svchost.exe streaming audio feeds and taking all available CPU

[boweasel]

I saw this topic on the forum - svchost.exe (netsvcs) maxing CPU out by streaming in audio feeds and although this seems to be an exact mimic of my problem I didn't think it was proper decorum to piggy-back onto his question http://www.sevenforums.com/performa...s-maxing-cpu-out-streaming-audio-feeds-2.html

When we turn on this 64 bit W7 desktop it almost immediately starts playing what sounds like overlapping radio stations. Looking at taskmgr show that svchost's memory consumption climbs to where it's using over 500,000 KB of memory and the performance grinds to a halt. Ending the task stops the audio.

I ran a quick scan of Malwarebytes in safe mode, it detected a backdoor trojan, which I removed, and rebooted. The radio was still audible, and svchost was still maxed out.

I killed the process and downloaded Rkill and TDSSkiller. I ran Rkill in safe mode, it detected a zero access virus. I stayed in safe mode and ran TDSSkiller. It detected the zero access virus, and I clicked on Quarantine. It apparently quarantined nothing, because a normal reboot brought up the same symptoms.

I didn't want to go through the complete scenario of solutions offered to the original poster, so I never attempted the elevated net stop WMPNetworkSvc.

Should I be doing that, or something else?

 

[VistaKing]

boweasel

Try this tool below

Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[boweasel]

For some reason I can no longer end the offending svchost process, so I'm now running in safe mode with networking. Here are the text files...

Additionally, this particular phenomenon occurred at my friend's house as soon as he turned on the PC. Now that I brought it to my house, it only seems to happen when I attempt to connect to the internet. In other words, when I first set up his PC at my house I did not connect an Ethernet cable to his tower, and his Dell desktop was powered on for hours without a peep. As soon as I connected the cable and restarted the PC, the radio noises began. Curiously, there are no noises while running in safe mode with networking.

 

[VistaKing]

Open Notepad . Inside Notepad paste the highlighted text inside notepad

start
Winlogon\Notify\AutorunsDisabled:
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKLM-x32\...\Run: [] - [x]
ZeroAccess:
C:\Users\Vickie\AppData\Local\Google\Desktop\Install\{3ee2cae2-7844-dff1-ce2e-d0c62a7e658e}
C:\Users\Vickie\GoToAssistDownloadHelper.exe
end


Click on File ====> Save As

File Name : Fixlist.txt

Save as type : All Files

Location : Desktop

Click on the [Save] button .

Open FRST tool again from the Desktop and click on the [Fix] button . Once complete it will create a new log called Fixlog.txt . Upload the new log created in your reply . It should be on the desktop .

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Clean and confirm the prompt.


Upload the log : The log file is at C:\AdwCleaner[n].txt

Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

 

[boweasel]

Here's the Fixlog..

 

[VistaKing]

Run the two programs AdwCleaner and Junkware Removal ToolKit .

 

[VistaKing]

Log into the PC in normal mode and again run TDSSKILLER again

Do every step

TDSSKILLER

download link :ar: TDSSKiller

Save to the Desktop

Right-click the program and select

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System

Click: OK


Press: Start Scan


If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)


When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\


Logs have a name like:
C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt


Please post the TDSSKiller log in your reply.

 

[boweasel]

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Clean and confirm the prompt.

The Clean option is grayed out. I can Scan, however. And maybe Clean after the scan?

 

[VistaKing]

Click Scan then upload the log

 

[VistaKing]

Log is in C:\AdwCleaner

Log title : AdwCleaner[R0]

 

[boweasel]

Sorry it takes so long - even in SMWN this puppy is slowwwwww, not to mention all the 'page cannot be displayed's...

 

[VistaKing]

Restart the PC and login to normal mode and do Post #7 . You don't have to download Tddskiller again just do the next steps .

 

[boweasel]

Rootkit.Boot.Harbinger.a....
That's the one that showed up in TDSSKiller, but it would never let me cure it - only quarantine was available, and quarantine didn't do jack...

But this time it let me cure it. Why?

And what's the deal with all the different names - Zero Access showed up on RKill, Some sort of backdoor Trojan in Malwarebytes and now this one in TDSSKiller. Are they all the same virus? Did he have 3 different infections?

This is typed from my friend's PC - fast response, no gigantic svchost file, and NO RADIO.

 

[VistaKing]

The tdsskiller looks good it cured the issue it found . Can you rescan the PC in normal mode using FRST and upload the new FRST.txt

 

[boweasel]

The tdsskiller looks good it cured the issue it found . Can you rescan the PC in normal mode using FRST and upload the new FRST.txt

Will do it tomorrow - it's 1:15 AM here and I am bushed.

If you get a chance could you answer the questions from my last post?

Thanks again.

 

[VistaKing]

I don't know why it wouldn't cure before but did this time . You might of not checked the item inside Change Parameters .

ZeroAccess is a rootkit .

 

[boweasel]

PC still seems sluggish, actually

 

[VistaKing]

Can you rerun JRT and AdwCleaner in normal mode

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click the Scan button

:ar: Upload the AdwCleaner[Rn].txt in your reply.

   Note

The log file is at C:\AdwCleaner

Right click JRT.exe and choose

Once done upload the JRT.txt file

 

[VistaKing]

Remove Search-Results toolbar (Uninstall Guide)

Take a look at the link above . Do all of the steps in the Browsers

Step 4 :

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.

Log looks like this : mbam-log-yyyy-mm-dd

Log located : C:\Users\{Your UserName}\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs or C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs


Step 5 : Download

HitManPro

64-Bit Version OS :ar: HitmanPro_x64

32-Bit Version OS :ar: HitmanPro

:ar: Save to the Desktop

:ar: Right click on HitmanPro.exe and choose

:ar: When HitmanPro opens up click on Settings uncheck Scan for tracking cookies . Click on OK . Then click on the Next button

:ar: Click on No, I only want to perform a one-time scan to check this computer on the Setup page . Click Next once done .

:ar: Let it scan the PC once its done Click Next

:ar: Click Activate free license to start the free 30 days trial and remove all the malicious files from your computer then click Next

Upload the log . Locate in C:\ ProgramData\Hitman Pro\Logs

 

[boweasel]

Like I said, I'm getting a lot of "This page cannot be displayed" msgs in IE10, which seem to go away after 1 or 2 times pressing the refresh button