Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Trojan Notifications and Memory Hog

  • Please log in to reply
2 replies to this topic

#1 Joe109


  • Members
  • 5 posts
  • Local time:01:29 PM

Posted 23 October 2014 - 10:38 PM



I have noticed that in my task manager, i get various amounts of processes from  "dllhost.exe*32" which has the description " COM SURROGATE" eating up ALOT of memory making everything go slow- I've had around 20 of them at once before until i start ending the processes. When I try to open the file location, Its path is Computer > C Drive > Windows > SYSWOW64. From Norton, I get notifcations of "Trojan. Ad. Clicker activity", "Powelik Activity" and "web attack: Exploit toolkit website 33". Not all at once but at various times I get the notifcations by Norton that they were blocked.  I've ran Malwarebytes anti-malware and Norton internet security many times and seem to not pick up anything. I am not very great at looking up logs so would be a novice at that stuff. I was hoping if i could find some guidance to find out how to fix this. 


My operating system I use is windows 7. I also, occasionally get popups that say, "  Your current security settings  do not allow this file to be downloaded" even though i'm not downloading anything. I suspect that is related to the many "COM SURROGATE" Processes because when that popup happens, There are many processes of "COM SURROGATE" running. 

Edited by Joe109, 24 October 2014 - 12:51 AM.

BC AdBot (Login to Remove)


#2 Joe109

  • Topic Starter

  • Members
  • 5 posts
  • Local time:01:29 PM

Posted 23 October 2014 - 11:53 PM

Heres the most recent Malwarebytes anti-malware log
Malwarebytes Anti-Malware
Scan Date: 10/23/2014
Scan Time: 11:30:59 PM
Logfile: Malwarebytes Anti malware Log.txt
Administrator: Yes
Malware Database: v2014.10.24.01
Rootkit Database: v2014.10.22.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Joe
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 373206
Time Elapsed: 18 min, 4 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)

#3 Joe109

  • Topic Starter

  • Members
  • 5 posts
  • Local time:01:29 PM

Posted 24 October 2014 - 11:50 AM

I tried creating another user account to see if it had the same symptoms (High memory usage, Norton Trojan notifications) Seems that after about an hour or so, I've yet to see any dllhost.exe*32 "COM SURROGATES" in the task manager and yet to have any Trojan notifications.Only high usage is from 6x chrome processes(chrome.exe*32)  which seems to be normal. I don't get how that works that the symptoms seem to have dissipated- at least for right now on this new user account. So, its seems that it's affecting to my main user account.


I've bene on the main user account now and tried using adw cleaner - heres that log.



# AdwCleaner v4.001 - Report created 24/10/2014 at 16:59:03
# DB v2014-10-23.2
# Updated 20/10/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Joe - JOE-PC
# Running from : C:\Users\Joe\Desktop\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\Users\Joe\AppData\Local\Temp\AtuZi
Folder Deleted : C:\ProgramData\DeviceVM
Folder Deleted : C:\Users\Joe\AppData\Roaming\DeviceVM
Folder Deleted : C:\Users\Joe\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Joe\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
[!] Folder Deleted : C:\Users\Joe\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
***** [ Scheduled Tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A13C2648-91D4-4bf3-BC6D-0079707C4389}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AB4C7833-A6EC-433f-B9FE-6B14B1A2F836}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A13C2648-91D4-4bf3-BC6D-0079707C4389}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AB4C7833-A6EC-433f-B9FE-6B14B1A2F836}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A13C2648-91D4-4bf3-BC6D-0079707C4389}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AB4C7833-A6EC-433f-B9FE-6B14B1A2F836}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{A13C2648-91D4-4bf3-BC6D-0079707C4389}]
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.7601.18595
-\\ Mozilla Firefox v
-\\ Google Chrome v38.0.2125.104
AdwCleaner[R0].txt - [3426 octets] - [24/10/2014 16:49:19]
AdwCleaner[R1].txt - [3484 octets] - [24/10/2014 16:56:51]
AdwCleaner[S0].txt - [3105 octets] - [24/10/2014 16:59:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3165 octets] ##########

Edited by Joe109, 24 October 2014 - 05:11 PM.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users