dllhost.exe & com surrogate

[mmitech]

Yesterday I noticed a constant usage on my network monitor of about 2m DL and 250k UL, but figured it was a game updating as they tend to do.  Today I noticed my processes list included 1-2 dozen instances of dllhost.exe *32 consuming between 40 and 120 megs of RAM each.  

I ran MB and it detected 1 file (screen shot of log attached).

 

After quarantining the threat I was prompted to reboot, which I did.  Now my network usage is normal and I do not have the dllhost.exe instances any more.  However I now get "com surrogate has stopped working" notices every few minutes. (screen shot attached)

 

I ran CCleaner and AVG.  CCleaner removed old temp internet files and AVG didnt find anything to remove.

 

Any help would be greatly appreciated.

[H01ymoses]

Ok what I've found out is it seems to be generated from a powershell script.  I've yet to find the script but I parsed some inet logs and shows random searches to random ip's when they run.  I saw one for tendon+pain and others like that.  I manually renamed dllhost.exe then powershell.exe and even conhost.exe just to be safe.  it got rid of the dllhost.exe but, did not remove the infecting virus. 

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 

Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[mmitech]

I have run the FRST and attached the 2 txt files.  At some point during the night the dllhost.exe's started up again and there were 30 processes running this morning.

FRST.txt

Addition.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 
Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
• Include that log in your next reply.
  If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
  If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

fixlist.txt

[mmitech]

I tried running the FRST with fix option.  first time it ran for over an hour before i came back and saw it had frozen and AVG was reporting several blocked malicious attempts.  attempted to restart the fix and an hour or so later i had the same result.

Fixlog.txt

[TwinHeadedEagle]

Please disable AVG and try again.

[mmitech]

i tried disabling avg and FRST locked up after a few minutes.

 

combofix has finished and log is attached.

ComboFix.txt

[TwinHeadedEagle]

Okay, how is your PC now?

[mmitech]

OK, after running combofix, which switched me from the user account on my computer to the passworded admin account i almost never use, i noticed that after finishing i still had 2 dozen dllhost.exe processes still running with varying amounts of memory used.  after rebooting into the user account i let it idle for 3 hours and so far network traffic is normal and there are no dllhost.exe processes and no com surrogate errors.  im going to let it run overnight and i will post again tomorrow regardless of what happens.

[TwinHeadedEagle]

Nice

Keep me updated.

[mmitech]

Computer has been running for 27 hours now and no sign of the issue.

[TwinHeadedEagle]

Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself
 
 

Recommended reading:

 
 
MUST READ - security tips:

• Computer Security - a short guide to staying safer online.

• Simple and easy ways to keep your computer safe and secure on the Internet

MUST READ - general maintenance:

• What to do if your Computer is running slowly?

The Importance of Software Updating:

 

 
In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.
 
Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

• How to configure and use Automatic Updates in Windows
• How to update Java
• How to update Adobe Reader

Recommended additional software:

 
 
TFC - to clean unneeded temporary files.
Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.
Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.
McShield - to prevent infections spread by removable media.
CryptoPrevent - to secure yourself from very severe CryptoLocker infection.
Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.
FiheHippo.com Update Checker - to keep your programs up-to-date.
Adblock - to surf the web without annoying ads! 
 
 

Post-cleanup procedures:

 

 
Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run.
• The program will run for a few seconds and display a notepad report. You do not need to attach it.

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning. 
 
 
 

My help is free for everybody.

If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation:

Thank you!

 
 
Stay safe,
TwinHeadedEagle  

[mmitech]

About 10 minutes ago I was downloading the recommended programs, and internet connection started lagging.  Checked network meter and processes and the dllhost.exe is back running 2-3 dozen instances again.  I had not gotten to installing any of the programs, however MBAM was updated and running the premium trial.

[mmitech]

I ran MBAM and it found the same file as it did originally. The file was quarantined and the computer rebooted. After booting, I still get the dllhost.exe processes and the constant internet usage, but I am not getting the com surrogate messages this time. Although the processes still run, further MBAM scans didnt find any additional threats. For now I've just disabled my network adapter and I'll keep up with this thread on my phone.

[TwinHeadedEagle]

I would like to see fresh FRST reports.
 
 
Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[mmitech]

I renamed the original frst.txt and addition.txt before running FRST.  a new frst.txt was created but not a new addition.txt.  i will include the old one.

FRST.txt

Addition-old.txt

[TwinHeadedEagle]

PC is clean, there is no active malware infection.

[mmitech]

I still have the dllhost.exe processes running eating up 4-5Gb of RAM and constant network traffic.

[TwinHeadedEagle]

Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.
If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.
 
 
 
 

Scan with TDSSKiller
 
Please download TDSSKiller by Kaspersky and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
• Your machine may appear very slow and unusable after that - it's normal.
• TDSSKiller will run automaticaly. Click on Change parameters and click OK.
• Click the Start Scan button and wait patiently.

If anything will be found follow this guidelines:

• If a suspicious object is detected, the default action will be Skip, click on Continue.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  If Cure is not available, please choose Skip instead.
• Do not choose Delete unless instructed!

A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.

[mmitech]

I ran combofix again along with tdsskiller.  combofix log is attached, tdsskiller did not find anything.  for the moment everything seems normal, but time will tell.  would still love to find out what causes it to come back and why it gets past the programs im using to prevent it.

combofix2.txt

[mmitech]

Scratch that, right after i clicked post it started back again.

[mmitech]

MBAM ran an update and I started a new scan that found a new piece of malware - screen shot attached. Im having trouble getting the realtime protection to work.  when i look at the settings, i see MBAM set to start when windows does, but is missing from processes list until i manually load the program, then i stays in the list along with the tray icon.  also, i cannot get the realtime protection to stay activated.  if i use the menu in the main program it defaults to disabled every time i reboot the machine.  if i enable it from the tray icon it seems to do the same thing, yet the tray icon menu and the main program menu dont always agree on whether the realtime protection is enabled or not.

[TwinHeadedEagle]

Your system seems outdated, please follow my instructions to enable Windows Update. When you install all patches, then we can see what is going on. 

[mmitech]

I have updated everything that windows said was out of date.  Every time i run MBAM it comes up with the same threat from the most recent screen shot.