I have a process called cwershnsvc.exe on my computer. What is it?

[roma1625]

It's located in the System32 folder. I Googled it and I got no results. The thing is, something keeps creating items that my virus program and malwarebytes both identify as malware.

Anyway, something keeps creating a folder in Program Files called wddnthu with a couple of executable files in it (wddnthu.exe and sckdllbu.exe), then those exe's start running and try to connect to an internet site, but my virus program stops it from happening. Anyway, I started investigating and saw this process running and thought maybe this is what's causing the problem. Task Manager won't let me stop it.

 

[Ranger4]

Will your AV & Malwarebytes isolate & quarantine this item. If they do you should be able to remove it.

 

[roma1625]

They remove the items that they identify as malware, which are in the wddnthu folder, but then they comes back within a few minutes. So I'm trying to figure out what is making it come back.

So then I started looking at the processes running on my computer and found that cwershnsvc.exe, which I had never seen before. Out of curiosity I tried to stop it and Task Manager wouldn't let me. So then I Googled it and there were no results, so i became suspicious. That's why I'm asking if anybody here knows what it is. My AV and Malwarebytes do not identify it as malware, so maybe it's legit. But I mean, why is there something running on my computer that has no results on Google? Just seems odd to me.

 

[Ranger4]

Have you tried Right Clicking on that item in Task Manager & select Open File Location to see where it's located. That might help give you an idea of what it could be.

 

[roma1625]

It's in C:/Windows/System32

When I try to stop it in Task Manager, it says "Unable to terminate process. Operation could not be completed, Access is denied" with a red x.

I've fooled around with stuff enough to know that you can stop just about any process through Task Manager, so why not this one?

 

[Layback Bear]

Check in 'msconfig' and see if their is anything that looks like ' cwershnsvc.exe' under Startup or non Microsoft Services and Microsoft Services.

It would also be a good time to run Microsoft Malicious Software Removal. (MRT)
You can get 'MRT' through Windows Updates or from below.

Download Malicious Software Removal Tool from Official Microsoft Download Center

Jack

 

[Barman58]

I Agree with Jack's post above but would suggest you try Autoruns for Windows - Windows Sysinternals | Microsoft Docs as this will show a lot more than MSconfig and will allow you to better tie down the issue.

The main Tab will show everything that is set to start with windows and this can get a little confusing so I also suggest that you go through each of the specific tabs in turn, paying particular attention to the Known Hijacks Tab

It's also a good idea to initially set the option in the menus to hide all microsoft processes, as they are unlikely to be the cause unless malware is pretending to be an MS item

 

[Megahertz07]

Some executable files protect themselves from being turned off or deleted.
Start windows in Safe mode than delete the files.

 

[roma1625]

"Start windows in Safe mode than delete the files."

I've done that a couple of times that and it come back whenever I reboot. In fact, I noticed that the "Date Modified" on the file changes every time I reboot (to the date/time of reboot). So, in theory at least, it's modifying itself every time the computer boots up. And it regenerates itself if one deletes it.

 

[Barman58]

Sounds like it's using some form of Scheduled Task to restart the process. There is a Scheduled Task tab in Autoruns but this type of setup may require specialist assistance as It is often used by Malware, I'm not saying that this is the case here but it's possible.

you could try opening Task Scheduler and dong a search for the cwershnsvc.EXE file and see if you can discover more information.

I'd also try scanning the file at Online Malware Detection ESET as it could be a new camouflage file for an existing malware infection

I would not normally advise deleting the file until it is actually identified as something you do not need - you could somehow delete the file and then find that it causes worse problems and as you do not know what put it there you will then still need to Identify it

EDIT

upload the file to here ...https://www.virustotal.com/#/home/upload for an in depth check for malware

 

[Layback Bear]

Another little trick I use. Ccleaner.



It might show you what you are looking for.
You can turn on startup or turn it off.

You can also check scheduled task and context menu.
Just right tick and select what you want.

Jack

 

[roma1625]

It doesn't show up on CCleaner.

I get an error message when I go to Task Scheduler: "Reading data failed" When I press Show all running tasks, it gives me another error message "MMC has detected an error in a snap-in and will unload it." When I press OK, it (I assume) unloads a bunch of items and then says "Snap-in unavailable" with a red x and listing a bunch of items.

I don't know. I think I may be focusing on the wrong thing anyway. I really need to find out what's causing the wddnthu folder and files to regenerate themselves. That's the real problem as that is definitely malware. Right now I just delete it manually whenever it shows up. I had a theory that the cwershnsvc was the culprit mased on circumstantial evidence, but I've come to the conclusion that it's probably not the problem. Nothing I scan it with identify it as malware.

 

[Megahertz07]

Open a CMD window and type:
sfc /scannow

Use this software to scan for malware: SUPERAntiSpyware - SUPERAntiSpyware Portable Scanner

 

[Megahertz07]

Did you find a solution and got it fixed?