes up more of my memory and sometimes plays what seem like random audio tracks. I can shut down the process but within a minute it will start up again. I've tried several fixes I found through google searches but nothing seems to work. Any ideas?

Answer 1

If you are able to see the process and even terminate it, it's not protecting itself too well. Even if the only way to be sure you're eradicated the virus is a clean reinstall, chances are that the infection isn't technically very advanced and may be eliminated with "reasonable" certainty.

I assume you already tried with System Restore and had no luck. If you didn't try, verify whether you can revert the system to a state preceding the infection. If you could, that would be something you might want to try (but see at bottom for a caveat).

Otherwise, start by grabbing a tool like Process Explorer and display the process tree after a clean (well, dirty...) reboot. You will be able to see the scvhost process and its parent. Usually this 'restart' trick is managed either through the service interface, or by two different programs that "look after" each other, restarting their companion as soon as they see it down.

So first you check the scvhost object.

If its parent is an "unknown" binary, not part of the Windows system, you can "suspend" both parent and child. Neither will react, since you killed neither (yet). If the parent is "services.exe" (and it's the real services.exe), then your infection has disguised itself as a service, and you need to suspend the child only.

In the service scenario, open the Services console, set it to "Do not restart if terminated", and disable the service so it doesn't run at boot. Then kill the child process (having been suspended, it shouldn't be able to notice the settings being changed and change them back), and try rebooting. See the note at bottom for a caveat first, though.

If it wasn't a service, look on the disk for the parent process (Process Explorer usually tells you where the process started from). In these setups, the parent has the only tasks of launching the child and overwatching, and trying not to attract attention. You might not find the child executable (might not even be a file on its own), but you should be able to remove the parent. Look for its name in the usual places in the Registry (or you might want to also try Autoruns).

Before doing this, verify you do have a current backup of your data files. It is conceivable that the infection might have either rendered the system unstable, or purposely booby-trapped it, and this rather brutal removal might trigger something unpleasant.

Answer 2

This question is probably not a good fit for this site, as it is too narrow and localized (not likely to be of relevance to others), and it doesn't provide enough information to diagnose the problem.

That said, generally speaking, the procedure is as follows:

1. The only safe way to recover is to format your drive, reinstall your OS and applications from scratch, change all your passwords, and restore your data from a backup taken before you got infected (you need to be certain it is before you were compromised).

2. If you want to live dangerously, here's an alternative approach. Update your A/V (antivirus) software to make sure it has the latest definitions, then run a full scan of your hard disk. Then, download MalwareBytes and scan your hard drive (you may need to write it to a CD or USB dongle, then boot from the CD or USB dongle). Have them remove and fix any infections that they find. Then, change all your passwords. See if this fixes the problem. If it doesn't fix the problem, the fallback is to go to step 1 (reformat and reinstall).

Answer 3

I think you'll find this type of question more suited to superuser or similar site for tech-level work. That said, when I was more involved with malware removal, there were some basic tactics.

First, be sure of the exact OS version you're using (for example if windows xp, then home, pro, etc. or if win 7, then which home, pro, ultimate, etc.). Some older OS's are more prone to corruption and other issues. This will also help you decide which tools specifically to download to deal with that particular malware.

Second, figure out what service pack of the OS you've got versus what is the most recent version of that. Any lapse (at all) in updates, hotfixes, etc can leave your machine almost totally at the mercy of something new that isn't picked up by heuristics on an AV. In fact, updates are typically more important than AV in securing a machine and I've seen issues that kept returning after AV scans but were successfully neutralized after updates and hotfixes were installed.

Third, don't keep downloading every little app to try to fight it since those can be cleverly disguised versions of other viruses or just simply not work and leave you with spyware or other inconveniences. Similarly, be careful what you do on that machine as it could be hiding other malware that could be doing more than just playing music at inconvenient times (for example, logging your passwords, etc.).

There's entire chapters of books written about dealing with viruses and other malware, so it's somewhat beyond the scope of this post. But you can start with this.

Answer 4

Check for the parent process( process tree) and end it. Be sure to download applications from only trusted sites and ALWAYS have an updated Anti virus.