BleepingComputer.com: svchost.exe using way too much ram

So a few days ago I noticed one of my instances of svchost.exe taking 1.7 gigs of ram. That's outrageous, obviously. I got a copy of Process Explorer to check it out. I didn't see anything that stood out to me, though admittedly it was a lot of information and much of it didn't mean anything to me.

So I rebooted, thinking that might make it go away. Shortly there after, it became very clear that I had a Windows Recovery Virus. Hid my desktop items, tons of fake HDD/cpu/ram errors, a bs scanner running on my system, and it closed task manager and I couldn't reopen it. I ran spybot, and it seemed to get rid of it. I rebooted and everything seemed ok. Until my task manager closed itself again. So I downloaded malware bytes instead, thinking maybe it does a better job. It seemed to. It figured out that the virus had set itself up in the system restore directory (Which is odd, since I disabled that). But it deleted those files too and I've not seen it come back since.

Except I'm at 1.5 gigs of ram used on the svchost.exe again. I ran combofix and it deleted some files that didn't seem to have anything to do with the virus, but didn't solve the memory issue.

I'm not sure what to do next, short of reinstalling windows. I can post the log files from the scanners, info fro Process Explorer, or anything else that might be helpful. Just let me know what you need to help me out.

Hello,

Please follow the instructions in ==>This Guide<== starting at step 6.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Since you have run ComboFix, please include the ComboFix log in the new topic. Please be sure to include a description of your computer issues and what you have done to try to resolve them.

If you cannot produce any of the other logs, then please create the new topic anyway, include the information that you were unable to produce the other logs and why and include the ComboFix log along with a description of your computer issues.

Orange Blossom

Still waiting...

http://www.bleepingcomputer.com/forums/topic436785.html

Thanks for the nudge .

Posted 07 January 2012 - 12:08 PM , today is 11 Jan 2012 and it' 1716 by my clock.

We understand your impatience...but the truth of the matter is reflected in the following statement:

Now that you have properly posted a malware log topic, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic. Good luck with your log.

Louis