Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

COM Surrogate, Windows Update, and Windows PowerShell, after ZDot infection


  • This topic is locked This topic is locked
5 replies to this topic

#1 prefect

prefect

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:20 PM

Posted 22 August 2014 - 01:08 AM

Hello,

 

Yesterday my laptop was infected with ZDot. I seem to have removed the infection with Norton, but since then, COM Surrogate processes have been opening up and eating my memory to the point of my computer hanging. Closing the processes will give me memory to work with, but then they run again shortly after. Googling suggested running windows update, which I haven't done in forever, but and troubleshooting issues with that, I can't even get my computer to recognize Windows Updates has available updates. Lastly, Windows PowerShell, which I have no idea what it is, keeps crashing.

 

I'm not sure what to do, but I can't really work on this computer until its fixed. Any help would be appreciated.



BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:20 AM

Posted 22 August 2014 - 02:40 AM

Hello -

Is there a chance of a typo in this line >>

Yesterday my laptop was infected with ZDot.

I do believe the infection could read ZBot, but I have been wrong on other cases ..........

 

A couple of first scans .............

 

First -

Please download RKill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not both of them.

You may get warnings from your antivirus about this tool, ignore them or Temporarily Disable your Antivirus

RKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Double-click on the Rkill desktop icon to run the tool.
*If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Copy and Paste it in your next reply.
NOTE. rKill.txt log will also be present on your desktop.

 

 

Next -

 

Run ESET Online Scanner.

 - For Internet Explorer Users

  • Hold down Control and click on This Link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu. to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives and Remove Threats"
  • Click Advanced settings and select the following:
    Scan potentially unwanted applications
     Scan for potentially unsafe applications
     Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer.
  • Please be patient as this will take some time. 1 / 2 / or even 3 hours can be expacted for a first scan.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.

NOTE:Sometimes if ESET finds no infections it will not create a log.

 

Last -

If you do have .MalwareBytes Anti-Malware installed, please run a scan and post the log back here.

 

Thank You -



#3 prefect

prefect
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:20 PM

Posted 22 August 2014 - 12:08 PM

Here's the report. My computer crashed at some point from memory issues while I was sleeping during the scan, but I didn't see a report.
 
_
Rkill 2.6.8 by Lawrence Abrams (Grinler)
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 08/22/2014 04:00:50 AM in x64 mode.
Windows Version: Windows 8 
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * C:\Users\Stephen\AppData\Roaming\Google\Google Talk\googletalk.exe (PID: 4516) [UP-HEUR]
 
1 proccess terminated!
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * No issues found.
 
Checking Windows Service Integrity: 
 
 * No issues found.
 
Searching for Missing Digital Signatures: 
 
 * No issues found.
 
Checking HOSTS File: 
 
 * No issues found.
 
Program finished at: 08/22/2014 04:27:14 AM
Execution time: 0 hours(s), 26 minute(s), and 53 seconds(s)


#4 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:20 AM

Posted 22 August 2014 - 05:53 PM

Execution time: 0 hours(s), 26 minute(s), and 53 seconds(s)

First - For Rkill the times should not run much over 2 minutes. (the 53 seconds is about average)

If it ever runs over 20 minutes then you do seem to have a problem ..........

I just ran a check on my Windows 8, and it took 0 hours(s), 1 minute(s), and 3 seconds(s).

 

 

Please follow the instructions in ==>This Prep Guide<== starting at Step 6.

Once the proper logs are created, then make a NEW TOPIC and post it to =>Malware Removal logs area<==

 Please be sure to include a description of your computer issues and what you have done to try to resolve them.

NOTES : If you cannot produce any of the requested logs, then please create the new topic anyway, include the information that you were unable to produce the other logs and why along with a description of your computer issues.
Please do not ever run ComboFix unless a Malware Response Team Member instructs you to do so.

 

If you could post a link back here once the New Topic is created, I will have this one locked, and only the Malware Response crew should deal with your problems.

 

Thank You -

 

EDIT - A very quick second scan produced this ==

Rkill 2.6.8 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/23/2014 08:56:17 AM in x64 mode.
Windows Version: Windows 8.1 << NOTE :

Checking for Windows services to stop:
 

 

Etc / Etc / Etc / ............


Checking HOSTS File:

 * No issues found.

Program finished at: 08/23/2014 08:56:39 AM
Execution time: 0 hours(s), 0 minute(s), and 21 seconds(s)


Edited by noknojon, 22 August 2014 - 08:03 PM.


#5 prefect

prefect
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:20 PM

Posted 23 August 2014 - 12:18 PM

http://www.bleepingcomputer.com/forums/t/545418/zbot-com-surrogate-and-all-kinds-of-memory-issues/

 

Thanks for you help so far!



#6 Queen-Evie

Queen-Evie

    Official Bleepin' G.R.I.T.S. (and proud of it)


  • Members
  • 16,485 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:My own little corner of the universe (somewhere in Alabama). It's OK, they know me here
  • Local time:04:20 PM

Posted 23 August 2014 - 12:23 PM

Now that you have posted logs in Malware Removal Logs

Please refrain from asking for further help from other members or staff until the Malware Removal Team has checked your posted log. The Malware Removal Team work very hard to investigate a unique solution to your problem and you will receive individual expert assistance. This takes time and effort so we ask you to please be patient while waiting for assistance and NOT to make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member. Any modifications you make on your own can result in system changes which may not show it the log you already posted. Further, following advice outside of that post may cause confusion for the team member assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

The Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean. If you followed any other advice already, please ensure you inform the Malware Removal Team Team Helper when they respond to assist you with your log. This will help them know what has been done and they probably will ask for an updated log.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Removal Team member is already assisting you and not open the thread to respond.

If HelpBot replies to your topic, please follow Step One so it will report your topic to the team members.

This topic is closed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users