Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

DCOM service launcher using lots of memory


  • This topic is locked This topic is locked
10 replies to this topic

#1 castillo

castillo

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:02:07 PM

Posted 15 January 2014 - 11:58 PM

svchost process using lots of ram.  DCOM service launcher and termina services are the two services having issues.  I've scanned the computer with MBAM, MBAR, Tdsskiller, combofix.  MBAM & MBAR found malware and removed it.  Don't know what else I can do. 


Edited by hamluis, 16 January 2014 - 07:44 AM.
Moved from XP to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:07 PM

Posted 16 January 2014 - 04:39 PM

Welcome aboard p22002758.gif

 

Please download Rkill (courtesy of BleepingComputer.com) to your Desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.


If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 castillo

castillo
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:02:07 PM

Posted 16 January 2014 - 05:15 PM

RKill Log

 

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/16/2014 05:09:29 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * C:\WINDOWS\system32\LEXBCES.EXE (PID: 1856) [WD-HEUR]
 * C:\WINDOWS\system32\WDBtnMgr.exe (PID: 412) [WD-HEUR]
 * C:\WINDOWS\system32\LEXPPS.EXE (PID: 1328) [WD-HEUR]
 * C:\WINDOWS\wanmpsvc.exe (PID: 3184) [WD-HEUR]
 * C:\WINDOWS\system32\MsgSys.EXE (PID: 2012) [WD-HEUR]

5 proccesses terminated!

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Firewall Disabled

   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
   "EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * C:\WINDOWS\System32\rpcss.dll : 401,408 : 02/09/2009 07:10 AM : 302a1d0092fcaa892c0ab2e9e09f721b [NoSig]
 +-> C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\rpcss.dll : 401,408 : 02/09/2009 05:56 AM : 9222562d44021b988b9f9f62207fb6f2 [Pos Repl]
 +-> C:\WINDOWS\$NtServicePackUninstall$\rpcss.dll : 395,776 : 08/04/2004 00:56 AM : 5c83a4408604f737717ab96371201680 [Pos Repl]
 +-> C:\WINDOWS\$NtUninstallKB956572$\rpcss.dll : 399,360 : 04/14/2008 05:42 AM : 2589fe6015a316c0f5d5112b4da7b509 [Pos Repl]
 +-> C:\WINDOWS\ServicePackFiles\i386\rpcss.dll : 399,360 : 04/14/2008 05:42 AM : 2589fe6015a316c0f5d5112b4da7b509 [Pos Repl]
 +-> C:\WINDOWS\SYSTEM32\DLLCACHE\rpcss.dll : 401,408 : 02/09/2009 07:10 AM : f56ed30b876c3851b4489667a48bc9fb [Pos Repl]

Checking HOSTS File:

 * HOSTS file entries found:

  127.0.0.1       localhost

Program finished at: 01/16/2014 05:11:19 PM
Execution time: 0 hours(s), 1 minute(s), and 50 seconds(s)
 



#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:07 PM

Posted 16 January 2014 - 05:44 PM

Please click Start Menu > All Programs > Accessories, click on Command Prompt.
Copy/paste the following text at the command prompt and press enter after each line:

sfc.exe /scanfile=c:\windows\system32\rpcss.dll

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

A txt file named sfcdetails.txt should appear on the desktop.

Upload it here and post the link to the log in your next reply.

Reboot the computer in order the changes to take effect


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#5 castillo

castillo
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:02:07 PM

Posted 16 January 2014 - 08:25 PM

This is what I get when I run the second command.  Also the sfc log file on my desktop is blank.

C:\Documents and Settings\Salon>findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%u
serprofile%\Desktop\sfcdetails.txt"
FINDSTR: Cannot open C:\WINDOWS\Logs\CBS\CBS.log

 



#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:07 PM

Posted 16 January 2014 - 10:04 PM

Post new rKill log.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#7 castillo

castillo
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:02:07 PM

Posted 16 January 2014 - 10:11 PM

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/16/2014 10:06:05 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * C:\WINDOWS\system32\LEXBCES.EXE (PID: 6432) [WD-HEUR]
 * C:\WINDOWS\system32\LEXPPS.EXE (PID: 9456) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Firewall Disabled

   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
   "EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * C:\WINDOWS\System32\rpcss.dll : 401,408 : 02/09/2009 07:10 AM : 302a1d0092fcaa892c0ab2e9e09f721b [NoSig]
 +-> C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\rpcss.dll : 401,408 : 02/09/2009 05:56 AM : 9222562d44021b988b9f9f62207fb6f2 [Pos Repl]
 +-> C:\WINDOWS\$NtServicePackUninstall$\rpcss.dll : 395,776 : 08/04/2004 00:56 AM : 5c83a4408604f737717ab96371201680 [Pos Repl]
 +-> C:\WINDOWS\$NtUninstallKB956572$\rpcss.dll : 399,360 : 04/14/2008 05:42 AM : 2589fe6015a316c0f5d5112b4da7b509 [Pos Repl]
 +-> C:\WINDOWS\ServicePackFiles\i386\rpcss.dll : 399,360 : 04/14/2008 05:42 AM : 2589fe6015a316c0f5d5112b4da7b509 [Pos Repl]
 +-> C:\WINDOWS\SYSTEM32\DLLCACHE\rpcss.dll : 401,408 : 02/09/2009 07:10 AM : f56ed30b876c3851b4489667a48bc9fb [Pos Repl]

Checking HOSTS File:

 * HOSTS file entries found:

  127.0.0.1       localhost

Program finished at: 01/16/2014 10:07:06 PM
Execution time: 0 hours(s), 1 minute(s), and 1 seconds(s)
 



#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:07 PM

Posted 16 January 2014 - 10:13 PM

The fix didn't work.

We're dealing here with pretty new infection (Zekos malware) and I don't have a tool allowed in this forum to fix it.

 

Please follow the instructions in THIS GUIDE starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it HERE. Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#9 castillo

castillo
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:02:07 PM

Posted 16 January 2014 - 10:51 PM

Ran DDS and created a new topic in virus, trojan, spyware and malware removal logs and posted the logs.



#10 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:07 PM

Posted 16 January 2014 - 11:35 PM

p22003888.gif


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#11 Queen-Evie

Queen-Evie

    Official Bleepin' G.R.I.T.S. (and proud of it)


  • Staff Emeritus
  • 16,485 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:My own little corner of the universe (somewhere in Alabama). It's OK, they know me here
  • Local time:02:07 PM

Posted 18 January 2014 - 09:20 AM

Malware Removal Logs topic here http://www.bleepingcomputer.com/forums/t/521084/zekos-malware-infection/

Now that you have posted logs

Please refrain from asking for further help from other members or staff until the Malware Removal Team has checked your posted log. The Malware Removal Team work very hard to investigate a unique solution to your problem and you will receive individual expert assistance. This takes time and effort so we ask you to please be patient while waiting for assistance and NOT to make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member. Any modifications you make on your own can result in system changes which may not show it the log you already posted. Further, following advice outside of that post may cause confusion for the team member assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

The Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean. If you followed any other advice already, please ensure you inform the Malware Removal Team Team Helper when they respond to assist you with your log. This will help them know what has been done and they probably will ask for an updated log.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Removal Team member is already assisting you and not open the thread to respond.

If HelpBot replies to your topic, please follow Step One so it will report your topic to the team members.

This topic is closed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users