Strange Processes Slowing Me Down

Merkava · Nov 10, 2017

(copied from the Public Malware Help board)

Hey guys. Need some help. Picked up something stubborn that seems to have morphed after I detected it and took some steps to delete it. I uninstalled a few things from the control panel programs list, and from C: Program Files.../System32, inter alia. More items seem to have popped up. I tried Malwarebytes and was able to run it twice with results that were quarantined and deleted, but the 3rd time - when I had it in mind to post results, the scans came up negative. Sneaky. I also used Hijackthis and was able to fix a couple of things, but according to online parsers/analyzers, several entries in %systemroot% - which should be deleted, couldn't be, due to access permissions. I'm going to post a pic of the processes running in my task manager, and the AdwCleaner log(which I don't quite comprehend). I also still have the HJT log, if needed.

Thanks.

TimW · Nov 10, 2017

As I said in your other post, you have some unknown processes running. Please follow the instructions in the Read and Run First sticky at the top of the forum and once done, attach the requested logs.

Merkava · Nov 10, 2017

Okay. I got as far as MGTools and had some strange events.

UAC is definitely disabled, firstly. Pic attached.

Malwarebytes file save name was changed, and results were negative. Log attached.

RogueKiller didn't finish for some reason. Error message pic attached.

HitmanPro got as far as closing the save log file window, but then hangs up(ran twice to be sure), and crashes, apparently. So no document available for attachment. I will say that of the few suspicious and one malware-flagged items, they weren't problematic, I think. They looked to be related to an anti-cheat program for games - PunkBuster.

MGTools had the same CMD prompt message pop up upon running the executable, and the GetLogs batch file, both as Admin. Pic of message and MGLogs.zip attached.

I'm still having the same issues indicated in the Task Manager pic above.

TimW · Nov 10, 2017

First, remove everything that was found in ADW. Next, open task manager and end these processes:

lscdpnb.exe
exibrgo.exe

Do not reboot!

Try to rerun RogueKiller and Hitman.

Merkava · Nov 10, 2017

I actually accidentally rebooted, but RogueKiller worked fine and got the processes running in Task Manager, along with quite a few other things - mostly registry entries. Hitman still has the problem following attempting to save the logfile, but again, the detected items were false positives. I can run again and just get a screenshot of the results if needed.

TimW · Nov 10, 2017

Please attach the RogueKiller log and if you can, copy and paste into notepad the results from Hitman.

Merkava · Nov 10, 2017

Didn't save RogueKiller results. Now it won't run! It was effective, at least.

Can't copy/paste Hitman results, but I got a couple of screencaps, , the second of which has a message that didn't appear the other couple of times I ran it. It just goes to a screen asking for a license key, so eliminating detected items isn't an option anyway, beside the fact that they, again, seem to be false positives.

TimW · Nov 10, 2017

I am still worried about some processes. Please do the following:

Please do the below so that we can boot to System Recovery Options to run a scan. There will be two options to choose from.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Option1: Enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

Option2: Enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)

Merkava · Nov 10, 2017

I opened notepad and, not being quite sure about the instructions, I chose "All Files", and FRST showed up, whereas it was just looking for .txt files at first, so nothing was visible. I chose "Open", and a bunch of code appeared in the notepad. I closed it, then typed "d:\frst64.exe", and it said it wasn't recognized. Rebooted, and the processes lscdpnb.exe and exibrgo.exe are back again.

Should I have saved the notepad with the code in it?

dr.moriarty · Nov 10, 2017

Hello, Merkava

The reasoning behind using Notepad is after opening a Command Prompt window, you are only using Notepad to see what drive letter your machine has assigned to the flash drive containing frst... nothing else - just "File/Open", look for the flash drive letter, close Notepad, now command your machine to run frst which is located in drive (assigned drive letter). <--- That's done by (assigned drive letter):\frst64

Merkava · Nov 10, 2017

Okay. However, like I said, it gave me a "not recognzed" message, so it wouldn't run..

