[Multiple instances of svchst.exe spawn and use all CPU]

# DelFix v1.013 - Logfile created 11/12/2017 at 22:24:56
# Updated 17/04/2016 by Xplode
# Username : Thomas - THOMAS-PC
# Operating System : Windows 10 Enterprise  (64 bits)

~ Activating UAC ... OK

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\Users\Thomas\Downloads\FRST-OlderVersion
Deleted : C:\Users\Thomas\Downloads\Addition.txt
Deleted : C:\Users\Thomas\Downloads\Fixlog.txt
Deleted : C:\Users\Thomas\Downloads\FRST.txt
Deleted : C:\Users\Thomas\Downloads\FRST64.exe

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #2 [Checkpoint by HitmanPro | 12/04/2017 22:48:20]
Deleted : RP #4 [Restore Point Created by FRST | 12/07/2017 00:14:00]
Deleted : RP #6 [Restore Point Created by FRST | 12/07/2017 00:16:28]
Deleted : RP #7 [Windows Update | 12/11/2017 15:50:33]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########
 

[Multiple instances of svchst.exe spawn and use all CPU]

Yes, I'm still here. Everything is back to normal. 

 

[Multiple instances of svchst.exe spawn and use all CPU]

Absolutely!

Here it is and thanks again for the help.

 

 

Quarantine.zip

[Multiple instances of svchst.exe spawn and use all CPU]

Here is the fixlog.txt file.

Ran FRST and it seems the Bitcoinminer is gone now. No spawned processes for 10 minutes. I'll test more tomorrow and let you know, it's getting late now.

So far so good 

Big thanks!

Fixlog.txt

[Multiple instances of svchst.exe spawn and use all CPU]

Hi Aura

Thanks for looking into my problem.

I cant see the fixlist.txt. 

[Multiple instances of svchst.exe spawn and use all CPU]

Hi 

This is my first post here and I'll try to follow the guidelines.

I have a problem with a process names svchst.exe using all my CPU. Several instances can occur. If i kill the process it will respawn after a while.
The description is Windows Spyware Service.

Checking with Process Explorer the svchst.exe process parent is a cmd.exe which is unsigned.
The same cmd.exe is also parent to a conhost.exe, also unsigned.
I cant see the filepath to any of the files. 
Checking the properties->TCP/IP tab on svchst.exe it shows there is a connection:

TCP    MYIP:52361    163.172.226.131:3333    ESTABLISHED

What to do?

Thanks in advance

 

 

Malwarebytes Threat Scan log.txt

FRST.txt

Addition.txt