Svchost.exe outside system32, but virus scanners says it's clean

[KHRZ]

I noticed my laptop fans were loud when it shouldn't be heavily loaded, I checked task manager and there was an svchost at 25% CPU (a full core). I checked it's location, which wasn't system32 but user\AppData\Roaming\Microsoft\Windows\svchost.exe. Also the file size is 619kB, not 27kB like in system32. I checked online and people are saying windows doesn't have any svchost outside sistem32, it must be malware. But both malwarebytes and spybot says it's clean when I scan it. Though malwarebyes found a registry entry called something PUP.iminient that I removed. I still have the svchost file though. Is it just harmless without the registry entries? Can I find out what it does?

[AdvancedSetup]

There must be a reason the file is there. Not sure we'll be able to tell you exactly what process put it there but we can help you to remove it and ensure the system is clean.

I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.

Thanks

[KHRZ]

Amazingly, I good old notepad might have solved the mystery. Near the end of the large program body is this:

DeregisterEventSource ・ReportEventW  }RegisterEventSourceW  ADVAPI32.dll  6 WSAIoctl  WS2_32.dll  ・HeapAlloc 1TerminateProcess  BUnhandledExceptionFilter  SetUnhandledExceptionFilter IsDebuggerPresent ・RtlVirtualUnwind  ・RtlLookupFunctionEntry  ・RtlCaptureContext OGetSystemTimeAsFileTime HeapFree  HeapReAlloc ~WideCharToMultiByte ・GetConsoleCP  ・GetConsoleMode  pGetCommandLineA TRaiseException  ・RtlPcToFileHeader ・RtlUnwindEx EncodePointer DecodePointer ?FlsGetValue @FlsSetValue >FlsFree ・SetLastError  =FlsAlloc  HeapSize  \GetCPInfo SGetACP  GetOEMCP  IsValidCodePage ・GetModuleFileNameA  HeapSetInformation  ・HeapCreate  LCMapStringA  LCMapStringW  ・SetHandleCount  9GetStartupInfoA DeleteCriticalSection  SetStdHandle  #GetProcessHeap  ・WriteConsoleA ・GetConsoleOutputCP  ・WriteConsoleW KFreeEnvironmentStringsA GetEnvironmentStrings LFreeEnvironmentStringsW GetEnvironmentStringsW  GetCurrentProcessId ・LoadLibraryA  InitializeCriticalSectionAndSpinCount kGetTimeZoneInformation  =GetStringTypeA  @GetStringTypeW  ・GetLocaleInfoA  R CompareStringA  U CompareStringW  SetEnvironmentVariableA                 ⅷQ    bz       Xz \z `z sz   jhPrimeminer.exe OPENSSL_Applink  

 

 

Apparently it was mining primecoins... not sure if I should be relieved, could also have been doing naughtier things?

[KHRZ]

Ok so this is the guy I'm looking for...

Credits: Sunny King for the original Primecoin client&miner

[Firefox]

I would follow Ron's advice in post #2 above and get expert help to get this all sorted out. Self medication could lead to more harm than good....

Thanks for understanding....

[shadowwar]

Also if you can please submit the files to us in zipped format we can go ahead and get it added.

 

Files can be submitted here:

 

http://forums.malwarebytes.org/index.php?showforum=51