Background: Windows 8, not a special edition. Windows Defender and Webroot are both installed and have been installed for over a month. Yesterday I got a weird error that I've never seen before that Windows Defender couldn't load because "some other antivirus" was installed. I had never seen this error before or experienced this issue and unfortunately the solutions I've searched for don't work to resolve it.

Odd behavior: I get an alert in the messaging center that suddenly virus protection is turned off - both Webroot and Windows Defender. Now, every time I start my computer, Webroot will launch, but will be unable to scan the system (the scanner loads, but scans 0 files). Note that this is all happening while I am not connected to the internet, which I default don't connect to the internet. Cisco's VPN client begin loading multiple times and tries logging in; this is not set as default to load, so I have no idea why this is suddenly loading. I uninstall the app. Next I all of the sudden see this begin to appear in Task Manager, and after a restart see it again:

Service Host: Local System (16)
-Microsoft Account Sign-in Assistant
-Windows Management Instrumentation
-Shell Hardware Detection
-Remote Desktop Configuration
-System Event Notification Service
-Task Scheduler
-User Profile Service
-Multimedia Class Scheduler
-IP Helper
-Group Policy Client
-Device Setup Manager
-Certificate Propagation
-Background Intelligent Transfer Service
-Application Information

Remember, I'm not connected to the internet at this point, yet my computer is acting as if I am. In addition, it's very slow, even though I'm doing very little as far as application usage. Note that when I terminated some of the services listed above this, like Remote Desktop Configuration (I don't recall seeing this before this week), it starts a whole new Service Host: Local System (16).

The problem is after a restart twice, Webroot will load, but still can't scan. After ten minutes, it still has the scanning page loaded, but can't scan any files. I don't know how much I can even trust Webroot, especially since the Windows messaging center will state later that Webroot is turned off (I didn't do this, so how did this happen).

Remember that I am not connecting to the internet at all while all of this is happening. What is going on and what can I do?


Running netstat -ano, I get quite a few TCP connections and UDP connections (internet is disabled). Most of these are with various ports, like 135, 445, 27019, 49152-7. Some have and the remaining six have [::] and then a port.

The UDP's, which are peculiar when I run further details with netstat =a -p UDP -b show sqlbrower.exe, and SSDPSRV (svchost.exe) twice.

  • What you mean by it is acting as if you were connected? does it actually say you are connected?0o – Zaibis Apr 23 '16 at 9:50

Short answer:

Your best option is to simply start over. If have a backup/restore point saved where you are absolutely certain there is no malware, you can try that, but many viruses these days will disable backup/restore. In that case, reinstall your operating system (you may want to do that anyway just to be certain). Once that's done, get a better antivirus such as Avast! (free) or ESET (if you're willing to spend money).

Long answer:

If you want to triage the malware, the first thing you should do is double check that you are not connected to anything. It could be possible that the malware turned on your internet connection. Run cmd and type in netstat -ano and see if you have any established connections to foreign hosts.

The next thing you should do is download Sysinternals and Wireshark if you don't already have them. Since you aren't connected to the internet, your best bet is to probably download them on to a thumb drive on a different computer and bring them over. You will want to format that thumb drive before you plug it into another computer though when you are done.

Once you have that, run Wireshark and look for any network activity coming to or from your computer. Since you aren't connected, you'll probably see nothing, but it's an easy step and will put a spotlight on what the virus is doing if it works.

For details on using Sysinternals for detecting malware, watch this video: https://www.youtube.com/watch?v=80vfTA9LrBM

The video basically says to use Procexp to identify any binares that are out of place, and use Autoruns to see if any of your Registry entries have been modified to start an executable that shouldn't be there. Use Procmon to get a step-by-step list of what all of your processes are doing (such as in your case, starting RDP).

But at the end of all of this, you will still want to remove the virus (referring to my short answer).

I hope this helps, and good luck!

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.