Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My antivirus keeps notifying me of a trojan. Svchost.exe keeps creating some 'drivers' (.sys files in the drivers directory under system32 of my Windows XP installation) each of which is marked as Bubnix.AB trojan.

The antivirus fails to remove many of the files as they are immediately used by svchost (I presume). How do I find out which service is the culprit? Why can't the antivirus effectively rid me of this plague?

Also, how many svchost processes is it normal to have running at any one time?

I am using Win XP SP3, and ESET NOD32 antivirus.

share|improve this question
up vote 3 down vote accepted

You could try to scan the computer with a different antivirus. With Avira AntiVir Rescue System you burn a cd and boot from it. This way you'll never have to worry about svchost.exe locking any infected files.

You should probably download and burn that cd from another computer if possible.

share|improve this answer
I would hate to speak too soon, but I followed your advice and "seems to work". Please keep your fingers crossed it's all over. – Peter Perháč Apr 17 '10 at 13:47

Not solving your problem, but some additional help:

  • Try to boot in safe mode (usually hitting f8 at start, often just after the beep, just after the time given to enter bios setup) , there perhaps you may be able to delete the evil files.

  • to detect the dangerous service, what i do is I actually know most of the "honest" ones, and if there's one am not very sure of (service or proccess!) ,just google for the full name and extension of the file, or the service name as a full string. this pops in first results all info you need in places where all them are filed and reported as standard or dangerous, or posible disguised ones.

share|improve this answer

Your windows install is hosed. Stop trying to repair it, and reinstall. This may sound harsh, but it's the best way to go.

The virus has clearly dug in pretty deep, and attempting to clean it will leave you with an unstable system and most likely take more time than just reinstalling.

share|improve this answer
yeah, sadly you're completely right. however in my situation, I just can't afford to reinstall the whole system. I might do that once my MSc project and my girlfriend's BSc project is done but this time of the year, I'd rather tolerate the annoying trojan than have to dig into all that re-installing and then "Oh! I lost this!" and "Oh! I lost that!" Thanks for the post, tho :-) – Peter Perháč Apr 17 '10 at 13:45

Just a additional info if someone also runs into this problem as I did. Avira Rescue CD did not report an suspicious files, but when I ran updated Kaspersky Rescue CD 10, it successfully found and eliminated problem the same problem as MasterPeter had...

share|improve this answer

On a vanilla install there are 5 instances of svchost.exe (2 under network service, 1 under local service, and 2 system).

This will change depending on what services you have running. Use services.msc to edit running services.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.