Hello Taylor, thanks for submitting a comment. I have had good success removing malware using RogueKiller. Try running that program and let me know your results.

Peter,

Thanks for taking time to relate your story and troubleshooting tips. I’m sure someone will find this comment very useful! It is very encouraging to me, as the author when readers comment, thanks again!

Just gonna add some more detail in case this helps future readers.

I first noticed this through Comodo when I saw explorer.exe sending in/out small packages of data (66B and most of it out-going) that made me suspicious. Before reading this guide i was using Comodo Killswitch instead of Process Explorer/Monitor, which showed a child program of explorer.exe called explorer.exe. The child version was using up to 800MB of memory, whereas Task Manager showed it only using approx 200MB, and around 5-10% of my CPU.

First response, Kill and Block process: Access Denied Seek Admin Assistance/Permission (I am the admin and only user).

Tried other things, “Set priority”, “Properties”, “Delete” all came up with Access denied.

Then tried “Terminate Tree and Reverse” Surprisingly this was allowed, it brought the explorer.exe down to 17MB mem usage (it then began climbing again) and it also revealed the child process cfmon.exe (Mentioned in your guide).

Poked around with this new process, couldn’t figure out what to do next. Whacked it into google along with exploere.exe and high mem usage and found this page. Followed steps and both child programs are gone.

After following your method malwarebytes found a fake trojan called FntCache.dll instead of your rdpencom.dll.

I love it when people are able to get one up on malware. You are a life saver and a genious, thanks again.

Remoted into her pc and discovered MASSIVE incomming/outgoing tcp connections being initiated from explorer.exe. Found a few sights that pointed me towards c:/programdata. Looked in there and found a alphabetsoup file that had a d3d10.dll (assuming this is directx) that identified it self as part of Microsoft IIS. Looked in regedit for that alphabet soup name and found an entry where inprocserver32 was calling that file. Did some searching on google and found your post. Was able to run unlocker and rename the file then deleted it. Manually deleted the entries from regedit (after backup ofcourse) then rebooted. File was gone and system has thus been back to normal. Ran malwarebytes and found other unsignificant entries (over 2000).

Probably never would have even known the issue was there had they not had really crappy DSL.

Good show my man. A+

Anyway, I followed your steps and it worked perfectly. I don’t even know how long I’ve had this problem, but I can’t remember when my computer worked as well as it does now.

I can’t thank you enough. This article was brilliant.

Thanks for your comment. I’m glad I was able to be of help!