Windows 10: sihost64.exe virus?

My antivirus avast marks ths file: C:/windows/system32/microsoft/libs/sihost64.exe as trojan and ijfected fileasking because its in system32 folder.

:)

 

miner virus sihost64.exe - telemetry - how do i remove it?

i did run a full scan with administrator privileges on Windos Defender and it only blocks the miners that are created by the virus that are called sihost64 and or sihost32 and they are located in /appdata in the telemetry folder by microsoft. so it doesnt resolve the core problem, it kills only those soldiers that are created by the virus!

I also run a scannow and it repaired some .net framework things but thats it. i also run a chkdsk and no errors there.

I instaled then a trial version of eset antivirus and it didnt resolve anything. I also run it on full admin privilege - FULL SCAN

Now im running MICROSOFT SAFETY SCANNER 1.377 on full admin privilege and give it a FULL SCAN after the quick scan didnt find a problem.

9 mil files scan and found 33 infected files so i will let it run till it finishes and see if it resolves the problem

the "sihost32.exe" and "sihost64.exe" are still created and blocked while this scan is performed - this worries me that this scan will not resolve the problem

I checked the Startup and is all good - i uninstaled alot of what it tought are "suspicious" or "problematic" software i use in my 3d artist workflow and so my system runs preety clean now.

for more details about the virus i found this on the internet - preety acurate - Automated Malware Analysis Report for sihost64.exe - Generated by Joe Sandbox

 

/Users/%appdata%/Roaming/Microsoft/Telemetry/Sihost64.exe Malware

Hi Navy, that has definitely fixed it. Here's the VirusTotal report for the malware (sumcheck32.exe) removed that was writing sihost64.exe

VirusTotal

If you could mark the post that answered/resolved the issue, it would be much appreciated.

 

/Users/%appdata%/Roaming/Microsoft/Telemetry/Sihost64.exe Malware

Fixlog.zip

I really think it's worked, but I'm not 100% sure. For one, the Telemetry Folder no longer exists, and I can't find sihost64.exe, so thanks!

Edit: For some reason it's still not gone, since it still sends phishing links to my friends on discord