Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple SVCHOST.EXE are running


  • This topic is locked This topic is locked
4 replies to this topic

#1 EILEENNOLA

EILEENNOLA

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New Orleans, LA
  • Local time:12:29 AM

Posted 04 November 2011 - 10:44 AM

First - A bit of history b/c I've had nothing but problems for weeks now:

I have Windows XP got a rootkit infection that completely corrupted my hard drive - so had to have a new hard drive installed about a week ago (320 GB Internal 3.5" 7200RPM).

When I got the new hard drive, I installed Vipre Premium and Malwarebytes. I had Pirate Bay on my old hard drive and never had problems with it so I tried installing Pirate Bay and you guessed it, I got the infamous Searchqu/iLivid that took over Firefox.

I went online and followed directions by changing the home page by taking the steps: about:config, Keyword.URL, replaced the homepage to google, etc. It worked but somehow I did something and screwed it up. I can't even run "about:config" anymore - it goes to a page that says that it won't connect and to work off-line or something like that.

I was finally able to uninstall Firefox (it wouldn't let me uninstall it and I had to try about 10 times.) Now I'm using IE with a MSN.com homepage. Although it's annoying (I don't like Bing and want Firefox back) my computer was running fine. I reinstalled Firefox but it comes back with Searchqu every time.

The above is just annoying but now I have a much bigger problem: This AM when I turned my computer on, it was freezing or running so slow that I couldn't use it. I had to keep turning it off and on. Now it's an hour later and running fine.

This may or may not be important, but I looked in the Task Manager and saw something weird. I have 6 svchost.exe running and I've never seen that before. 1 is "network service (3K)" , 3 are "system (22K, 5K and 8K)", and 2 are "local service (4K and 3K.) BTW, I didn't know what a svchost.exe was - I had to look it up.

I ran the Vipre and Malwarebytes and everything is OK. I guess the Searchqu/iLivid are lurking somewhere hidden in my computer(?) I removed it in Programs but I've read that it can still be hidden somewhere.

I don't know a thing about computers - I am using all of this jargon b/c I've had help from BC before so I know how to run dds.txt, attach.txt, hijackthis and GMER but that's about it. So if anyone can help me, I'd appreciate the most simplistic instructions - like you're telling a 10 year old what to do! :unsure:

Thanks once again. I really appreciate your help. -eileen

BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:10:29 PM

Posted 04 November 2011 - 11:58 AM

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#3 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:01:29 AM

Posted 04 November 2011 - 03:20 PM

EILEENNOLA ,

Does this concern the same computer as the topic here: http://www.bleepingcomputer.com/forums/topic422066.html ?
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#4 EILEENNOLA

EILEENNOLA
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New Orleans, LA
  • Local time:12:29 AM

Posted 04 November 2011 - 03:41 PM

Orange Blossom - Yes, it's the same computer but a BRAND NEW hard drive! Boy, have I really screwed things up...

I came to BC b/c my anti-virus/spyware programs were wiped out. Turned out that it was a "nasty rootkit infection" that was diagnosed by Bleeping Blonde. (You had originally helped me but moved me to the virus removal team.) So I had a tech look come to the office and he said that my hard drive was corrupted and he put in a new one.

On the new one, I installed virus/malware programs and everything was working until I tried to install Pirate Bay. That's how I accidently downloaded Searchqu/iLivid(!)

So the answer to your question is that yes, it's the same computer but it's a new hard drive with completely different problems! Thanks again, -eileen

#5 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:01:29 AM

Posted 04 November 2011 - 04:05 PM

That may be, but Elise asked you a few days ago http://www.bleepingcomputer.com/forums/topic424477.html/page__view__findpost__p__2460751 to post the logs for it in that topic which she reopened for you. So, I've merged your new topic with the one Elise Reopened. That link is here: http://www.bleepingcomputer.com/forums/topic422066.html

To avoid additional confusion, I'm closing this topic.

Orange Blossom :cherry:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users