Getting rid of a trojan. SVCHOST question

Posted by MasterPeter on Super User See other posts from Super User or by MasterPeter
Published on 2010-04-17T10:32:33Z Indexed on 2010/04/17 10:33 UTC
Read the original article Hit count: 347

Filed under:

svchost

|

trojan

|

Windows

|

windows-xp

|

antivirus

My antivirus keeps notifying me of a trojan. svchost.exe keeps creating some 'drivers' (.sys files in the drivers directory under system32 of my Windows XP installation) each of which is marked as Bubnix.AB trojan.

The antivirus fails to remove many of the files as they are immediately used by svchost (I presume). How do I find out which service is the culprit? Why can't the antivirus effectively rid me of this plague?

Also, how many svchost processes is it normal to have running at any one time?

I am using Win XP SP3, and ESET NOD32 antivirus.

© Super User or respective owner

Related posts about svchost

What could be causing SVCHost to leak handles?

as seen on Server Fault - Search for 'Server Fault'
I have a problem that has been causing me all sorts of grief recently. SVCHost appears to be leaking resources all over the shop. This is the SVCHost run with the arguments "-k netsvcs". At the moment it is sitting at around 5,700 Handles being used. Before I rebooted the machine it was sitting… >>> More
Getting rid of a trojan. SVCHOST question

as seen on Super User - Search for 'Super User'
My antivirus keeps notifying me of a trojan. svchost.exe keeps creating some 'drivers' (.sys files in the drivers directory under system32 of my Windows XP installation) each of which is marked as Bubnix.AB trojan. The antivirus fails to remove many of the files as they are immediately used by svchost… >>> More
svchost consuming more than 50% CPU all the time in windows 7

as seen on Super User - Search for 'Super User'
Hello, I'm using windows 7 ultimate. svchost containing DCOM Server Process Launcher Plug and Play Power services is consuming more than 50% of CPU for most of the time. I found this blog post: http://blog.hansmelis.be/2007/06/17/windows-vista-long-delay-when-switching-songs-in-media-player/ … >>> More
svchost.exe crash on wake up

as seen on Super User - Search for 'Super User'
Lately whenever I wake up my laptop from sleep I get a series of errors (generated by a host process failing) I haven't been able to figure out why this happens but I know which host process fails and was wondering if someone had some insight on why this keeps occuring 99% of the time when my laptop… >>> More
.net generate proxy classes problem (wsdl/svchost) by soapHeader

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm using a web service from .Net C# client application. My web service has a method which return generic list and in my client application I use Configuration Service Reference to change array to generic list.Its working correctly. But when I add a soapHeader to my web service Configuration Service… >>> More

Related posts about trojan

2/2: Trojan.Sasfis Trojan Horse--And Other Malware You Should Know About

as seen on Internet.com - Search for 'Internet.com'
A round-up of today's worms, Trojans, viruses, and other malware threats. >>> More
Does VMware_ThinApp_4.0.3_169725.msi contain Trojan.Win32.Vapsup in it? [closed]

as seen on Super User - Search for 'Super User'
Today I ran a full system scan using Online Armor++. It detected Trojans in the installer. I have had this installer on the computer for many months and I do not remember if I ever installed it on this PC or not. For some reason I unpacked the installer with 7zip though. I was probably going to attempt… >>> More
Cleaning a proxy/phishing trojan from Windows XP computer

as seen on Super User - Search for 'Super User'
I am trying to remove an interesting trojan from a Windows XP computer. It manifests itself as a phishing page (screenshot linked) that appears after the user tries to log on to eBay. So far, I haven't found any other web sites that are affected. As you can see, the trojan intercepts browser connections… >>> More
Can Windows Essentials Remove the alescruf.c Virus from a Windows PC?

as seen on Super User - Search for 'Super User'
A colleague just visited a site which had been hacked by the alescruf.c trojan virus, which infects HTML via embedded JavaScript. Windows PC's are infected by visiting the site. If my colleague has Windows Essentials, which detected and removed the trojan, is there anything else that he needs to… >>> More
2/10/10: Backdoor.Mulkerv Trojan Horse--And More of Today's Threats

as seen on Internet.com - Search for 'Internet.com'
A summary of the day's newest viruses, Trojans, worm, and other malware threats. >>> More