svchost.exe random audio, high memory and CPU

4 posts in this topic

Hi, i'm seeing a svchost.exe process increment up in memory usage and CPU. CPU will hit 99% at times. there is an audio device that shows up in the audio mixer, and random clips are played out intermittently. This started yesterday. Malwarebytes picked off 2 trojans yesterday from safe mode, but the problem persists. I'm notified that Malwarebytes is blocking traffic to on port 49620. I'd appreciate any help or direction that could be offered to get rid of this thing.

here's the log from Rogue Killer:

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback :

Website :

Blog :

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User : rmccormick [Admin rights]

Mode : Scan -- Date : 04/25/2013 09:21:45

| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤

[sUSP PATH] rpcld.exe -- C:\ProgramData\Rpcnet\Bin\rpcld.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 5 ¤¤¤

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$3c45e405818ee654faaf70ded16263ec\@ [-] --> FOUND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1830819319-1975652134-394877016-23726\$3c45e405818ee654faaf70ded16263ec\@ [-] --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$3c45e405818ee654faaf70ded16263ec\U --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1830819319-1975652134-394877016-23726\$3c45e405818ee654faaf70ded16263ec\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$3c45e405818ee654faaf70ded16263ec\L --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1830819319-1975652134-394877016-23726\$3c45e405818ee654faaf70ded16263ec\L --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

Share this post

Link to post
Share on other sites

Hello and Welcome to Malwarebytes

The computer shows signs of being infected with the Zero Access rootkit.

One or more of the identified infections is related to a nasty
which is difficult to remove. Rootkits and
very dangerous
because they use advanced techniques (backdoors) as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use
backdoor Trojans
and rootkits as part of an exploit to gain unauthorized access to a computer and take control of it without your knowledge.

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned.
All passwords should be changed immediately
to include those used for banking, email, eBay, paypal and online forums
. You should consider them to be compromised. You should change each password by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again. Banking and credit card institutions should be notified of the possible security breach. Because your computer was compromised please read

Although the rootkit has been identified and may be removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again.
It is dangerous and incorrect to assume that because this malware has been removed the computer is now secure.
In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. The malware may leave so many remnants behind that security tools cannot find them. Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, delete the partition, reformat and reinstall the OS.

Please read:

Should you decide not to follow this advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful. If you wish to proceed, disinfection will require more time and more advanced tools.

If you would like to proceed to try and clean the computer please follow the advice from the link below.

I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.

Message borrowed from quietman7 with minor wording and link changes

Share this post

Link to post
Share on other sites

ok, thanks very much for the advice and direction. I'm going to change my user names a p/words today as you recommended. have 2 questions:

The infected PC is offline now. If i backup my files before reformatting the drive, do i need to worry about the infection residing in itunes, .pdf or any Msoft Office file types? I'm concerned that i'd reinfect my laptop if i copy my files back after reloading Windows.

I'm on another machine now. Before i reset all my passwords, is this one clean? Thanks again.....

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback :

Website :

Blog :

Operating System : Windows Vista (6.0.6001 Service Pack 1) 32 bits version

Started in : Normal mode

User : Rob McCormick [Admin rights]

Mode : Scan -- Date : 04/25/2013 11:45:24

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[64] : NtCreateKey @ 0x8262DFA5 -> HOOKED (Unknown @ 0xA03AAFC0)

SSDT[72] : NtCreateProcess @ 0x826DA72B -> HOOKED (Unknown @ 0xA03AA200)

SSDT[73] : NtCreateProcessEx @ 0x826DA776 -> HOOKED (Unknown @ 0xA03AA4C0)

SSDT[75] : NtCreateSection @ 0x8268F689 -> HOOKED (Unknown @ 0xA03ABC80)

SSDT[78] : NtCreateThread @ 0x826DA560 -> HOOKED (Unknown @ 0xA03AC160)

SSDT[123] : NtDeleteKey @ 0x825FB83C -> HOOKED (Unknown @ 0xA03AB540)

SSDT[126] : NtDeleteValueKey @ 0x825F621F -> HOOKED (Unknown @ 0xA03AB800)

