Member Avatar for SSSD

i recently found out i had the virus called RECYCLER, and that it had infected my usb and hard drive. So the first thing i did was end the process called ctfmon.exe, as i read it was part of the virus. I also ran a program called combofix with a script that was supposed to kill the virus completely from my usb and my harddrive. However i went to check my processes again and found a few peculiar processes - csrss.exe, smss.exe, lsass.exe, slserv.exe, catchme.tmp, x2 dllhost.exe, plugin-container.exe, msdtc.exe, jqs.exe, sched.exe, and finally the ctfmon.exe had returned. How do i resolve this issue?

Not sure if all of them are virus related, but its better to be safe.

Thanks in advance

Edited by SSSD because: more processes added
  • 3 Contributors
  • 4 Replies
  • 380 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

Brief expert summary and safe next steps (expanded from , and ).

A folder named RECYCLER on a drive is the per‑drive Recycle Bin used by older Windows (Vista+ uses $Recycle.Bin); the folder alone is not proof of malware. That said, many USB worms historically copy an Autorun.inf plus hidden EXEs to removable media and can use Recycler/Recycle‑like names to hide; presence of both a suspicious autorun.inf and unknown EXEs on a USB is the stronger indicator of an infection. (learn.microsoft.com)

Processes such as ctfmon.exe are normally part of Windows (text/input services) but the filename can be spoofed. The reliable way to tell is to inspect the process image path and digital signature (legitimate ctfmon.exe resides in C:\Windows\System32). Use Process Explorer to view the full command line, path, and signature, and Autoruns to find persistent autostart entries. Any instance running from AppData, a removable drive, or another non‑System32 folder should be treated as suspicious. (howtogeek.com)

Practical containment and cleanup workflow (run from an administrator account; make backups first):

  1. Immediately disconnect suspect USB drives (do not browse them).
  2. On a clean machine, download/run updated on‑demand scanners (Malwarebytes / AV) and Sysinternals Autoruns/Process Explorer.
  3. To reveal + remove hidden autorun and system attributes then delete items (replace X: with the drive letter):
attrib -s -h -r /s /d X:\*.*
attrib -s -h X:\autorun.inf
del /f /q X:\autorun.inf
rd /s /q X:\RECYCLER
rd /s /q X:\$Recycle.Bin

Run those commands only from an elevated prompt and only for the targeted removable drive; incorrect use can remove important data. Microsoft guidance on removing autorun/USB worm artifacts is relevant. (support.microsoft.com)

Notes on ComboFix / Catchme.tmp and logs: ComboFix commonly creates files like Catchme.tmp and folders such as C:\ComboFix or Qoobox when run; their appearance by itself can simply be an artifact of that tool. If ComboFix was used, include the generated ComboFix.txt and related logs when asking for help — experts will examine those before recommending further actions. If ComboFix was run without supervision, prefer asking an experienced removal team rather than re‑running it. (bleepingcomputer.com)

Short checklist: isolate media, disable Autorun/Autoplay, collect Process Explorer + Autoruns snapshots, run updated AV/Malwarebytes from a clean machine, remove autorun.inf and unknown executables after unsetting system/hidden attributes, and post logs if further manual analysis is needed.

Recommended Answers

All 4 Replies

Member Avatar for gerbil

slserv.exe is for your smartlink modem? You can see that catchme.tmp is in combofix. ctfmon.exe runs because you have MS Office? The remainder are [normally] standard processes to be seen on any machine. Any chance of seeing your combofix logs?
To remove combofix, go Start, in the run box, type combofix /u and press enter.

Edited by gerbil because: n/a
Member Avatar for SSSD

Sorry, not sure if i still have them, i might have deleted them. Anyway i still have the hidden folder called RECYCLER in my harddrive C:\, isnt that supposed to be a virus? And i also read that ctfmon.exe was part of the virus aswelll. I tried to delete the RECYCLER folder, as it also spread to my usb, i think its gone frm my USB, but i cant seem to delete it from my harddrive. I even tried to use a program called unlocker to delete it but still no luck. I also read that the virus copies itself onto a file called autorun.inf if thats any help

Member Avatar for Biker920

If you are worried that you have a virus go here http://www.daniweb.com/forums/thread134865.html follow instructions then post requested logs in that fourm. Some one will be along and look at the logs please be patient as we are short on volunteers due to vacations and out door activities. Later---

Member Avatar for gerbil

RECYCLER is your recycle bin. Delete someting.... it will pop there. Empty the bin.. it will go from RECYCLER [or one of its subfolders].
To check if a file is valid open its properties... see if it is signed.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.