Svchost.exe / Com Surrogate Virus

[Gunnerhowell]

Request Help. Suspect I may have the Svchost.exe / Com Surrogate Virus. Com Surrogate has normal disk usage until I start Internet Explorer. Once Internet Explorer is started then Com Surrogate takes Disk usage to 100%. Can not terminate the process while IE is running. If IE is shutdown I can kill Com Surrogate and the Disk Usage returns to normal. Thought I could fix it myself by restoring the computer to factory settings using restore drive. Computer worked fine for about 2 weeks then problem returned. I started following the threads here at malwaretips.com. Ran Malwarebytes Anti-malware. It found no viruses and only one threat. PUP.Optional.OpenCandy. The Com Surrogate still took the system to 100% disk usage after I opened IE.

 

[TwinHeadedEagle]

Hello,



They call me TwinHeadedEagle around here, and I'll be working with you.



Before we start please read and note the following:

• At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
• Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
  
• All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
• If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
• I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
  
• Please attach all report using
  
  button below. Doing this, you make it easier for me to analyze and fix your problem.
  
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay for the repair.

Rules and policies

We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.



Is this enterprise/business computer?

 

[Gunnerhowell]

Sorry. I didn't see the question until just now. This is not an enterprise/business computer. It is my wife's HP la ENVY.

 

[Gunnerhowell]

I am in the Navy and they give us Enterprise programs like anti virus software to use on our home systems to prevent us from bringing a virus to work.

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[Gunnerhowell]

Here they are. IE was not running and the COM Surrogate (dllhost.exe) was not wreaking havoc but the system disk was still fluctuating between about 80% to 99%. McAffe On-Access Scanner service was biggest user with system (ntoskml) file name (ntkmrnlmp.exe) fluctuating to keep disk use high.

After I ran Farbar Recovery Scan Tool and it generated the attached files, I started IE to see what would happen and system(ntoskml) dropped to around 2 to 5% and McAffe On-Access Scanner service dropped to 0%. COM Surrogate spiked to whatever it needed to keep disk use at 100%. This lasted for about 5 min then system (ntoskml) and McAffe On-Access Scanner service spiked back up again to replace COM Surrogate and COM Surrogate dropped down. Not sure if this was a normal system response.

I then stopped IE and killed COM Surrogate task and it dropped down but then McAfee On-Access Scanner service and Windows System Protection kept system at 100% disk usage with system (ntoskml) floating around them.

Restarted IE and COM Surrogate took over as the offender and kept system at 100% again but system and McAffe were there again battling for the top spot.

Again not sure if the is a normal system response to something wrong and I'm just being distracted but the end result is a that a service or a combination of services are keeping system disk usage at 100%.

 

[TwinHeadedEagle]

Check Disk

• Press the
  
  + R on your keyboard at the same time. Type cmd and click OK.
• Copy/Enter the command below and press Enter:

• chkdsk C: /r

• You should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.
• All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.

Check Disk report:

• Press the
  
  + R on your keyboard at the same time. Type eventvwr and click OK.
• In the left panel, expand Windows Logs and then click on Application.
• Now, on the right side, click on Filter Current Log.
• Under Event Sources, check only Wininit and click OK.
• Now you'll be presented with one or multiple Wininit logs.
• Click on an entry corresponding to the date and time of the disk check.
• On the top main menu, click Action > Copy > Copy Details as Text.
• Paste the contents into your next reply.

 

[Gunnerhowell]

Wow that took all awhile. Notepad file is attached with Log.
- Opened IE and verified. Disk usage goes to 100%. "Host Process for Windows Task" (taskhostex.exe) was at 99.6%. Killed that and COM Surrogate (dllhost.exe) took over and kept disk usage at 99%. Could not kill COM Surrogate (dllhost.exe) until IE was shutdown.

Just an FYI for anyone following this thread:
1. Must run the check disk (chkdsk) and event viewer (eventvwr) as Administrator. One option is to use the

+ x and select from list. This was for Windows 8.1 and I'm not sure if it will for other versions of Windows.

2. The Check Disk (chksdk c: /r) in my case was run on the boot drive (c so the system had to be rebooted as it cannot run while disk is in use. Just select (Y) when prompted at the command prompt while running (chksdk c: /r).

3. BE PATIENT. The (chksdk) with added (/r) parameter cause the system to not only locate bad sectors but also to fix errors on the disk and recover readable information. It is broken up into 5 stages. This most likely will take hours. Just walk away. Mine was displaying 13% complete for about 4 hours and took about another 2 or 3 to finish. Could take even longer depending on amount of files.

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[Gunnerhowell]

Here are the new FRST.txt and Addition.txt

 

[TwinHeadedEagle]

PC seems clean, I don't see active infection.

 

[Gunnerhowell]

Any advice on why COM Surrogate (dllhost.exe) causes disk use of 100% when IE is running if it's not a virus?

 

[TwinHeadedEagle]

Not sure why is this happening. But you can try to reset IE:

Change or reset Internet Explorer settings - Windows Help