1

I have recently downloaded a trash software (even if normally I do not), and just after done an update of windows 10. After this when I was booting my computer my ventirad (I guess) was running faster and faster (like an exponential). So I watched tasks by pressing (CTRL+Alt + Escape) and saw a empty task running a lot of CPU. When I went to detail it shown me a /Windows/SysWow64 and it was pointing to Svchost...

As far as it was using 50% of my CPU I knew that there was a problem because it's not supposed to use that much.

So I restarted in safe mode to run an analysis with in this order Avast, spybot, cccleaner, and they didn't find anything and can't run at all.

I tried to restore an old save point of windows, and in the middle of the process it failed.

Then I have downloaded Process explorer and saw that things : enter image description here

I wanted to go to Service tab but first I received an access refused then I wanted to suspend it, and it refuses. Then I tried to force to kill it with a Taskkill 6492 /F Did not work...

Please I have lost my resources and don't know what to do.

(I don't have windows 10 usb bootable, and don't find my key (it was a windows 7 key official, then I upgraded to 10 long time ago)

Do you have any solution ?

|improve this question
  • Click on properties and check the path of svchost.exe – M. Abdelhafid Jun 14 '18 at 23:53
  • the past in properties is pointing to /Windows/SysWow64 – Chaveex Jun 15 '18 at 7:46
  • What doe the Services and Threads tab (sort by highest CPU) property page look like? Also, get a sha1 hash of the file and upload it to: virustotal.com To get a hash, this will do: Download: live.sysinternals.com/sigcheck.exe sigcheck.exe -h "C:\Windows\SysWOW64\svchost.exe" – HelpingHand Jun 15 '18 at 21:49
1

It looks like it is a crypto miner virus. Once it was happened to me. I realized it when I have listened my network using Wireshark. svchost was commanded to communicate with a pool server of Monero coin. I found the only solution by restoring my C drive. Apologize, I can not come up with a nice solution. I had to write this as comment not as answer, but my reputation is not sufficient for commenting, and I would like warn you about the miner virus from my experience;

  1. It is a malware infects in svchost.exe, so it is not possible to kill it since Windows recognizes it as a system process.
  2. Usually its encoders work very well so that virustotal or any anti-malwares can not detect anything.
  3. Do not try to log-in to interface of your router while you have this malware, since it is going to steal your router credentials and change your proxy or dns settings.
  4. Do not make any online shopping with your bank or credit cards on this infected pc.
  5. It is not only a miner virus. It is a strong Trojan which has many capabilities such as disabling Windows Defender, breaking Windows Updates. ( That's the reason why your restoring is failing ), listening your keyboard strokes, might be getting screenshots as well.

Windows 10 has a feature to return to a fresh re-install without removing your personal files. Restore Windows 10 to Factory Settings. This will definitely save you from the dangerous trojan.

|improve this answer
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. - From Review – A. Hersean Jun 18 '18 at 12:49
  • This malware could cause very serious issues. So I could not wait until I have enough reputation. Possible down votes of my answer or my reputation are not important if my warnings can help him or her to prevent the malware go further and causes more damage. – Pilfility Jun 18 '18 at 13:01
  • @vvvnn Don't worry, it is wonderful if you see it so! But you don't need to cross the rules for that, you could write a self-answered post, too. Simply post a question, and answer it for yourself. You can even accept your own answer, or others answer if they give a better one. You don't get rep for accepting your own answer, and you can't vote for your own posts, but others, yes and they generally like such posts. :-) If it is done, you can link that self-answered question in any comments, any time (until it is a meaningful comment below the posts). You can also refer that question in – peterh says reinstate Monica Jun 18 '18 at 16:33
  • @vvvnn other answers. I suggest to edit this answer to become an answer to the question on the top. I vote now "skip" (I don't vote for delete your post), post others will. – peterh says reinstate Monica Jun 18 '18 at 16:35
0

I try to explain a bit. svchost.exe is used to (for example) startup a service. So what you see there could also be registered as a Service which mostly can be identified by checking the running Services and also if you are not able to open the GUI for services, there are some other ways to check for the running Services like:

  • run an elevated command shell (cmd.exe with administrative rights) and type into:services.msc press enter and wait a bit
  • run an elevated powershell (powershell.exe with administrative rights) and type into: Get-Service | ? {$_.Status -eq 'RUNNING'} | ft -AutoSize
  • run an elevated powershell and type into: Get-Service | ? {$_.Status -eq 'RUNNING'} | fl

Both PowerShell commandlets are doing the same but giving different output:

  • ft means : Format as a Table (-Autosize is for better reading)
  • fl means : Format as a List (gives way more details)

After getting the list of running services and identifying the 'bad' once you could use the sc.exe to stop/disable this service, reboot your machine and also delete this service.

But there are truly more ways to do this and it could also be, that this service will be reinstalled after a reboot with Autorun on boot.

|improve this answer
0

Looks like a crypto miner: high CPU usage, cannot be seen from the Task Manager, resists detection and killing.

Locating the origin of the affected svchost.exe will not solve your problem. Thanks to a technique called Process Hollowing, the malware will start the legitimate svchost.exe in suspended state, change some of the process structure to load its own code instead of svchosts' code, and start it. On the Task Manager, svchost.exe is loaded, but the code running is something else.

If you use ProcDump on the running process and compare with the legitimate svchost code, you will see very different things.

Solutions?

Easy fix: nuke from orbit, recover backups.

Difficult fix: Create a VM, take a snapshot, install the suspect program again, compare the snapshots. Start Windows on safe mode, delete the changed files.

Very difficult fix: Grab Sysintenals' Suite Process Utilities, start on Safe Mode, investigate everything that is loading on login. Disable one group of processes at a time, reboot on normal mode, see if the miner returned. Repeat until you grab the exact process.

Don't install untrusted software. If you really have to, install on a sandbox. Sandboxie is one I have used since a long time ago, is convenient and works well. It can protect from most embedded malware, but is not safe enough to run well written malware that can detect, evade and attack it. The other option is running untrusted software inside a VM. But again, this is not bullet proof, as some malware can detect and escape a VM as well, but probably you are not running one of those.

|improve this answer
  • Hello thank you for your answer. Finally, I formatted my computer, reinstalled everything I needed without the malware. I think your answer fit very well to the issue I had. Unfortunately, I could not test your solution. I will add a +1 because the you explaination will probably inform more users in the future. I usually don't install untrusted malware, but I wanted to test a game before buying it and I downloaded on Skidrow. I did something wrong. Skidrow seems to crack games and I think they want to get money from what they do. Crypto miner must be the best solution for them. – Chaveex Jun 25 '18 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.