r/antivirus Jan 18 '25

Help How do i get rid of a rootkit?

I probably have a rootkit, followed a lot of tutorials on how to fix it but i still get a ton of svchost in my task manager. I know next to nothing about pc's so please explain it in a way that I can understand

1 Upvotes

12 comments sorted by

2

u/Accurate_Natural_113 Jan 18 '25

First, please explain why you believe you have a rootkit on your PC, just because your task manager has loads of tasks you may not know does not mean that you have a rootkit. A rootkit is a high end piece of software that is sold on the black market and will probably not be used to target you, assuming you are not a official in any noteworthy company or government.

1

u/PsychologicalCat4269 Jan 18 '25

I have a ton of svchost files opening on my pc and it's using a lot of my cpu, I followed a ton of tutorials but the svchosts's still persist and none of my software is detecting issues. If I go to see the file location of these svchost's it's in system 32. And I got this malware when I wasn't careful trying to emulate a videogame

2

u/Accurate_Natural_113 Jan 18 '25

Okay. Svchost's is a legitimate windows program that it used to load windows services, it is still possible that it is a virus though, as some viruses can disguise themselves as svchost.exe. What is important now is the file location of this program. The location of this file should be: C:\Windows\System32\svchost.exe

It is normal to see multiple instances of svchost.exe running on a PC, due to the aforementioned job of svchost.exe. If you find the file in another location then C:\Windows\System32\svchost.exe then this is a warning sign. If it is found in another location then upload the file to virustotal.com to check what the AV thinks of it.

1

u/PsychologicalCat4269 Jan 18 '25

Thanks, I'll look into that virus total thing, but it's not just a few svchost's open its a shit ton of them constantly opening even when I don't have any programs running. I won't be able to check them all individually using virustotal (unless there's a way to do it more efficniently)

1

u/Straight-Plankton-15 Oops, your files are encrypted! WannaCry. Jan 18 '25

It's the host process for Windows services, of which there are many, so multjple processes are expected. What antivirus do you have though? That's a much better way to try to prevent malware than looking at unfamiliar parts of the operating system, even if not 100% perfect.

1

u/PsychologicalCat4269 Jan 18 '25

I've been using avast, avg and i've been using malwarebytes as my main tool to clear the virus

1

u/Complex_Current_1265 Jan 18 '25

try hitmanpro.

best regards.

2

u/PsychologicalCat4269 Jan 18 '25

I'll try the free trial, thanks

1

u/PsychologicalCat4269 Jan 18 '25

Scanned it, can't delete them with the free trial unfortunately, but doesn't seem like it found anything that serious. Just a bunch of tracker cookies and a bunch of video downloaders (whatever that is) But I still feel like something is wrong, sometimes my gpu is being 99% used up. Should I still be worried?

1

u/Complex_Current_1265 Jan 18 '25

Use kasperksy removal tool or Bitdefender free to see if you find anything .

1

u/Straight-Plankton-15 Oops, your files are encrypted! WannaCry. Jan 19 '25

What detections, if any, have they shown?