TimW · Nov 10, 2017

Humm....let's try running this:
Please download Zemana Malware Removal to your desktop and run it please. It should produce a log for you. At the top right it will give you a report.

Merkava · Nov 10, 2017

Had to boot OUT of safe mode and into normal. Noticed that the "not legitimate copy of windows" is now appearing at the bottom right corner. There are even more strange processes running in regular mode (task manager pic attached), and Zemana wouldn't run properly(error message pic attached). A couple of those processes could be terminated, but the main two - lscdpnb.exe and exibrgo.exe, still disallow termination.

TimW · Nov 10, 2017

If Farbar completed properly, you should have on your flash drive a file > FRST.txt. Do you have it?

Merkava · Nov 10, 2017

It didn't even initiate, much less complete. That's what I meant by "'not recognized' message".

TimW · Nov 10, 2017

The only thing found by the logs was PunkBuster. Use windows explorer to find and delete > (see image as my forward slash is not working LOL) Just remove the entire PunkBuster Folder.

Otherwise, looking at your screenshots and what did run, there is no malware that could be accounting for your issues. Could you do a system restore to a date before these issues started?

Merkava · Nov 10, 2017

I might be able to do a sysrest, but deleting Punkbuster files doesn't add up, unless it's possible/likely that whatever inection is using it as a medium. PunkBuster is pretty well-established, thus not really on my radar as an offender here.

TimW · Nov 10, 2017

It's the only file that came up in the scans as a trojan. Usually it is benign, but your copy could be infected. However, it is usually benign. However, considering your issues, I can only suggest a restore or:

http://www.majorgeeks.com/files/details/tweaking_com_windows_repair.html

TimW · Nov 11, 2017

I can't force you to uninstall Punkbuster, but I have never known Roguekiller to give a false positive. It is very possible that where you downloaded it from, the program was embedded with a trojan, which could account for the scans not running and the other issues you are having.

Merkava · Nov 11, 2017

I've had it for a while. Way longer than the problems have been occurring. Is it possible that whatever offender injected into those files and usurped their functions? I just deleted the ones that came up on Hitman, and the strange processes still show up in taskmanager. I want to go through the fix programs I've downloaded, unistall them, clean their registry entries, then reinstall under pseudonyms to see if I can get them around any detection/prevention methods the malware may have. Then I'll check into a system restore if it's no help, I guess. Does that seem at all useful?

Thank you guys for your help so far, by the way. I know it's (at least mostly) a labor of love for you, IIUC. I'll let you know how this goes when I'm done.

TimW · Nov 11, 2017

Your latest screenshot of task manager did not show any unusual processes. Your plan sounds reasonable. Let me know how it goes.

Merkava · Nov 11, 2017

No, it had several instances of those two - lscdpnb.exe and exibrgo.exe.

TimW · Nov 11, 2017

Merkava said: ↑

lscdpnb.exe
Click to expand...

Is described as a Windows Process Manager .... the other is only listed as Client Service. Not sure about that last one.

Perhaps you should try running:

eSet Online Scan.

Merkava · Nov 11, 2017

Before I go through all that, I decided to look in C: Users\Owner\App Data\Local and found a folder correlating with one of the processes - "exibrgo", and another suspicious one - "zadtgpv". I can't access permissions to delete it though, and I'm in Safe Mode. Any suggestions?

TimW · Nov 11, 2017

Are they .exe? I need to know the full path to the files, please.

TimW · Nov 11, 2017

Let's see if we can figure out what is going on with this.

Download TDSSKiller from Kaspersky directly onto your Desktop

Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7,8 and 10, do not double click on it but rather, right click and select Run As Administrartor. )

If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).

If you do not see the file extension, please refer to: How to view hidden, system files & folders!

You may see a window similar to the below appear

Click on Run to allow the application to run properly.

If you see any popup warnings from your antivirus or firewall about it trying to access the nework or similar, make sure that you allow it to run/have access.

It will start the scan and run rather quickly and will notify you of whether anything is found or not.

You will then see the below window

Click on the Start scan button to begin the scan and wait for it to finish. When it finishes, you will see a window similar to below accept you may have one indicating infections were found.

Follow the instructions to delete/quarantine if asks you what to do when if finds something.

Whether an infection is found or not, a log file should already be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

Reboot and the infection should hopefully be removed.

TDSSkiller - How to run

Merkava · Nov 12, 2017

Sorry. Backtracking a bit now. It seems I simply didn't give MGTools long enough to run. I thought the CMD prompt message that came up about the "process being completed" was final. It's going right now, so I guess I'll post the result for real this time...?

TimW · Nov 12, 2017

Good idea.

Merkava · Nov 12, 2017

Here we go.

TimW · Nov 12, 2017

Nothing found. Please do the TDDSKiller scan. I need it to double check.

Merkava · Nov 12, 2017

Will do. There are two MGLogs.zips though. The one above is from C:, and this one is from the desktop. Not sure why there are two.

TimW · Nov 12, 2017

Don't worry about it. Both report the same.

Merkava · Nov 12, 2017

Okay. I actually just ran FRST as part of my proposed re-download under pseudonyms and re-run after registry clean, and I made a mistake last time with the drive letter!

So here's that, and I'm doing TDDS right now.

Merkava · Nov 12, 2017

TDDSKiller log

TimW · Nov 12, 2017

Did you reboot after running TDSSKiller? If not, do so now.

Once back in normal mode:

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message.

Merkava · Nov 12, 2017

TimW said: ↑

Are they .exe? I need to know the full path to the files, please.
Click to expand...

Sorry, I didn't see this yesterday. They're both folders that won't allow me to open or delete them, and again, one of them has the same name as one of the strange processes. "exibrgo", and "zadtgpv"

TimW · Nov 12, 2017

TDSSKiller took care of those, and to be sure, the fixlist for FRST will double check it.

Merkava · Nov 12, 2017

Okay. Just now getting around to running ESET Online scanner and it's taking inordinately long it seems. I should be able to get the FRST log up this evening. I hope.

TimW · Nov 12, 2017

OK. When we are done, we will have to talk about the lack of space on your hard drive.

Merkava · Nov 12, 2017

Here's FRSTfixlog. I'm in safe mode now and I only see exibrgo.exe in the task manager, so that's good.

TimW · Nov 12, 2017

Fixlog is garbage for some reason. Try to rerun RogueKiller and Hitman.

Merkava · Nov 13, 2017

RogueKiller got a few things that I deleted, but quite a few other detections that came up "failed", which I take to mean it couldn't get at them well-enough for a quarantine or deletion. I'll go back to normal mode for a rescan and log save.

HMP still crashes when trying to save the log, but it only came up with one item that I'm sure has been okay for a while before these problems even started. I went ahead and deleted all those punkbuster-related files, since I can reinstall them pretty simply.

TimW · Nov 13, 2017

If RougueKiller can not remove them, we can try different ways. Just upload the log when you are ready.

Merkava · Nov 13, 2017

It's not going to run in either mode, it seems :/

Merkava · Nov 13, 2017

Ugh. I'm sorry, it was Zemana that had those unremoveables. Finally got it to run. Want me to do it again?

TimW · Nov 13, 2017

Yes. You can make a log as directed in post #12. And also rerun TDSSKiller and attach that new log, please.

Merkava · Nov 13, 2017

Nope. Won't run now. Sheesh.

TimW · Nov 13, 2017

What about TDSSKiller?

Merkava · Nov 13, 2017

Kaspersky TDSS

TimW · Nov 13, 2017

Try to remove them all including the suspicious one. Afterward, reboot and rerun it and attach the new log.

Strange Processes Slowing Me Down

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

dr.moriarty Malware Super Sleuth Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Attached Files:

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Attached Files:

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Merkava Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches