Comments on: NT/2000/XP: Clearing relaunching spyware processes

By: davak

davak — Tue, 07 Dec 2004 15:15:56 +0000

russellcomputer wrote:

You rock! Love it!

By: russellcomputer

russellcomputer — Tue, 07 Dec 2004 14:41:51 +0000

I did the tskill * and the computer wanted to shutdown. I got around it by Ctrl-Alt-Del, clicked on Task Manager -> File -> Run -> shutdown -a.

It stopped the shutdown and I could then work on the computer some more.

By: GauntletWizard

GauntletWizard — Sun, 12 Sep 2004 21:09:38 +0000

Well, I tested it out some, and discovered that as an administrator (Which you should NEVER run as), you can indeed kill SVCHOST with this util. Most people shouldn’t be running as admin. Running the desktop as a normal user account and using runas (Hold down “Shift” while right clicking on an executable or link to executable) should be sufficent for any normal use and even most installations.

Also, is it possible to edit recipes? I’d like to make a note of this in the main writeup.

By: MickeyMouse

MickeyMouse — Sun, 12 Sep 2004 13:41:04 +0000

If you kill an svchost.exe process with CTRL-ALT-DEL, it gives that little countdown and then reboots…

the blanket tskill * does it as well… I am assuming it is from killing the svchost.exe.

I can’t imagine a system that it wouldn’t force a reboot.

By: GauntletWizard

GauntletWizard — Sun, 12 Sep 2004 13:19:04 +0000

Hmm.. I’ve never seen that require a reboot. You can replace the asterisk with a regular expression that matches the process names of the spyware (e.g. tskill w* for wintoolsa and wsup, the wintools daemons). You can also run “tskill *” and then “Shutdown -a” to prevent a shutdown, if you can bring up the task manager fast enough.

By: davak

davak — Sun, 12 Sep 2004 04:39:00 +0000

So when I use this in XP:

tskill *

It kills everything… and then reboots. I have no way to running anything before the system reloads everything. There is got to be an easy way to kill everything except the nonvitals.

Do you have an easier way?