PC slow after virus removal

Fran

Rikki wrote:

I have sygate firewall and it is blocking svchost.exe fron accessing the net. How do I know if this is a virus or I need it.

Maybe the Microsoft info can help?

gunneradt

an excellent standalone virus scanner is mcafee stinger available here

http://vil.nai.com/vil/stinger/

To check for spyware download either free version of adaware from https://www.lavasoft.de

or a trial version of spysweeper (the best anti spyware app in my view) from webroot.com

hope this helps.

Renee

I've done everything that has been suggested. When I run spybot it says that everything is OK but at the bottom of the scan screen I can still see. smitfraud and coolwwwsearch.

Fran

Have you run these with system restore turned off? Otherwise there still might be info stored to replicate itself. Try running the software StephenB reccommends (and others while you're about it) with system restore turned off and in safe mode.

There is info on the Symantec website.

charlieheard

Renee wrote:

just received an e-mail saying charlieheard has replied to my problem and i'ts not there heeeelp

When I re-read my post, I realised I might have misunderstood the point.

I just said that I have at least 7 instances of svchost running, with more if there are other users logged on. You need to check that they are the right ones from Windows\System32, though...

gunneradt

Renee wrote:

I've done everything that has been suggested. When I run spybot it says that everything is OK but at the bottom of the scan screen I can still see. smitfraud and coolwwwsearch.

try spysweeper from webroot - you can use it free for 30 days. It is the most thorough spyware removal programme and it will remove coolwwsearch and lop.com which are two nasty little buggars.

You also need to look at what programmes are starting at boot up - spysweeper should analyse this for you.

Give it a try

Renee

Used spysweeper and it found it. Scanned a second time to be sure and all gone. It's number 1 for me.

Thanks everyone

Renee

pchelpman

The red screen you mentioned (post 6) is an indicator of the Smitfraud infection and I think Webroot have now included a fix for this one. However, it can return so let those coloured screens be a warning if they come back!

As to the svchost running processes there's no need to worry about having several of them running at the same time. Normally, you don't stop any of them running.

Svchost, which is short for "service host", is a core part of the operating system that provides support to many of the required services that are Windows.

That said, it is also a common name for malware authors to use but slightly mis-spelt and/or running from the wrong location. You have to be particularly careful to watch for the exact spelling and location of this one.

For example, C:\windows\system\svchost.exe (running as a process) is evidence of something wrong and is not to be confused with the genuine svchost.exe which lives in the C:\windows\system32 folder. Also scvhost (wrong spelling) is another infection.

intel

Smitfraud info for anyone who wants to know.

http://www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?IdVirus=77495&sind=0