Maleware Removed - How to be sure?

[ETH_BS]

Hi Everyone!

Running a really, really outdated Windows Server 2003 sp2 with a webshop on it, used for internal use in a company only, but is accessible from outside.
everything ran fine until yesterday afternoon, when suddenly it became totally unresponsive, cause: svchost.exe was at 99% CPU usage all the time. 

so after wrestling this beast for the better part of a night, i think im finally rid of it. 

Heres what i did: 

1. download rkill

2. download mbam

put it on USB drive and go to infected computer, there:

1. run rkill -> 5 processes stopped

2. install mbam, scan system -> 23 threads found

3. reboot

4. run rkill -> 5 processes stopped 

5. run mbam scan -> clean

6. run Malewarebytes Anti-Rootkit -> 1 Thread found

7. reboot

8. run rkill -> 5 processes stopped (at this point i google the names of the processes: cpqrcmc.exe, cpqnimgt.exe, cpqserv.exe, cpqhost.exe, cpqrstor.exe, all part of compaq software so i figured its safe to ignore) 

9. run mbam scan -> clean

10. run Malewarebytes Anti-Rootkit -> clean

------------------------------

 

at this point im thinking im clean, so i just want to run adwcleaner for the hell of it, and it gives me "not a valid win32 application", which makes me really suspicious.... 

 

how can i be sure im actually clean now? 

 

thanks a lot

Eth 

Addition.txt

FRST.txt

Edited November 15, 2017 by ETH_BS
attachements forgotten

[ETH_BS]

Alright, so im think im not as clean as i thought i was. 

Checking Taskmanager now, i had a Process called "notepad.exe" using up 99% of the cpu. The computer feels responsive and the i was able to kill the process, but i just have a bad feeling about all of this.

so any input is highly appreciated

thanks a lot

Eth

[AdvancedSetup]

Hello @ETH_BS

Please run FRST again and make sure to place a check mark in the Additions.txt check box and post back both new logs

Thanks

Ron

 

[ETH_BS]

Hi AdvancedSetup

see the files attached, i apologize in advance for the state of this computer.

it really shouldnt be running at all anymore, but you know, small companies. 

thanks in advance

Eth

Addition.txt

FRST.txt

[AdvancedSetup]

Okay, are you sure you ran this with Admin rights? Looks like FRST was blocked from accessing most items.

Please see if you can download and run the MBAR tool from this post. You typically won't be able to run it the way listed as Server 2003 does not support that method but hopefully you can run the software directly from the computer in Normal Mode.

Thanks

Ron

 

[ETH_BS]

I was able to run the Software normally, it detected 1 Threat, cleaned it up.

I have now rebooted the computer as requested

rand the scan again and it came out clean 

[AdvancedSetup]

Great, let's run some scans to make sure all is okay.

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron