svchost.exe *32 winrscmde

Discussion in 'Malware Help (A Specialist Will Reply)' started by Clurichaun4, Nov 19, 2012.

  1. Clurichaun4

    Clurichaun4 Private E-2

    Ok, i just got back from vacation and my computer has a bad trojan. No one used it for the week i was gone, and the only thing i did before i left was run the windows update. When I got back my computer was taking an extremely long time to boot up, and could not run firefox at all. I noticed that the process svchost.exe *32 (winrscmde) was on the top of my list with well over one million k. I ran all the tools in your read/run first guide and have the logs to attach with this, with the exception of tdsskiller which just kept forcing my computer to reboot on the last item scanned.

    Thank you in advance for your help getting rid of this nasty bastard.
    Stephen
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:


    • [RUN][SUSP PATH] HKCU\[...]\Run : Conduit (rundll32.exe "C:\Users\Stephen\AppData\Local\CrashDumps\Conduit\muoeczak.dll",VisioLibMainW) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : {A00F6535-849C-7D85-7867-E5BF7475B5DD} (C:\Users\Stephen\AppData\Roaming\Sosae\ileva.exe) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-69395153-3421434066-982110981-1000[...]\Run : Conduit (rundll32.exe "C:\Users\Stephen\AppData\Local\CrashDumps\Conduit\muoeczak.dll",VisioLibMainW) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-69395153-3421434066-982110981-1000[...]\Run : {A00F6535-849C-7D85-7867-E5BF7475B5DD} (C:\Users\Stephen\AppData\Roaming\Sosae\ileva.exe) -> FOUND
      [TASK][SUSP PATH] Minecraft Server : "C:\Users\Stephen\Desktop\Minecraft Server\Minecraft_Server.exe" -> FOUND
      [STARTUP][SUSP PATH] vuucos.exe @Default : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vuucos.exe -> FOUND
      [STARTUP][SUSP PATH] vuucos.exe @Default User : C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vuucos.exe -> FOUND
      [STARTUP][SUSP PATH] sinyo.exe @Mcx1-STEPHEN-HP : C:\Users\Mcx1-STEPHEN-HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sinyo.exe -> FOUND
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Do not reboot your computer yet.

    Now re-run Hitman and have it fix all that it finds.

    Now after a reboot, see if you can run TDSSKiller. In any event, rescan with both RogueKiller and Hitman and attach those logs as well.
     
  3. Clurichaun4

    Clurichaun4 Private E-2

    Hey, sorry it took a while to respond. Thank you for your help! So i ran the roguekiller and wiped out what you said, although the last one you mentioned never even showed up. Then i ran Hitman, and let it do its thing. After a reboot I was finally able to run TDSSkiller to completion, but was getting an error about being unable to initialize log. However it found no threats anyways if that matters.

    Sorry for so many RK reports, i ran it a couple more times to make sure that the "[STARTUP][SUSP PATH] sinyo.exe @Mcx1-STEPHEN-HP : C:\Users\Mcx1-STEPHEN-HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sinyo.exe -> FOUND" wasnt found, but i included all of them to be sure. report 2 was my initial one, 3 and 4 were reruns to check for the file, and 5 was after hitman and reboot.

    Thanks for your time, and I hope you have a great Thanksgiving!

    *Edit*
    Just checked my task manager, and for the first time since I got back to town the svchost*32 wasnt there! Noticed my computer working a bit better as well! But I will still check back to make sure this is gone.
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks much better. Lets just get rid of the Junkware!

    http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.

    Now make sure to tell me how things are running.
     
  5. Clurichaun4

    Clurichaun4 Private E-2

    Hey thanks for all your help! Comp has been running great. Here is my JRT log just to be sure.

    Thanks again!
    Stephen
     

    Attached Files:

    • JRT.txt
      File size:
      7.4 KB
      Views:
      1
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link
    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds