Solved Malware *32.exe flooding RAM

Veliary

New Member
Thread author
Apr 12, 2019
7
Everytime I start Windows almost every programs I opened keep duplicating and filling Task Manager with program*32.exe.
 

Attachments

  • mbar-log-2019-04-12 (12-47-58).txt
    3 KB · Views: 6
  • system-log.txt
    21.9 KB · Views: 1
  • Addition.txt
    34.8 KB · Views: 3
  • FRST.txt
    25.4 KB · Views: 4

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Hello,


FRST.gif
Fix with Farbar Recovery Scan Tool

icon_exclaim.gif
This fix was created for this user for use on that particular machine.
icon_exclaim.gif

icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 

Attachments

  • fixlist.txt
    6.3 KB · Views: 6
  • Like
Reactions: oldschool

Veliary

New Member
Thread author
Apr 12, 2019
7
I ran FRST and followed the instruction given. But in my Task Manager I still see lot of iexplore*32.exe and many other programs. Below I attach my Fixlog.txt. Is there anything else I have to do or did I do something not correct?
 

Attachments

  • Fixlog.txt
    14 KB · Views: 3

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition.txt option is checked.

    2873ryc.png

  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please attach report into your next reply.
 
  • Like
Reactions: oldschool

Veliary

New Member
Thread author
Apr 12, 2019
7
Sorry for the delay. Here is the log files from FRST latest scan.
 

Attachments

  • Addition.txt
    32.6 KB · Views: 3
  • FRST.txt
    73.6 KB · Views: 2

Veliary

New Member
Thread author
Apr 12, 2019
7
My computer is still getting slower the more it on. And this .exe*32 still persist in the processes running. Below I attach a screenshot of my Task Manager after 2 hours of runtime. FRST latest scan result the FRST.txt and Addition.txt are attached in my previous reply. Haven't done anything since then.
 

Attachments

  • Task Manager.JPG
    Task Manager.JPG
    101.3 KB · Views: 11

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
32 next to the process name is normal. That represents 32-bit application running on a 64-bit system.

Don't know what to say, I don't see signs of infection in your logs.
 
  • Like
Reactions: oldschool

Veliary

New Member
Thread author
Apr 12, 2019
7
When I let my computer runs for almost 4 hours, the memory is fully loaded until I got a message telling me that the memory is full and I need to close some programs.

I don't know how to remove this worm from my computer, but I definitely know that this is a malware. Below I attach my Task Manager Processes when I just start my computer and after 2 hours runtime. Please help me fix this.
 

Attachments

  • Task Manager - 7 mins.JPG
    Task Manager - 7 mins.JPG
    113.4 KB · Views: 7
  • Task Manager - 131 mins.JPG
    Task Manager - 131 mins.JPG
    114.9 KB · Views: 4

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Please uninstall Web Companion

FRST.gif
Fix with Farbar Recovery Scan Tool

icon_exclaim.gif
This fix was created for this user for use on that particular machine.
icon_exclaim.gif

icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 

Attachments

  • fixlist.txt
    865 bytes · Views: 1
  • Like
Reactions: oldschool

Veliary

New Member
Thread author
Apr 12, 2019
7
Here's the result from latest fix. Do I have to reboot the PC or I just let it be for a while to check if it's normal again?
 

Attachments

  • Fixlog.txt
    5.2 KB · Views: 2
  • FRST.txt
    72.9 KB · Views: 0
  • Addition.txt
    30.8 KB · Views: 0

Veliary

New Member
Thread author
Apr 12, 2019
7
Sorry for the delay.

I found out that the problem is in Internet Explorer. It is some kind of glitch of IE 11 in Windows 7 that it keeps running in background and consuming memory. After looked in some forum the solution is to turn off Internet Explorer from Programs and Features in Control Panel. So now my PC is normal again.

Thanks for the help. Much appreciated.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top