Another COM Surrogate Issue

SGreen38925 · Oct 21, 2014

I noticed about one week ago that my computer was running very slowly. I checked Task Manager and found several instances of COM Surrogate running. I can end these processes, but they will come back within a few minutes. My first step was to scan my system using Microsoft Security Essentials and Malwarebytes Anti-malware. Neither detected anything.

The problem progressed within a couple of days. I found that my security settings were changed and several pages that had previously stored my password, now required me to log in when I accessed the page. I'm not sure what all internet options were changed, but I do know that where I had chosen to keep pages in my history for 7 days, it was reset to 0 days. No matter how many times I changed it, it would revert back to 0 days the next time I opened by browser.

I have attempted to do all of the steps in the Read Me First tutorial, but I have had limited success. I was able to enable viewing of hidden files. I was able to disable the disk emulation software. I ran CCleaner with no problem.

I downloaded Rogue Killer, TDSSKiller, and Hitman Pro with no problem. I already have Malwarebytes so I did not have to download it. I did make sure that it was updated. I tried to download MGTools. First, the link would not work when I clicked on it. Then when I right clicked on it and selected "open in a new tab", it would always give me a blank page. I finally hovered over the link and wrote down the address and entered it manually. When I finally got to download it, I tried to download it in the C folder but I got the following message:

"You don't have permission to save in this location. Contact the administrator to obtain permission."

I saved it to Computer-System Files instead.

I was able to disable the UAC.

I ran Rogue Killer and it found ZeroAccess and Tr.Poweliks- I left this alone, as you advised. I expected to have a report on my desktop, but this did not happen. I had to manually save the report.

I ran Malwarebytes and it detected nothing.

I ran TDSSKiller and no threats were found. I expected the report to be found in my C: drive but I was unable to locate the report.

I ran Hitman Pro and no threats were found.

I tried to run MG Tools. I right clicked on the icon and selected run as administrator. I got the following error:

"Cannot export C:\MGTools\temp\xrkeylla.txt Error writing the file. There may be a disk or file system error."

I then went to the \MGTools folder and located the GetLogs.bat folder. I right clicked on that and chose run as administrator. I got the same error message.

Please let me know what steps I should take at this point. I will attach the logs that I was able to obtain. Thank you so much for your time.

Kestrel13! · Oct 21, 2014

Hi there.

Are you able to run MGTools.exe in safe mode at all?

SGreen38925 · Oct 21, 2014

MG Tools did work in safe mode. Thanks. I will attach the log.

I failed to mention that a new problem started today. I have been getting a box that shows up that looks sort of like an actual error message, except that the lack of capitalization and punctuation makes me think it is bogus. The box has "powershell" at the top. The message is as follows:

powershell has stopped working

A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available.

Kestrel13! · Oct 21, 2014

You have a zero access infection.

Ask Toolbar <<< Uninstall this junk.

Re run Hitman Pro and have it remove all that it finds.

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[ZeroAccess] (X64) HKEY_USERS\S-1-5-21-1705098522-3043440573-3339885335-1001\Software\Microsoft\Windows\CurrentVersion\Run | Google Update??❤ : "C:\Users\Sharon\AppData\Local\Google\Desktop\Install\{697d47b6-3833-4338-0dde-4684b87c7024}\❤≸⋙\Ⱒ☠⍨\?ﯹ๛\{697d47b6-3833-4338-0dde-4684b87c7024}\GoogleUpdate.exe" > -> Found

[ZeroAccess] (X86) HKEY_USERS\S-1-5-21-1705098522-3043440573-3339885335-1001\Software\Microsoft\Windows\CurrentVersion\Run | Google Update??❤ : "C:\Users\Sharon\AppData\Local\Google\Desktop\Install\{697d47b6-3833-4338-0dde-4684b87c7024}\❤≸⋙\Ⱒ☠⍨\?ﯹ๛\{697d47b6-3833-4338-0dde-4684b87c7024}\GoogleUpdate.exe" > -> Found

[ZeroAccess] (X64) HKEY_CLASSES_ROOT\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 | (default) : C:\$Recycle.Bin\S-1-5-21-1705098522-3043440573-3339885335-1001\$697d47b6383343380dde4684b87c7024\n. -> Found

[Tr.Poweliks] (X64) HKEY_USERS\S-1-5-21-1705098522-3043440573-3339885335-1001\Software\classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32 -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

...and the same for this entry on the File/folder tab please...

[ZeroAccess][Folder] Install -- C:\Users\Sharon\AppData\Local\Google\Desktop\Install -> Found

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Download Cleano 0.61

Download it to your desktop, Right click the cleano.exe file and run as admin > and place check marks in the boxes as follows (click on link below to see image)

View attachment 148092
Click clean now and exit the program.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Re run Hitman Pro and attach log.

Now re run RogueKiller (just a scan) and attach that log too, please.

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running!

SGreen38925 · Oct 22, 2014

Thanks! I have tried to remove that stupid Ask Toolbar SO many times. Every time I thought it was gone, but it would reappear later. Maybe I have killed it for good this time. I was able to run everything without incident. logs are attached.

SGreen38925 · Oct 22, 2014

I wasn't able to include the log from HitMan Pro on the previous post for some reason.

Kestrel13! · Oct 22, 2014

Navigate to this folder:

C:\Users\Sharon\AppData\Local\Temp Once inside, select all > and delete as many temp files away as possible. Some may remain, which is fine...

Explain how things are running. The logs look lovely now.

SGreen38925 · Oct 22, 2014

Quick question. I am getting a couple of different prompts about whether or not to delete items. The first one reads:

The folder contains items whose names are too long for the Recycle Bin.

The second one reads:

The file ______ is a system file. If you remove it, Windows or another program may no longer work correctly.

(The files are: Cookies, History.IE5, Temporary Internet Files, and IECompatCache.)

I just wanted to make sure I should delete these. Thanks.

Kestrel13! · Oct 22, 2014

Just keep the one it warns about. Get rid of the rest.

SGreen38925 · Oct 22, 2014

Okay, I got rid of the rest of them. No more COM Surrogates in the task manager. Things seem to be going well. Time to re-enable the Disk Emulation software and UAC?

Kestrel13! · Oct 22, 2014

OKay, here are final steps below.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

SGreen38925 · Oct 22, 2014

Thank you so much for all of your help. I try so hard to protect my computer, but sometimes things happen... I have completed all the steps you listed and have gone through all the steps on how to protect myself from future problems. You are so awesome! Thanks again!

Kestrel13! · Oct 22, 2014

You are most welcome. Safe surfing!

Log in or Sign up

Another COM Surrogate Issue

SGreen38925 Private E-2

Attached Files:

HitmanPro_20141020_2353.log

MalwareBytesScan10202014.txt

RKreport_SCN_10202014_224517.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Attached Files:

RKreport_DEL_10212014_215223.log

JRT.txt

RKreport_SCN_10212014_230326.log

MGlogs.zip

SGreen38925 Private E-2

Attached Files:

HitmanPro_20141021_2259.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Another COM Surrogate Issue

SGreen38925 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Attached Files:

SGreen38925 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

SGreen38925 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches