Anyone know of a new virus or strain of an existing virus that creates a svcmgt.exe file that runs as a Service eating up all processor time? I can't find anything about it. Thanks.

Clue on a Chinese thread It has it listed in a HJT log .. C:\WINDOWS\System32\svcmgt.exe Look at the second response and the TechNet security bulletin it points to ... Microsoft Security Bulletin MS04-011 Security Update for Microsoft Windows (835732). See the iDiOt walk See the idiot TaLk WaLk IdIoT WaLk

I'm sorry...second response to what? And, the effected machines already have that particular MS Patch.

Original question mentions svcmgt.exe. First response tells person to run HJT. Second response says possible affected machines need to be patched according to the security bulletins mentioned. Person then runs a HJT log. Next response tells them what to get rid of using HJT. Blah blah. But if you've already patched, and are up to date .... Then I'll have another looksee elsewhere. See the iDiOt walk See the idiot TaLk WaLk IdIoT WaLk

A little more info. The Service name that is associated with this svcmgt.exe file is "Microsoft Support Service," and it's being added to the Run key in the Registry. Short of stopping the service and creating a bogus, read-only version of the executable, nothing seems to be working on fixing this, not even anti-virus upgrades. Has anyone else run across this? Help.....

I'm puzzled Jen. If you know this svcmgt.exe is a bogus file and should not be there, why haven't you already got rid of it ? I've never run into it before and the only clue regarding svcmgt.exe I've come across is as I've already mentioned. It turned up in a HJT log and was earmarked for removal. If you look at what was earmarked for removal, the very top one says .. O4 - HKLM\..\Run: [Microsoft Support Service] svcmgt.exe But I'm guessing you couldn't view the Chinese site as you don't have Chinese language text display installed in IE. But like I said, I'm curious why you haven't got rid yet. Or is it the extra detail you really want ? See the iDiOt walk See the idiot TaLk WaLk IdIoT WaLk

I am getting rid of it, but only with a bandaid. Prevention is what I'm looking for here, so what I need to know is where it's coming from and what is causing this new "Microsoft Support Service" to be installed on these machines. So, yes, the extra detail is what I want and need. And no, I couldn't view the Chinese site.