How to end a virus process which disguise as critical system process in taskmanager?

R

russweaver

New Member
Joined
Apr 21, 2011
Messages
1
Reaction score
0
For eg: that process is a virus and when i tried to end process, it says tat i is a critical system process. How can i end that process?
I am using windows sp2. The path c:\windows\system32\services.exe is there. I tried to remove the virus entry in startup using ccleaner. But not working. Also i cant access the msconfig.exe. So how can i end the process?

Safe Eyes Coupons
 
Last edited:
Shut the computer down, take the drive out and put into a clean computer and scan it there as a secondary drive.
 
What Gary said always worked for me when fixing customers drives.
 
A few weeks back my friend brought me his PC for repairs. It had a beast of a virus on it. It's replicating ability was remarkable. It had a hand in most of the inner workings of the PC, probably using a rootkit. It disabled any antivirus from launching, prevented any changes to the registry (it would re-create infected registry entries I deleted), ran in safe mode, restarted if I killed it using process explorer.

Heh, one thing I didn't try was put the drive in a other working PC to have it scanned as a secondary drive. In the end I decided to wipe the drive since there wasn't anything important on it. But really, it was like trying to kill something that could read your mind.
 
Guys, I thought this was common knowledge. If you PC is infected then the virus loads itself into active memory while your PC is on. It is almost impossible to completely remove all vestiges of it from the hard drive while you are running from that drive. Especially with modern viruses that hide copies of themselves all over the place so that they can re-activate later.

The only SURE FIRE way to remove them is to scan the drive when it is a secondary drive (not active in RAM).

Trying to remove them when the PC is on... even in safe mode... is like trying to kill an ant colony by spraying doom on the grass.
 
Garyvdh said:
The only SURE FIRE way to remove them is to scan the drive when it is a secondary drive (not active in RAM).

Trying to remove them when the PC is on... even in safe mode... is like trying to kill an ant colony by spraying doom on the grass.
Click to expand...

Correct! This is because the malware exploits the various system lock mechanisms that are there to ensure that true pre-emptive multitasking works as well as it does. And attempts to overwrite the task in memory leads usually to a system crash or a BSOD. Been there, tried that.

I don't even bother with anti-virus software, I plug the drive into another machine and use tools to remove the malware. This has worked for me with all but the most advanced rootkits. Usually afterwards, if I plug the drive into the machine and use AntiSpyware (regrun reanimator) that will recover it completely in 99% of cases.
 
Well it seems the virus has affected quite a lot of your system files. So do something which you are presuming now, wont help you at all. Try using Norton anti-virus to scan your entire system. Make a full system scan. That should hopefully solve the problem, but then again I would not say that your system would be 100% fit and fine. At best I would suggest you to repair your Operating System or re-install. I know this is time consuming and a lengthy process but thats the only way where you can actually accept the fact or consider the system is clean and virus free. And if you don't want to format and re-install the O/S, well then just repair it. But my recommendation is format and a clean install of the O/S.

Kaspersky Coupon
 
Last edited:
1. Download Malwarebytes' Anti-Malware

2. Go into Safe mode by pressing F8 while your pc is booting up.

3. Install Malwarebytes.

4. Do a full scan.

5. Remove all the infections it detects.

6. Restart your PC and hope for the best :)

7. Download Service Pack 3 ad install it, then download and install any remaining Windows XP updates. Also update your anti-virus, if you don't have anti-virus get Microsoft Security Essentials

Good Luck :)
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X