0

I think I have a trojan.

svchost.exe is consuming %25 cpu all the time, and my Microsoft Security Essentials reports a different virus every half an hour or so. From what I understand the trojan is downloading different viruses. MSE removes those but can't disable the real culprit.

I have tried a couple bootable scanners such as Kaspersky Rescue Disk, they seem to find the same ones found by MSE but with no further success, when I restart my pc svchost still uses %25 cpu and I get new virus alerts time to time.

My question is, I have a windows backup of my C drive (120gb single partition), if I delete the partition and format it and then restore from backup, is it a sure way to get rid of trojan, assuming it didn't attach itself to something in D drive (which is a seperate hdd) and I don't run it? I read some trojans reside in GUID tables and such, can this action get rid of them?

Improve this question
1
  • Although this is likely a virus, keep in mind that svchost.exe is the process to create services. But a hanging service would not create virus messages.
    – LPChip
    May 17, 2016 at 7:50

1 Answer 1

Reset to default
1

If you have a virus, format the machine totally. If the image you're restoring from doesn't have the virus it's fine to proceed.

If another hard drive may be infected, you need to do the same thing - nuke it and restore from back ups.

If the virus is on the network then you still essentially do the same thing. Disconnect network, nuke everything and restart with back ups.

Improve this answer
2
  • I don't have understanding of GUID and MBR parts, question is how can I nuke them?
    – uylmz
    May 17, 2016 at 7:48
  • Because it's still stored on the hard drive... techlogon.com/2012/01/15/…
    – Dave
    May 17, 2016 at 10:54

Not the answer you're looking for? Browse other questions tagged .