Taskkill remove service but then it returns from the dead right after!

Recently my bank released an update of their security access module and I was forced to install it onto my computer. The problem is that the crap eats around 25-30% of my CPU even when I am not accessing the bank website (that is 99.99% of time). I tried to kill the service from the CMD window with this:

taskkill pid 1628 /t /f

And then I was granted with the message:

"SUCCESS: The process with PID 1628 has been terminated."

Then when I returned to the task manager to check and realized that the evil thing was back with a new PID.

I can keep doing it the whole day and it still will return the next second with a new PID.



How can I manage to resolve this???

Thanks!

There is likely a service running that will start it up again it's finding the service

samuria said:

There is likely a service running that will start it up again it's finding the service

I suspected that. So then I would have to find what service is this and kill it first?

Find the service stop it and set it to disabled one would assume its name would match in some way with the software this may help track it down by date forensics - Find the service creation date in Windows? - Super User

If you know what the process is, run msconfig.exe. In the Startup tab, disable the process, if it's shown. Also check for it in the Services tab.

Malware will often attempt to shut down security software so it must take active steps to protect itself. I am rather surprised you were able to kill the process at all. It will try to ensure that the process can only be shut down by deliberate action by the user following the established procedure. Security software usually provides such a facility and that would be the most reliable method.

wither 2 said:

If you know what the process is, run msconfig.exe. In the Startup tab, disable the process, if it's shown. Also check for it in the Services tab.

It is not in the Startup list.

I am thinking in a "solution" that would be to uninstall the module from my computer and then setup a secondary W7 virtual machine with it only to access bank website. So it won't keep wasting my CPU resources all the time. I would have to buy an extra SSD for this though.

LMiller7 said:

Malware will often attempt to shut down security software so it must take active steps to protect itself. I am rather surprised you were able to kill the process at all. It will try to ensure that the process can only be shut down by deliberate action by the user following the established procedure. Security software usually provides such a facility and that would be the most reliable method.

This is a shame that the user/owner of a computer don't have control over it. I wonder what's the point of having administrative rights if you cannot administrate things. This is not the first time that I try to do things on my machine and am not allowed to. One of these days I was trying to share the access of my PC with another computer in my home network and even following all the steps that supposedly would allow me this I was miserably defeated.

After some attempts I guess I cannot get rid of this stupid module unless I UNINSTALL it. Since I am going to purchase a second SSD I will just remove it from my main system and set a small VM with W7 just for it. Thanks for helping!

What's curious about that module is, what is it doing that requires a PID when you're not using it? Like samuria said, there's a service running which will start it up again. If you run msconfig.exe and look in Services, is it there?