Multiple cmd.exe and comhost files on Windows Server 2008R2

[Rygas]

I have a server that is producing multiple cmd.exe and comhost files and wanted to find out if it posed a problem.  We recently had a person within our network let a ransomware virus in, and it hit that PC and the server in question had shared folders connected with that PC.  The shared folders already has encrypted files, but the rest of the server seems unaffected.  But I wanted to make sure so I have come here for help.  I am already concerned, what steps do I need to take to see if there is in fact a problem?

[Aura]

Hi Rygas

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

• As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens;
• As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you;
• The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system;
• If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!;
• If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
• Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced;
• I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules;
• In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process;
• I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone;
  This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread;
  

This being said, it's time to clean-up some malware, so let's get started, shall we?

Follow the instructions in the thread below, and provide me both FRST logs (FRST.txt and Addition.txt). You can attach them in your next post, or copy/paste their content.

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

[Rygas]

Here is the file, also, another update, The Diagnostic Policy Service will not start.

FRST.txt

Addition.txt

[Aura]

I'll review the logs tomorrow since I'm going to bed now, but in the mean time, open the Task Manager, then under the Details, right-click on any column and select Select columns. From there, check Command line and click on Ok. Do you recognise the command line(s) used to launch the multiple cmd.exe processes? You can copy/paste them here if you want.

[Rygas]

I do not recognize it, it is \??\C:\Windows\system32\conhost.exe "A LOT OF RANDOM NUMBERS

That is on every Conhost.exe

I will see if I can send a pic of it for you.

[Rygas]

Here is the pic.

[Aura]

Sorry it seems that I missed your reply.

Do you know which Ransomware you were infected with by the way?

I'll take a look at the logs today once I come back from the gym.

[Rygas]

I am not sure this machine is infected. I think maybe just the shared files on here are, but the ID service says it's a variant of Revenge. 

[Aura]

I know little about Windows Server normal processes, services, etc. but the logs looks clean to me. Obviously there are major differences with logs from a desktop version of Windows, but most of them can be associated with the fact that Windows Server is running.

The various cmd.exe and conhost.exe processes could also be because Windows Server is running tasks, operations, etc. through them and desktop versions of Windows aren't.

Obviously, if you are not sure if the server was compromised or not, you should rebuild it from scratch just to make sure.

Edited July 8, 2017 by Aura

[Aura]

Hi Rygas,

Are you still with me?

[Rygas]

Yes I am, I have been transferring data from the infected machine and decided to start back up troubleshooting when I get to a safe place on the machine.  I am ready now.

[Rygas]

This is a SQL server and that may be some of the reason that it is doing what it is doing.  I really think the server is clear, but I have turned up a different server on a VM that has taken over the old server's duties.  Is there anything you would like me to check?

[Aura]

Nothing really. When a server is compromised, the best course of action in my opinion is to format and reinstall it. A server is critical in a network infrastructure, and you don't want to take any chances once one have been infected by a Ransomware, backdoor, keylogger, etc.

[Aura]

Hi Rygas,

Is there anything else I can do for you?

[Aura]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!