What should I do? It gives me the option to replace or ignore. Uploading it on virustotal gives that https://www.virustotal.com/el/file/71013...492941215/
Hitman Pro classifies svchost as suspicious... |
  (Apr 23, 2017 03:10 PM)Travelers Wrote: Do you have any reason to believe that this is something malicious? Are you noticing craziness on your system? No I don't notice anything weird on my system. The only reason I believe it may be malicious is because it showed up on Hitman Pro.
I see that you could go two ways with this:
1) It's a false positive. Nothing to see here, folks. 2) Pursue it; dive down the rabbit hole. Crack open process explorer and give it a look over. Have process monitor open at system start up, let it run for a few minutes, stop it then review. See if anything was opened or leads you to think there is anything going on. Deep dive, so to speak. This is what I would do, anyway. Hope this helps. ![[Image: pia_banner_3.png]](https://www.privateinternetaccess.com/affiliates/banners/pia_banner_3.png)
Apr 23, 2017 04:05 PM
(This post was last modified: Apr 23, 2017 04:06 PM by JoshuTee.)
This certainly is very suspicious. It's not signed by Microsoft but masquerades as a system file. It even contains the string "PAYLOAD".
Please boot into safe mode and use Autoruns to find the file location, and delete it. 
I usually show these to people who think their svchost is infected.
https://hackforums.net/showthread.php?ti...id54319032 https://hackforums.net/showthread.php?ti...id54147490
~
(Apr 23, 2017 06:47 PM)Soulmate～っ☆ Wrote: I usually show these to people who think their svchost is infected. Both seem to be very good resources. I'll be bookmarking these two threads ✌ (Apr 23, 2017 06:47 PM)Soulmate～っ☆ Wrote: I usually show these to people who think their svchost is infected. This is not very accurate to be honest. It's true for most cases but svchost.exe may also exist in C:\Windows\sysWoW64 or a subfolder of C:\Windows\WinSxS. Having that said it can also be that the instance of svchost running has been injected with malicious code or has been infected with a virus. Generally it's much safer and easier to check for certificates. Every svchost.exe that belongs to Windows has a valid Microsoft certificate. It it does not, it is almost certainly counterfeit.  (Apr 23, 2017 04:05 PM)JoshuTee Wrote: It's not signed by MicrosoftLooks signed to me? Unless were looking at two different VT links. ![[Image: ODGu2i1.png]](https://i.imgur.com/ODGu2i1.png) Could just be a false positive from HitmanPro seeing as 60 other antiviruses don't flag it as suspicious. According to VirusTotal the file is Digitally signed by Microsoft so it is a Microsoft process. However that doesn't mean another application hasn't "binded"/"Injected" it's self into the process in memory. In which case Virustotal wouldn't detect it anyways as your just uploading the file it's self and nothing associated with it. If it were me in this situation I'd just use a utility like process explorer and see if anything looks suspicious with the process and go from there. ![[Image: 5Lxbaet.png]](https://i.imgur.com/5Lxbaet.png) (Apr 25, 2017 09:33 AM)GruntStyl Wrote: Looks signed to me? Unless were looking at two different VT links. Oh. You're right. My mistake!
Apr 25, 2017 03:10 PM
(This post was last modified: Apr 25, 2017 03:11 PM by JoshuTee.)
(Apr 25, 2017 01:17 PM)James Burnham Wrote: I am sure I had seen it as "unsigned". I don't know why now it says it is signed. Me too to be honest. I was absolutely sure. Anyway I'm trying to get my hands on the actual file now. 
Apr 25, 2017 03:44 PM
(This post was last modified: Apr 25, 2017 03:45 PM by Hackoo.)
Hi ✌
You can download System Explorer ![[Image: system-explorer-portable-2.jpg]](https://screenshots.en.sftcdn.net/en/scrn/69000/69935/system-explorer-portable-2.jpg) This small software includes many usefull tools which help you Keep Your System Under Control . With System Explorer You get also fast access to File Database which help you to determine unwanted processes or threats. Main Features :
|
|
|
