gspaulsson Posted March 28, 2011 Report Share Posted March 28, 2011 Processes explorer.exe and XaRIOmbZq.exe are using 100% of CPU.This problem first showed up yesterday. 28 March 2011. I don't recognize XaRIOmbZq.exe - does anybody know what it is? I can't end the process, and between it and explorer.exe they are tying up my CPU. I suspect it may be a trojan, but I can't find it on Google or in the Windows malware database. Under Properties, Location is users\AppData\Roaming, but when I do a DIR in cli, it doesn't show up there and when I try to erase it I get "file not found". It also appears to have disabled AVG. Any clues? Quote Link to comment Share on other sites More sharing options...
bludgard Posted March 28, 2011 Report Share Posted March 28, 2011 Processes explorer.exe and XaRIOmbZq.exe are using 100% of CPU.This problem first showed up yesterday. 28 March 2011...I suspect it may be a trojan,...Any clues?Never headrd of it, gspaulsson.Maybe you can be rid of this behaviour by using System Restore. Or better yet the latest sytem image or clone that you have recently created (prior to yesterday) of your HDD. If you haven't a clue what is being referred to here or do not subscribe to basic backup maintenence of your computing machine, read through this thread submitted by Bugsy. Click on this link. See if that helps.If you need further assistance, feel free to post your concerns.Welcome to Windows Forum. Quote Link to comment Share on other sites More sharing options...
Boris Posted March 28, 2011 Report Share Posted March 28, 2011 Processes explorer.exe and XaRIOmbZq.exe are using 100% of CPU.I don't recognize XaRIOmbZq.exe - does anybody know what it is?Sure sounds like a trojan to me :(Download the free version of MalwareBytes Anti-Malware from here :-/>http://www.malwarebytes.org/mbam.phpInstall and update it.Do a full scan and let it kill what it finds.If necessary, boot into "Safe Mode with Networking" and run it from there. Quote Link to comment Share on other sites More sharing options...
gspaulsson Posted March 28, 2011 Author Report Share Posted March 28, 2011 Hi all. I have done all the obvious things - run scans, restarted from last system checkpoint. Talked to MS support today and they had me run a 3-hour scan out of cli. All it found was some PDF, which it deleted, but XaRIOmbZq ("Zombie") is still there. I have monitored it some more: it seems to lie dormant, and then comes to life when you start a browser (any browser). I suspect it was carried by a Firefox "greasemonkey" script, because I downloaded one just before it showed up. I trust the script designers, but someone may have hacked their site. Uninstalling the script and disabling greasemonkey had no effect - once it was planted, there it was. It is pretty smart: you can't end it, you can't unhide it, it isn't in the folder that task manager properties says it came from (yes, I set folder options to show hidden files and folders). I've reported it to MS security, although the "sample" their bot sends is the nonexistent file, so it's not going to tell them much. I've searched for the filename but it doesn't turn up anywhere. MS Security Essentials notified me today of a worm called boinberg.B, which was first spotted on March 19th, and which also found its way onto my system, probably the same way. It looks to me like Zombie uses Windows Explorer to do file searches and intercepts the output. One thing it seems to have done is uninstall avg, and then it blocks installation of antivirus software (I've tried AVG and Avast). Seems like a state of the art virtual microorganism that nobody has identified yet. Quote Link to comment Share on other sites More sharing options...
gspaulsson Posted March 29, 2011 Author Report Share Posted March 29, 2011 OK, the problem seems to be sorted out, at least for now. I dropped "Zombie" to low priority and boosted Chrome to high priority, and did finally manage to install Avast. It didn't detect or remove the trojan, but it did remove whatever it was that prevented me from ending the process. Until I finally get rid of it, it may start up again every time I reboot, but at least I can stop it now. Thanks for your help, and I'll wait for a more permanent fix. Quote Link to comment Share on other sites More sharing options...
bludgard Posted March 29, 2011 Report Share Posted March 29, 2011 I'm glad to hear you have at least made some headway on this. I know from experience that it can be fun at times to tinker around with the boogieman. Sometimes it is quite a pain in the .Did you try running Avast's boot time scan, gspaulsson? It seems to be fairly thourough and has found a couple of infected audio files on one of my machines.If you know what it was that infected your box, shoot me a link in a private message (or your preferred method-just don't make it a public link) and I will infect a virtual machine and take it for a ride. I've got a little extra time and I need to get some recreation anyway. I love a good monster hunt.There are of course no guarantees....The only sure way of being 100% positive of removal would be a "clean install" or recovery from an image that isn't infected. Quote Link to comment Share on other sites More sharing options...
gspaulsson Posted March 29, 2011 Author Report Share Posted March 29, 2011 Thanks for help, have got things under control and will run the avast scan next time I boot. It seems in the aftermath that this was confined to an MMORPG I'm playing and intended to sabotage other players; no visible aftereffects outside the game. Would like to send you a private msg on this but don't know how - can you give me your email address or fb page?I'm glad to hear you have at least made some headway on this. I know from experience that it can be fun at times to tinker around with the boogieman. Sometimes it is quite a pain in the .Did you try running Avast's boot time scan, gspaulsson? It seems to be fairly thourough and has found a couple of infected audio files on one of my machines.If you know what it was that infected your box, shoot me a link in a private message (or your preferred method-just don't make it a public link) and I will infect a virtual machine and take it for a ride. I've got a little extra time and I need to get some recreation anyway. I love a good monster hunt.There are of course no guarantees....The only sure way of being 100% positive of removal would be a "clean install" or recovery from an image that isn't infected. Quote Link to comment Share on other sites More sharing options...
bludgard Posted March 29, 2011 Report Share Posted March 29, 2011 Would like to send you a private msg on this but don't know how - can you give me your email address or fb page?Check your meesage envelope at the top of the page, gspulsson.We'll take it from there.;) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.