Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Mdmcls Removal Help!


  • Please log in to reply
5 replies to this topic

#1 LDiPrenda

LDiPrenda

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New Jersey
  • Local time:11:31 AM

Posted 08 March 2008 - 12:14 PM

My computer crashed a few weeks ago and I lost all my virus protection etc. I'm temporarily using CA. My computer has been going incredibly slow, and when I checked my processes log, I noticed that mcmcls.exe is using a huge amount of memory. I can't find much on how to remove this, can someone please help me? Thanks in advance!

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,112 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:31 AM

Posted 08 March 2008 - 06:05 PM

Where is it located (full file path) at on your system?

Go to jotti's virusscan or virustotal.com. In the "File to upload & scan" box, browse to the location of mcmcls.exe and submit (upload) it for scanning/analysis.
-- Then post back with the results of the file analysis.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 LDiPrenda

LDiPrenda
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New Jersey
  • Local time:11:31 AM

Posted 09 March 2008 - 07:56 AM

When I search for it on my system, results are:

MDMCLS32.EXE -1A7FF2AF which is located in C:\WINDOWS\Prefetch

and

mdmcls32 which is located in C:\WINDOWS\system32




Here are the scans for both files...


File MDMCLS32.EXE-1A7FF2AF.pf received on 03.09.2008 13:45:18 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.3.4.0 2008.03.07 -
AntiVir 7.6.0.73 2008.03.07 -
Authentium 4.93.8 2008.03.07 -
Avast 4.7.1098.0 2008.03.09 -
AVG 7.5.0.516 2008.03.08 -
BitDefender 7.2 2008.03.09 -
CAT-QuickHeal 9.50 2008.03.08 -
ClamAV 0.92.1 2008.03.09 -
DrWeb 4.44.0.09170 2008.03.09 -
eSafe 7.0.15.0 2008.03.06 -
eTrust-Vet 31.3.5597 2008.03.07 -
Ewido 4.0 2008.03.09 -
FileAdvisor 1 2008.03.09 -
Fortinet 3.14.0.0 2008.03.08 -
F-Prot 4.4.2.54 2008.03.08 -
F-Secure 6.70.13260.0 2008.03.08 -
Ikarus T3.1.1.20 2008.03.09 -
Kaspersky 7.0.0.125 2008.03.09 -
McAfee 5247 2008.03.07 -
Microsoft 1.3301 2008.03.07 -
NOD32v2 2932 2008.03.09 -
Norman 5.80.02 2008.03.07 -
Panda 9.0.0.4 2008.03.09 -
Prevx1 V2 2008.03.09 -
Rising 20.34.62.00 2008.03.09 -
Sophos 4.27.0 2008.03.09 -
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.09 -
TheHacker 6.2.92.238 2008.03.08 -
VBA32 3.12.6.2 2008.03.05 -
VirusBuster 4.3.26:9 2008.03.08 -
Webwasher-Gateway 6.6.2 2008.03.09 -
Additional information
File size: 44736 bytes
MD5: 90dc20d783bf82c2ef07201b2d6a9f5d
SHA1: 82a9a0351ddffd60bda42610b94fbd51f1a1a44f
PEiD: -



File mdmcls32.exe received on 02.12.2008 05:03:18 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.2.12.11 2008.02.12 -
AntiVir 7.6.0.62 2008.02.11 -
Authentium 4.93.8 2008.02.11 -
Avast 4.7.1098.0 2008.02.11 -
AVG 7.5.0.516 2008.02.11 -
BitDefender 7.2 2008.02.12 -
CAT-QuickHeal None 2008.02.11 -
ClamAV 0.92 2008.02.11 -
DrWeb 4.44.0.09170 2008.02.11 -
eSafe 7.0.15.0 2008.02.11 -
eTrust-Vet 31.3.5529 2008.02.11 -
Ewido 4.0 2008.02.11 -
FileAdvisor 1 2008.02.12 -
Fortinet 3.14.0.0 2008.02.11 -
F-Prot 4.4.2.54 2008.02.11 -
F-Secure 6.70.13260.0 2008.02.12 -
Ikarus T3.1.1.20 2008.02.12 -
Kaspersky 7.0.0.125 2008.02.12 -
McAfee 5227 2008.02.11 -
Microsoft 1.3204 2008.02.11 -
NOD32v2 2866 2008.02.11 -
Norman 5.80.02 2008.02.11 -
Panda 9.0.0.4 2008.02.11 -
Prevx1 V2 2008.02.12 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.26.0 2008.02.12 -
Sunbelt 2.2.907.0 2008.02.12 -
Symantec 10 2008.02.12 -
TheHacker 6.2.9.217 2008.02.11 -
VBA32 3.12.6.0 2008.02.11 -
VirusBuster 4.3.26:9 2008.02.11 -
Webwasher-Gateway 6.6.2 2008.02.11 -
Additional information
File size: 1212416 bytes
MD5: 887632aa68280a259019409d9b6dba0a
SHA1: bce750926355939ae299652f4a1cee71134f0d40
PEiD: Armadillo v1.71

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,112 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:31 AM

Posted 09 March 2008 - 09:10 AM

The scans indicate the file is not malware. During my research, I'm finding mixed reviews. MDMCLS32.EXE can be found in Prevx's database but they have no specific vendor information. There is indication that this file is related to CA Internet Security. If that file appears as a startup then it could be a Trojan. Can you confirm you are seeing it as a running process and not a startup? I suspect that is the case or it would have been flagged as bad by jotti or virustotal.

Right-click on the file, choose Properties and examine the General and Version tabs. What does it say? You can download and use Process Explorer or System Explorer to investigate all running processes and gather additional information to identify and resolve problems. These tools will show the process CPU usage, a description and its path location. If you right-click on the file in question and select properties, you will see more details about the file.

Also check to see if its running as a service.
  • Click on Start > Run and type: services.msc
  • Press OK.
  • Click the "Extended tab" at the bottom to view all the info on your services.
  • Scroll down the list and see if you find a service called MDMCLS32.EXE.
  • If so, double-click on it or right-click and choose "Properties".
  • In the Properties Window > General Tab that opens, click the "Stop" button.
  • From the drop-down menu next to "Startup Type", click on "Disabled".
  • Click "Apply", then "OK" and close any open windows.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 LDiPrenda

LDiPrenda
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New Jersey
  • Local time:11:31 AM

Posted 09 March 2008 - 09:44 AM

When I click on properties --

General:
Type of file: Application
Description: mdmcls32.exe
Location: C:\WINDOWS\system32
Size: 1.15 MB (1,212,416 bytes)
Size on disk: 1.15 MB (1,212416 bytes)

Created: Yesterday, March 08, 2008, 11:02:52 AM
Modified: Yesterday, March 08, 2008, 11:02:52 AM
Accessed: Today, March 09, 2008, 10:26:27 AM

Version:
File version: 5.0.53.0
Description: mdmcls32.exe
Copyright: Copyright 2007


When I try to end the process, it will go away for a few minutes but it shows up again very soon after...

When I run services.msc, I do not see it as a service.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,112 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:31 AM

Posted 09 March 2008 - 07:09 PM

Please read this discussion thread.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users