Windows 7 SVCHOST.EXE tries to change my host and dns file

Hello All,
I have Symantec Endpoint 12.1.3 on a Windows 7 pc. It is infected. one of the svchost.exe files (three on the hard drive), one in SYSTEM32 keeps trying to change my Host file and DNS files. Symantec blocks all attempts. I submitted the three svchost.exe files for virus detection and they are clean. The file I suspect to be corrupted is in the WINSXS directory in Windows 7. What do I do? I have scanned and rescanned with no viruses or spyware but something is there. I am an experienced virus hunter and virus hunt for many companies. Now, one of my work pcs is infected and I cannot see it.
Thanks in advance to all,
Who is Participating?
John HurstConnect With a Mentor Business Consultant (Owner)Commented:
@dronethought  - Also be aware that if the machine is badly enough wrecked that you will save time by reinstalling Windows. Virus repairs often are not permanent.

... Thinkpads_User
John HurstConnect With a Mentor Business Consultant (Owner)Commented:
There are near a half dozen svchost.exe files in my Winsxs folder (windows 8 but very similar).

Can you use Windows Explorer, make sure it can see hidden files and then look there?

Can you scan that folder with SEP?  I think you can. I have SEP V12.1.3 on this machine but the machine is totally free of viruses and I won't see the same things as you.

.... Thinkpads_User
jcimarronConnect With a Mentor Commented:
svchost is unlikely the cause.  It only assists other programs to run.  One of those other programs is usually the culprit.

To determine the other program(s)
dronethoughtAuthor Commented:
Thank you all. Never found the problem. I was able to look at every svchost.exe file to see what it was calling. Then a dllhost.exe file started kicking in. The virus was iBryte Optimum Installer and was from a fake "you need an updated flash player" message. Anyway, I let the virus change the host file to see what it was adding and nothing was added...odd. Anyway, I let Symantec block any changes to my hosts file in the meantime. I will have to format and start over.
dronethought--Thanks for telling us the solution.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.