how to get a pid for a *32 process

[TryWare90Days]

I'm trying to kill a malware process, that I can't remove with my www.sophus.com/hom antivirus.

The malware is known as coinminer,config and my Sophus only creates popups of blocking the malware.

I know that the malware is constantly launching a svchost *32.exe processes, where the svchost.exe processes are from my Windows 7 operating system.

I have with no luck tried to do this:

Global $_bStatus = False

While $_bStatus = False
           Global $_iPid
           Global $_sActiveTitleNew = "svchost *32.exe"
           $_iPid = WinGetProcess($_sActiveTitleNew)
           If $_iPid <> -1 Then $_bStatus = ProcessClose($_iPid)   
Wend
EXIT
 

But the $_iPid doesn't ever show anything else than  -1, even if I can see the svchost *32.exe process in my TaskManager

 

YES - I know I shouldn't EXIT after killing the first malware detection, but it is easier to explain the above for you, so I can get a solution.

[BrewManNH]

Find out how it's being started instead of trying to kill the processes it's spawning. Find the exe that is being run first, delete it and go from there. If you can't delete it, download something like Unlocker and see if that will let you kill it. Or reboot in safe mode and delete it. There's probably a registry setting that needs to be deleted for it as well. 

[Earthshine]

https://malwaretips.com/blogs/remove-js-coinminer-trojan/

a number of utilities can do it, MalwareBytes included

[caramen]

To solve that problem I recomand you to,

Check these keys :
 

\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Nothing about svhost should be found. Or also suspicius exe name.

Or double check the  names of your services. Then google them. If looking suspicius.

Services.msc

If you find somthing you delete and reboot. If it s a service you can unregister it.

Edit: You got some rare case where WUpdate doing this problem.

I dont get it. Do you want a solution for your problem or a way to do it with autoIT ?

 

Edited October 16, 2018 by caramen