1

I don't know if this is the right place to post this question but I have two tasks that have appeared recently and are always taking up most of my CPU. They don't have a name and when I go to stop them they don't stop running.

If I open file location they go to svchost.exe but I feel it could be malware disguising itself.

Is there any chance these two tasks are malware?

  • 2
    open a command prompt and type tasklist /SVC AND tasklist /FI "imagename eq svchost.exe" /svc update your question with the results – HashHazard Nov 4 '16 at 1:22
  • Depending on your Windows version and patches, the one svchost process that contains Windows Automatic Update 'wuauserv' is frequently a ginormous CPU and memory hog; see superuser for several Qs on this. I don't know any second one like this though. – dave_thompson_085 Nov 4 '16 at 6:36
4

svchost.exe (Service Host) is a normal process used for running services (background programs) on Windows. You can use tools like Process Explorer to determine what executables are being ran by the Service Host process. Without further information as to what is being ran by the Service Host it is impossible to provide you with additional recommendations, and JL117748's "answer" is woefully uninformed in regards to the basics of the Windows operating system. You can download a copy of Process Explorer here.

Edit

I should have been more detailed and addressed how to specifically see which services are being ran by Service Host, since by saying executable gave the impression of only child processes as brought up by dave_thompson_085. If you right click on the svchost.exe process in Process Explorer, and select Properties, then click on the Services tab as can be seen in the screenshot below. Assuming the services arent needed/required by the operating system, they can be disabled by opening the Computer Management MMC (in Administrative Tools, or right clicking the Start Menu/Windows Logo button), selecting Services underneath Services And Applications, then double clicking the relevant service, clicking the stop button and then changing the Startup Type to Disabled.

eProcess Explorer

  • Note that there are both processes under svchost, such as shown by ProcessExplorer TreeView, and service threads inside svchost, shown by mousing over svchost or doubleclicking it (or select, Process, Properties) in the Services tab, as well as tasklist /svc commented by Hollowproc. – dave_thompson_085 Nov 4 '16 at 6:39
  • Yea i don't see the need to download additional software to answer OPs question. – HashHazard Nov 4 '16 at 17:09
  • If OP doesn't know what svchost and thinks it is malware, its pretty easy to assume that using a command line would be beyond his abilities. There is a reason why GUIs exist, and it is to make computing more accessible to the masses. – Muh Fugen Nov 4 '16 at 18:50
1

This could very well be the case , where you might have a rootkit installed. Because such changes can only happen if you modify _EPROCESS structure, which requires us to write a kernel driver. If thats the case, no AV can help you. I dont know if there are known rootkit hunters, but you should probably look into that angle.

0

I may be able to answer more fully if I know where this svchost.exe is located, but I'll give it my best shot. This is most likely malware, as legitimate processes usually don't run with no name. The malware could, if advanced enough, be making task manager hide the process name and make the process properties point to svchost.exe. You should consult your antivirus(use a full scan, not a quick one).

Hope this helped.

  • Thanks for the reply, the svchost.exe is located in C:\Windows\System32 I have a feeling its malware because its only a recent thing. – Bad Dub Nov 3 '16 at 22:54
  • How recent? Is this a recent Windows installation? – JL117748 Nov 3 '16 at 23:25
  • Its just windows 10, AVG didnt pick it up so I trying BitDefender – Bad Dub Nov 4 '16 at 1:03
  • If you haven't already try a Malwarebytes Pro Trial. – JL117748 Mar 15 '17 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.