SSDT[165] : NtLoadDriver @ 0x825B5AD0 -> HOOKED (Unknown @ 0xA03AC4A0)

SSDT[194] : NtOpenProcess @ 0x82657EF2 -> HOOKED (Unknown @ 0xA03AAA40)

SSDT[197] : NtOpenSection @ 0x8266EBA2 -> HOOKED (Unknown @ 0xA03ABE20)

SSDT[324] : NtSetValueKey @ 0x8262EDD1 -> HOOKED (Unknown @ 0xA03AB280)

SSDT[334] : NtTerminateProcess @ 0x826292F0 -> HOOKED (Unknown @ 0xA03AAD00)

SSDT[358] : NtWriteVirtualMemory @ 0x82654033 -> HOOKED (Unknown @ 0xA03ABFC0)

SSDT[382] : NtCreateThreadEx @ 0x82647F82 -> HOOKED (Unknown @ 0xA03AC300)

SSDT[383] : NtCreateUserProcess @ 0x8260EE26 -> HOOKED (Unknown @ 0xA03AA780)

S_SSDT[572] : NtUserSetWindowsHookAW -> HOOKED (Unknown @ 0xA03ACB00)

S_SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0xA03AC920)

_INLINE_ : NtCreateKey -> HOOKED (Unknown @ 0xA03AAFC5)

_INLINE_ : NtCreateProcess -> HOOKED (Unknown @ 0xA03AA205)

_INLINE_ : NtCreateProcessEx -> HOOKED (Unknown @ 0xA03AA4C5)

_INLINE_ : NtCreateSection -> HOOKED (Unknown @ 0xA03ABC85)

_INLINE_ : NtCreateThread -> HOOKED (Unknown @ 0xA03AC165)

_INLINE_ : NtDeleteKey -> HOOKED (Unknown @ 0xA03AB545)

_INLINE_ : NtDeleteValueKey -> HOOKED (Unknown @ 0xA03AB805)

_INLINE_ : NtLoadDriver -> HOOKED (Unknown @ 0xA03AC4A5)

_INLINE_ : NtOpenProcess -> HOOKED (Unknown @ 0xA03AAA45)

_INLINE_ : NtOpenSection -> HOOKED (Unknown @ 0xA03ABE25)

_INLINE_ : NtSetValueKey -> HOOKED (Unknown @ 0xA03AB285)

_INLINE_ : NtTerminateProcess -> HOOKED (Unknown @ 0xA03AAD05)

_INLINE_ : NtWriteVirtualMemory -> HOOKED (Unknown @ 0xA03ABFC5)

_INLINE_ : NtCreateThreadEx -> HOOKED (Unknown @ 0xA03AC305)

_INLINE_ : NtCreateUserProcess -> HOOKED (Unknown @ 0xA03AA785)

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts localhost

::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: HITACHI HTS541616J9SA00 +++++

--- User ---

[MBR] 2de4c9e623116fefb281e08d7256f4d0

[bSP] 22542c83ee86097459dc05da1780809c : Windows Vista MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 152625 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: IMD-0 +++++

--- User ---

[MBR] 7ac7cfe9c18d4f619b97a8c759ffd7dc

[bSP] 3e29b9212929285cc4c2dd61ea901aa8 : Empty MBR Code

Partition table:

0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 63 | Size: 512 Mo

Error reading LL1 MBR!

Error reading LL2 MBR!

Finished : << RKreport[1]_S_04252013_02d1145.txt >>


Share this post

Link to post
Share on other sites

To answer your question, when you backup your files, and then format your pc and re-install everything, before you copy your data back, you would make sure you have an antivirus program installed and updated, and as the files are being copied, it would detect any file that may be infected and give you the option to either clean, remove, delete the infected file.

If your going to change your passwords, make sure you do it with a clean computer.

That being said, we do not work on log files in this section of the forum. If you want both these computers checked to make sure they are clean of viruses and malware you need to follow the instructions below....

Being that you are probably infected, feel free to follow the instructions below to receive free, one-on-one expert assistance in checking your system and clearing out any infections and correcting any damage done by the malware.

Please see the following pinned topic which has information on how to get help with this: Available Assistance for Possibly Infected Computers

Thank you

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.