Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This weekend I found my PC was possibly infected by some virus or spyware. There is one "svchost.exe -k netsvcs" in my task manager, and it is running under my user name, rather than SYSTEM accounts. There is already another same process with same command line options under SYSTEM account.

This user account svchost.exe consistently consumes 50% CPU (1 of 2 cores of my CPU). In Process Explorer, I can see it is started by explorer.exe, instead of services.exe. However, I failed to find its real service dll place in registry or disk. Does anyone know how to find this malicious program?

share|improve this question

migrated from Nov 24 '10 at 0:24

This question came from our site for professional and enthusiast programmers.

Simply use ProcessExplorer. Here is an article.

share|improve this answer
When I use Proc Explorer to view this user account svchost.exe, can't see service tab. No useful information to help find the actual malicious program. – Sheen Nov 24 '10 at 9:25

Make a boot AV disc then boot from the disc and scan the hard drive, remove any infections it finds, I like the Kaspersky disc myself.

Then: Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects.

MBAM and SAS are not AV softwares like Norton, they are on demand scanners that only scan for nasties when you run the program and will not interfere with AV programs like Norton, these can be run once a week to ensure you are not infected. Be sure you update them before each weekly scan.


share|improve this answer

ProcessMonitor, also made by SysInternals would be the better choice, just create a filter for svchost.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .