Jump to content

Maleware Removed - How to be sure?


Recommended Posts

Hi Everyone!

Running a really, really outdated Windows Server 2003 sp2 with a webshop on it, used for internal use in a company only, but is accessible from outside.
everything ran fine until yesterday afternoon, when suddenly it became totally unresponsive, cause: svchost.exe was at 99% CPU usage all the time. 

so after wrestling this beast for the better part of a night, i think im finally rid of it. 

Heres what i did: 

1. download rkill

2. download mbam

put it on USB drive and go to infected computer, there:

1. run rkill -> 5 processes stopped

2. install mbam, scan system -> 23 threads found

3. reboot

4. run rkill -> 5 processes stopped 

5. run mbam scan -> clean

6. run Malewarebytes Anti-Rootkit -> 1 Thread found

7. reboot

8. run rkill -> 5 processes stopped (at this point i google the names of the processes: cpqrcmc.exe, cpqnimgt.exe, cpqserv.exe, cpqhost.exe, cpqrstor.exe, all part of compaq software so i figured its safe to ignore) 

9. run mbam scan -> clean

10. run Malewarebytes Anti-Rootkit -> clean



at this point im thinking im clean, so i just want to run adwcleaner for the hell of it, and it gives me "not a valid win32 application", which makes me really suspicious.... 


how can i be sure im actually clean now? 


thanks a lot




Edited by ETH_BS
attachements forgotten
Link to post
Share on other sites

Alright, so im think im not as clean as i thought i was. 

Checking Taskmanager now, i had a Process called "notepad.exe" using up 99% of the cpu. The computer feels responsive and the i was able to kill the process, but i just have a bad feeling about all of this.

so any input is highly appreciated :)

thanks a lot


Link to post
Share on other sites

  • Root Admin

Okay, are you sure you ran this with Admin rights? Looks like FRST was blocked from accessing most items.

Please see if you can download and run the MBAR tool from this post. You typically won't be able to run it the way listed as Server 2003 does not support that method but hopefully you can run the software directly from the computer in Normal Mode.




Link to post
Share on other sites

  • Root Admin

Great, let's run some scans to make sure all is okay.

Please run the following steps and post back the logs as an attachment when ready.


  • If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • If you don't have Malwarebytes 3 installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know on your next reply.


Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Right-click on the program and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan.
  • When finished, please click Clean.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Copy its content into your next reply.


RESTART THE COMPUTER before running Step 3

Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.






Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.