SVCHOST.EXE

[q12]

Hello again. I want the discussion to continue please.

We had another discussion about the same thing, but much earlier, before i decided to clean D drive and to reinstall windows7. 

 

I will explain summarily here what i did so far after that discussion. I really thought i could solve it with a clean windows installation. I installed 8 windows-es so far, one after another. 4 times the same as original i had before, and 2 other new w7's. I learned to spot when  C:\WINDOWS\SVCHOST.EXE appeared.  I truly believed the windows i had was infected from the start. I scanned very early after installation of windows , and i saved the log too(i put it here in this post). I made my own log to keep track of what the hell is going on.

The conclusion is worse than i imagined. It looks like all the installers i have on D drive are "infected" somehow, INDIFERENT of the Operating system!!!!

Every time i execute any installer from D drive, virus is loose in the freshly (10 seconds finished ago)  windows installation, (i only installed from windows7 family). - not xp or w10.

My brain is on complete pause now. I am hopeless. This is the most aggressive virus i had ever and i usually didn't give them too much attention since i can clean them manually or from a simple scan with any AV...  But still my preferred AV is malwarebytes so far. I really have no idea how is functioning this one. After a fresh windows installation,  and also after 20 seconds of scanning, MBav finds the folowing: 

Process: 1    Trojan.Agent.E.Generic, C:\WINDOWS\SVCHOST.EXE

Module: 1    Trojan.Agent.E.Generic, C:\WINDOWS\SVCHOST.EXE

Registry Key: 1    Trojan.Agent.E.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PowerManager

File: 1        Trojan.Agent.E.Generic, C:\WINDOWS\SVCHOST.EXE 

(But i installed malwarebytes antivirus from my D drive so... now i understand that C  got infected from this simple execution.)

 

Oh, i put inside a zip file (hopefully) an infected installer that i watch it generate the SVCHOST.EXE when i execute it. I observed some installers are creating the svchost.exe, and some don't...or worse, it's a delay execution maybe?  I can send it to you for analyzing when you have the pleasure.

Also, i find in D drive System Volume Information folder a  "tracking.log" file that is created by svchost (im sure its from it - i watch it with ProcessMonitor) and unfortunatly is encrypted but i made also a zip file with it in it. Also i thought is good to send it to you for analyze. I can screenshot everything i said here to prove im not talking from imagination. 

All that i want is very simple. To be able (as before) to execute any one of my installers from D drive, and not get virused from that action. Also, to keep all my installers intact. I dont want to delete them.  I copy all the folder named "Programe" that contains all the installers, to a external hard drive as a backup and it helped immensely because i sometimes dont think at all and just press delete. After that i am very sorry i did it. But with a backup, im again at peace. 

I think this virus is behaving like a shell somehow... and i think you mention it in our first forum discuttion. We must neglect the "infections" that the antivirus finds, and somehow spot the root that is causing these infections. I dont know, it's a thought. You are way more qualified to decide what i should do.

Thank you so much for your kind support so far.

 

 

[q12]

mode in depth action i did so far, please look at All the pictures i made.

This is a screenshot of basic scan immediately after i just installed a fresh windows. But also after i installed the malwarebytes from D drive too and  is very probable this action was initiating the virus.  But i managed to effectively clean the C drive, restart computer, and scan again. It takes 20seconds to find this 4 findings. I also manually looked into c:\windows folder to spot if its anything there and it was clean.

But, if i installed some other (random) installer from D drive... the svchost.exe reappeared in c:\windows folder again, under my eyes. I dont have to scan it, i just keep that folder open and see when something is reappearing there. 

This is 1 step i did to learn more about this virus.

 

[q12]

it will be BEST for us to be able to edit the posts we are making here,  because if i mistake something ill have to add another answer and it will aglomerate the page. Not very smart not having that option. 2_windowsBasicVirus MB-ScanLog.txt

Here is the scan log from that first windows scan: 

 

[q12]

10 hours ago, q12 said:

this is the actual proof that it is searching after *.exe  (any exe)  
Its good to confirm what i suspected from a long time. 

 

[q12]

here is when is firing - i mean, after i just executed an installer (in this case 7z vers1602.exe archiver) 
what is curious is that is 1- creating File, 2-Query information; or Set Information, 3-read file, 4-close file. And is loading some "images" - most probably some copies of himself in different directories. 

.

.

.

Also, imediatly after i executed the installer,  its using some sort of command line inside an environment... at this point im lost... but i kind of getting it. He is using some sort of shell thing.  I really hope all this is helping you somehow. 

[q12]

In d:\System Volume Information\   i find this file tracking.log, heavily encrypted that my procmonitor point it to my totalcomander NOW, but im sure i've catch svchost.exe reading/writing from it like 50 times per second.

But im afraid this virus is using poor totalcomander like a puppet now. I think is the virus making it because in my life i never seen that "tracking.log" in that folder, and i use totalcomander for a long time. Ai ai ai.... This is black majik, i tell you.

4_tracking.log hidden from System Volume Information.zip

[AdvancedSetup]

Please start out by running the following again

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[q12]

MBupdates = done
MBThreat Scan = done 
MBscanLog = yes
AdwCleaner download/install = done
AdwCleaner update =  no such option*
AdwCleaner scan - restartPC- clean.
Farbar downloaded = ok
scanLog = yes

5_1MBscanLog.txt

5_2AdwCleaner[S00].txt5_2AdwCleaner[C00].txt

FRST.txtAddition.txt

 

[q12]

how i manually unvirus it: 

in Services - "Power Manager" i make it Disabled
i search in regedit after "PowerManager" and delete the whole folder with it.
Restart PC
C:\Windows\svchost.exe (hidden) and delete it. 

But even if i do that, after a new execution of (i want to believe CERTAIN) installers from D drive, all this cleaning i did is worthless. All reapear again as before like phoenix from the ashes. The same goes for MB. After it finds and clean, a new installer from D drive will fill back the virus locations with the same files. 

It should be a root of the virus. Can you explain to me what [CAN] it be?   I really want to understand the mechanics behind it, and im certain you encounter this kind of thing in the past. 

[AdvancedSetup]

Please run the fix. Then, for now do not install any other applications, plugins, etc for a couple days. Let's make sure the computer is clean first.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Ron

 

[q12]

Mello mister Ron, and thank you for your help. I did exactly what you ask me to do.  I will listen to you and wait these days without installing anything. Here is the result:

 

Fixlog.txt

[AdvancedSetup]

The log looks good. Keep an eye on the computer. Post back again later tomorrow and let me know how the computer is running.

It should be running pretty well at the moment. If not let me know

Ron

 

[q12]

well... thats the thing. How can i test if is dead? My only way to test it, is to install something from D drive. It's the only source.  I was thinking, maybe indeed there are some already infected installers, that i already downloaded some weeks ago infected like that OR they got mutated OR some kind of "system" file that is read automatically by some "shell" program from windows... my imagination got wild here but is all i can think of. Should i try the same installers now? Or just wait for you and do absolutely nothing? What are my options? I will definitely not download anything from internet these days. But to test your solution, i have to execute my "routine" installers. 

[q12]

or at least what preventive measures i can take? To install a firewall or option ON the active defense from malwarebytes while im executing my installers? 

 

[q12]

remember, the point here is not to clean windows, but to find the source of the virus in D drive. My windows7 was clean 8 times after windows7 installation but he got infected in the first 2 minutes like that every time. 

[q12]

my only thought is to watch this virus, to see what is doing, where is writing its stuff, how is performing, find its real source. 
it's effects that i observed so far: 

Effects:
7zip(error while running after install),

bsplayer(crash after install),

chrome(facebookLoginFailed - facebook thought every time i am hacked and put me to reset password),

SuspiciousServices() - errors and system crashing
PowerManager service mantaining svchost.exe,

*complete execution STOP of any installer after 2-3 uses making it unusable - basically, after i install a certain software repeatedly after 2 -3 times, that particular installer is blocked. I managed to unblock it by deleting it, and taking its original from a zip and running it again but the same routine was true, after 2-3 executions, it got blocked again. I can change it with it's original from zip again after that again and again. 

[q12]

i will try to run some (known infected) installers to see if svchost.exe is re spawned. 

[q12]

yep, svchost.exe is back after executing bsplayer installer.  This means that my installers, are truly infected with this virus? I have like 300 installers or more there. Im so dead. It looks that there are some random number of installers that are affected. Not all of them are touched. I tested them by execution. 

[q12]

This is after your cleaning. But its the only way i can test.

mbScan.txt

[q12]

i have a good idea: 

I think this virus write its own code to the installer. Can i send you some [infected] installers? You can quarantine them or put in a sandbox or whatever you have there...ideally a fresh windows like i have here. And see how its behaving, and fins a solution.  I think if you find it's code injected into installer you can find the solution to clean it.  I am scanning D drive now and make you a zip file with some small installers that i find infected. 

[q12]

I scanned D drive  and 93 infections found. The majority is [ Generic.Malware/Suspicious ] but is this thing that is creating svchost.exe.  I saved the log from MB of the scan.

mbScan_Ddrive.txt

Here some small infected installers too, if you can test them. I really wish they are ok and no virus is [attached] to them - you can confirm it for me if is like so. But do it in a safe environment - a new windows installation on a single hard drive. To be safe. it's what im doing here for 2 weeks already, but i don't have your knowledge or your equipment.  You can ask me  for other infected installers that you can see in the list, if you can think it will help you more. 

infectedInstallers.zip

 

infectedInstallers.zip

[q12]

i was curious how many executables i have  in D drive - 

700 executables/installers (not all are installers). and they make 14Gb  

and im afraid this virus is affecting zip files too.

[AdvancedSetup]

Well I'm sorry. All I can suggest then is that all installers on your D drive are infected and suggest you delete them.

If there are programs you want then find there current versions online.

 

[q12]

So, you can't play with what i send you ? To try to discover a way to repair it? You should do it way better than me, you have more knowledge and more tools to zoom in it, than me.

But i understand you in the same time, and i thank you for the help you give me so far. You did very good already.

[AdvancedSetup]

No, I'm sorry but having old compromised files is not something anyone should be using. Delete all of them. Get fresh, new installers that are not compromised.

Run the same 3 STEPS as before to delete known issues. Then run the same last FIX I provided you as well and that should clean the computer up again. Please do not re-infect your computer with any of those installers again as that is wasting time and resources that could be better used.

Thank you again

Ron