Windows 10: What is adminservice.exe/AtherosSvc is it a malware/trojan?

Tyree47 · Jun 23, 2019

Alright i wanna start off by saying i know this has to be a malware already cause one, when i open services all the other programs running on my computer have a description this one doesn't.

This is what it says when i look at the details.

Service name: AtherosSvc

Display name: AtherosSvc

Description:

The description is blank, it doesn't say anything so that's why i'm not putting anything there, it's also makes it 10x times more weird.

Path to executable: C:\WINDOWS\System32\drivers\AdminService.exe

Startup type: It was (automatic) But i since disabled it.

Service Status: It was running but i stopped it.

And when i go to the (Log on) Section of the details of this program/file.

It says...

Log on as: (Local System Account)

I also checked everything else out about this program and for recovery on it says (Take no action) on First failure, second failure and subsequent failures.

Also for (Dependencies) it says nothing, like it has no dependencies no programs or anything depend on this, which i also found really strange.

I did a file search i searched up where this program was located, it was located in system32/drivers.

It was created on: June ‎26, ‎2018, ‏‎5:03:28 AM

Modified: June ‎26, ‎2018, ‏‎5:03:28 AM

Accessed: June ‎26, ‎2018, ‏‎5:03:28 AM

Also the size of this file is: 406 KB (416,072 bytes)

And, The size on disk is: 408 KB (417,792 bytes)

And it's an .exe file.

I don't know if any of this helps just including it to make sure this a legit file or something or if this information will help someone help me to figure out if this is a safe program/file or not.

I went to the details of the file and for copyright it says: Microsoft Corporation. All Rights reserved.

So if this a legit microsoft file by any chance than it's extremely sketchy,

Also the original file name is: SETUPAPI.DLL

And i already did a virus/malware full scan, with malware bytes, and i'm currently doing a full scan with windows defender, than i'm gonna do a full scan with bitdefender, so hopefully it detects something, but if anyone can help me out that would be greatly appreciated.

:)

Mel Tar · Jun 23, 2019

Rooted Malware, Virus, and Trojan Infection, Keylogger Trojan Malware

Hi,

Please click the link below and follow Stephen Boots' suggestion on how to remove Trojan virus on your computer:

List of anti-malware product removal tools

Let us know if you need further assistance.

Borg 386 · Jun 23, 2019

Trojan malware: The hidden cyber threat to your PC

But while cryptojacking and ransomware continue to be widespread threats, other attackers have continued to quietly deploy a potentially much more damaging threat: trojan malware.

As the name suggests, trojan malware sneaks onto your PC by disguising itself as something else, often hidden in a malicious attachment that's distributed with a phishing email.
Click to expand...

It sometimes appears as if trojans have been overlooked when talking about hacking threats, with some seemingly dismissing the malware as old-hat, a dated means of attack. However, a recent report from security company Malwarebytes reveals how trojans and backdoor attacks have rocketed in the past year.

"We're seeing a new generation of stealers make an impact recently," says Jérôme Segura, head of threat intelligence at Malwarebytes.
Click to expand...

Trojan malware: The hidden cyber threat to your PC | ZDNet

Jon Barrow · Jun 23, 2019

Malware tprdpw64.exe after installing 7zip

Hi Jon,

Please follow the removal guidelines here:
https://www.bleepingcomputer.com/virus-removal/remove-winvmx-client-and-vmxclient.exe-pup/ (which is closely tied to

https://www.bleepingcomputer.com/virus-removal/remove-the-requested-resource-is-in-use-error which explains the basis for the first link). In either case, the removal instructions are virtually the same. I recommend the first link.

If that doesn't work (or you'd prefer to let them personally guide you step by step to be more certain and get anything else while you're at it), then I recommend you open a free case with the experts at bleepingcomputer by following the instructions and
the link at the bottom of the above manual removal instructions.

Best wishes,

Kosh
Click to expand...

Thank you for the reply and the suggestions. However neither link provided a working solution. I followed each set of instructions step by step, to the T, but the viruses are still there.

I killed the processes with Rkill as instructed, and it found and ended the malware process `tprdpw64.exe`. It, however, did nothing
about the adware `svcvmx` & `svcvmx client` processes. After doing so I downloaded and installed Zemana, as instructed, and let it do a full system scan. Might I add that this took over
10 hours to complete, as I have 1,396,541 files on my PC, so this whole thing wasted nearly half a day of my time with no results.

Zemana detected the malware virus `tprdpw64.exe` located at "C:\WINDOWS\System32\tprdpw64.exe"
(among other, smaller "threats"), and labeled it as malware. After it finished the scan, it said it has placed all files into quarantine, including `tprdpw64.exe`.
However, when checking the quarantine list `tprdpw64.exe` is
not listed. I then decided to have Zemana remove the files in the
quarantine list from my system and then rebooted my PC. It removed them all successfully, except for `tprdpw64.exe`
which is still on my system, and still runs (I can still see it in task manager after rebooting). So the 10+ hours of waiting were all for nothing.

I then used Zemana's "drag-and-drop" feature to re-scan just `tprdpw64.exe`
(in order to not have to wait 10+ hours again). It scanned it, and now says the file is not a threat (but it clearly is).

I then proceeded to step 2, using AdwCleaner to remove the adware. This did not work in the slightest. AdwCleaner did not detect the adware virus at all, and thus did nothing about it. I still cannot remove the viruses manually, either. However for some
reason, the adware `svcvmx` & `svcvmx client` processes no longer seem to run (my PC has been on for about an hour, and the processes
have yet to startup). However, even so the files are still on my file system and would like to delete them.

EDIT

I have just searched my registry, looking for any possible signs of tprdpw64 being listed, and there was nothing there.

Windows 10: What is adminservice.exe/AtherosSvc is it a malware/trojan?

What is adminservice.exe/AtherosSvc is it a malware/trojan?

What is adminservice.exe/AtherosSvc is it a malware/trojan?

What is adminservice.exe/AtherosSvc is it a malware/trojan?

What is adminservice.exe/AtherosSvc is it a malware/trojan? - Similar Threads - adminservice exe AtherosSvc

Trojan malware

Trojan malware

Trojan and Malware

Trojan and Malware

Trojan and Malware

Trojan malware

Trojan malware

Trojan Malware

What is AdminService.exe/AtherosSvc?

Users found this page by searching for:

atherossvc

AtherosSvc AtherosSvc

atherossvc is trojan