svchost.exe file in the /windows directory not system32

Anyone else able to help on this?

My issue is pretty much the same.... I have a svchost.exe file in the /windows directory (not system32, where it SHOULD be). All the usual virus/malware cleaning programs can't get rid of it (I've run Hitman Pro, Malware Bytes, and TDSS Killer). Malware Bytes is still finding it on quick scans and full scans.

The effect it is having on my computer is that it is not allowing the computer to see get on the internet. It will "see" my router, but it won't connect to the internet, or interact with the other 2 computers on my network.

The Farber Service Scanner results are:
Connection Status:
Localhost is accessible
LAN connected
Attempt to access (Google/Yahoo, etc...): unreachable
Other Services:
sharedaccess Service is not running. Checking service configuration:
The start type of shared access is set to Disabled
ImagePath of sharedaccess service is OK
The ServiceDll of sharedaccess service is OK

Since I cannot get online with that machine, it's very difficult to fix, having to download scanners/cleaners on my other computers, transfer them by USB drives or SD card to the infected machine, then take logs or whatever and move them back to the healthy machine to try to get help from experts. Any help you guys could offer would be greatly appreciated.

Thank you.

Borg 386 said:

Do you remember the name of the virus that the programs keep finding?

Having just re-run Malware Bytes, it's coming up with zilch. Showing no infection, both from safe-mode and regular windows 7. However, the problem connecting to the internet still exists. The 1 problem that it WAS finding up until now, was simply listed as svchost.exe in the C/windows/ directory.

However, if I look into the Quarantine tab, stuff that has previously been found and quarantined include:
Trojan.Agent
Trojan.Agent
Rootkit.ZeroAccess
Trojan.Agent.EXPD1
Trojan.Agent
Trajan.Happili
Rootkit.ZeroAccess

Borg 386 said:

Suggest you do a scan with Windows Offline Defender. This is a boot disk that will scan your PC at start up. This tutorial will guide you through the process.

Windows Defender Offline

OK, I will give that a shot and report back, thank you.

OK, I ran Windows Defender Offline. It found 9 problems rated as "severe" and supposedly cleaned them up. (I can list those if necessary).

Upon going back in and resetting it to boot up like normal windows, I find the problem still exists. It's seeing my network, but not connecting to it or the internet. Subsequent scans of Malware Bytes still comes up with nothing. TDSS Killer finds nothing. FSS still finds the same thing as reported in my first post above. SVCHost analyzer still finds the same 3 problems when run as admin. two of them are Windows Defender (service name WinDefend), whose status is "active", the other is WinHTTP Web Proxy Auto-Discovery Service, which is also "active". For both, it says "the system cannot find the file specified" (referring to their respective dll files).

I understand that it's not looking good... and that a fresh install of 7 may be warranted. However, I'm not quite ready to give up just yet, so I have a few more questions, if you all would be so kind to offer your feedback....

1) - What about the program SuperAntiSpyware? That was recommended to me earlier today as another option that might find the problem.
1a) - What about ComboFix? That seems to be a last ditch resort from what I read, as it's "aggressive". But what if it DOES solve the problem without having to resort to a complete re-install?
2) - If TDSSKiller, MalwareBytes, Hitman Pro, and Windows Defender Offline, ALL are no longer seeing any traces of this rootkit/trojan, is it possible that I might just need to reset some settings that the virus changed on me? For instance, a similar malware got me a few months ago, and after it was removed/deleted, I was left with files that were "grayed-out", or "hidden". I had to download a program called "unhide" and it reverted everything back to normal. Could there be a similar fix for this? For instance, if some file was just changed that's not letting my computer "see" the network or the internet past my router, could there be a switch to flip, instead of resorting to a move as drastic as a complete re-install?
3) - If I DO have to re-install 7 and wipe my system clean, can I first move files I need off to another drive without worrying about sending the virus along with it? Specifically, I'm referring to video files (wmv and m2t, m2ts, mts, or mp4 extensions) and Word/Excel docs.
4) - If I DO do a new install of 7, and have temporarily put those files I needed to keep onto an external, which programs should I FIRST install on the new copy of 7 to provide maximum protection, and how would I go about "scanning" my external drives to make sure the same problem isn't transfered back onto this clean install?

I'd rather deal with 1, 1a, and 2, instead of 3 and 4.... but I welcome your thoughts on all the options. Thank you again for this education! I gotta admit, it's kind of fun, even though it's as frustrating as it is.