Computer virus with the ability to "regenerate" is spreading rapidly in Vietnam

Svchost.exe is an important process on the Windows operating system. It runs as a backend process for system services, allowing those services to operate independently of each other. Each service in Windows can run as a separate process or run as a service managed by svchost.exe.

In a new warning about a virus that takes advantage of the standard svchost.exe process on computers to penetrate the system and "regenerate", Bkav said that the malware monitoring and warning system of this network information security company recorded nearly 96,000 computers infected with this virus, just in August.

According to experts' analysis, even if users detect and delete malicious files manually, this virus can still "regenerate" by taking advantage of the svchost.exe process in the system. Not only taking advantage of svchost.exe, this virus also searches for default software that comes with Windows versions such as OneDrive or NotePad, to perform similar actions. This makes it difficult to handle or completely remove them.

More dangerously, not only is it difficult to remove, this virus also has a mechanism to spread via USB by hiding the data in the USB, replacing it with shortcuts (shortcuts - PV) that fake the data. These shortcuts contain commands to call the virus hidden in the USB. If the user opens the fake shortcuts, the virus will be executed.

Finally, after penetrating and surviving on the victim's computer, the virus disables Windows' built-in protections and waits for an opportunity to download other malicious files, in order to steal user information and send data to the attacker's server.

To avoid being attacked by this virus, Bkav experts recommend that users be more vigilant when using peripheral devices to copy data between computers. If necessary, businesses and organizations can issue a policy of not using USB in their businesses and organizations.

Along with that, users need to always enable hidden file display mode and check the shortcut in USB before clicking on it. Faking shortcuts in USB is also used by many other viruses.

Experts also recommend that users use and regularly update copyrighted network security solutions and software to protect computers and systems from threats that are difficult to detect or require complex processing to completely remove viruses.