SVCHOST.EXE starts automatically downloading when connected to internet

[Avinash Kaur]

Hello Everybody,

I'm using Kaspersky as my antivirus software on my system. From last few days whenever i try to connect to internet my svchost.exe start automatically downloading from some ip. While searching the solution for the above issue. I came to know that kaspersky shows an option "network monitor" on the system. I had even disabled the automatic updates from the system, but i still get the same problem on my pc. Can any body tell me that how can i get rid of the above problem? Any help on the above issue would be appreciated.

Thanks in advance.

[Milton.J]

I think your system is affected by welcha worm virus. Your SVCHOST might be using the processing power. So in order to resolve the issue download the patch and there is also a symantec fix for it too which will remove it. Try to download both the patch to fix files. First try to disconnect your internet connection and then run the fix to patch it.

[Spyrus]

Follow these steps in order to remove the Welchia worm.

1) Disconnect your computer from the local area network or Internet

2) Terminate the running program

• Open a command prompt window. Click Start-->Run, type CMD and then press the Enter key.
• At the command prompt, type the following:NET STOP "Network Connections Sharing"
• Press the Enter key. A message should indicate that the service has been stopped successfully.
• Do the same to stop the following service:NET STOP "WINS Client"
• Close the command prompt window.

3) Remove the Registry Entries
Open Registry Editor. To do this, click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>
In the left panel, delete the subkeys:

• RpcPatch
• RpcTftpd

Close Registry Editor.

3) Install the patches for the DCOM RPC Exploit or WebDAV exploit, you can download the patches from the website.

[Snake08]

Try to download Malwarebytes on your system.

• Make sure you are connected to the Internet.
• Double-click on Download_mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
• Update Malwarebytes' Anti-Malware
• Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

Then try to scan your system.

• On the Scanner tab:Make sure the "Perform Quick Acan" option is selected.
• Then click on the Scan button.
• The next screen will ask you to select the drives to scan. Leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

[adilakport]

At last my experiments solved this issue. i removed qmgr.dll along with wuaueng.dll from "Windows/System 32". I think removing qmgr.dll is enough. if it is not worked try removing second one. qmgr.dll is a module associated with Background Intelligent Transfer Service from Microsoft Corporation and wuaueng.dll is a module belonging to Microsoft Windows Update. From these descriptions it is clear that windows update is downloading data from net even if it is disabled. So i think this is a method used by windows to check whether our system contain genuine os.

Deleting files from system32 in windows 7 or vista is not an easy task. You have to get the ownership of the file. Follow the instructions.

In start menu type cmd then right click cmd and select run as administrator.

To take ownership of the file, you’ll need to use the takeown command. Here’s an example:

takeown /f C:\Windows\System32\qmgr.dll

That will give you ownership of the file, but you still have no rights to delete it. Now you can run the cacls command to give yourself full control rights to the file:

cacls C:\Windows\System32\qmgr.dll /G Appu:F

Note that my username is Appu, so you will substitute your username there.

At this point, you should be able to delete the file. If you still can’t do so, you may need to reboot into Safe Mode and try it again. For the filename in the example, I was able to overwrite it without safe mode, but your mileage may vary.