Jump to content

dansky9

Members
  • Posts

    10
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Kevin, I ran ESET scan a few more times, and it kept finding the many "how_decrypt" files in various directories. With a little research, I learned these are associated with ransomware that encrypts personal files and demands $500 to get the decryption key. So far, we have not had this problem with files being encrypted. So, I found and manually deleted all the "how_decrypt" files everywhere on all drives and ran ESET again -- this time, it found no threats, so I selected "uninstall upon close". Then I ran a complete scan with MBAM, and it found no threats. Now, Internet Explorer is running again at the expected typical speeds -- not buggy or laggy, like before. (Even though it still occupies >200MB RAM per instance, which I guess must just be typical for this machine.) I think we're finished successfully -- THANK YOU VERY MUCH!! Are there any final clean-up steps to the process? Regards, dansky9
  2. Kevin, ESET found and removed several threats, the log file is attached here for your review. Thanks, dansky9 ESET SCAN 2.txt
  3. Kevin -- Thank you for your reply. I have run ESET as you instructed, and the result was >250 threats found. The "ESET SCAN" results log file is attached here. I also reset all the IE settings, as you recommended. It seems to have helped a little - Internet Explorer runs a little faster now and takes only ~90MB RAM per instance, instead of >200MB as was the case before. What is the next step? Thank you very much, dansky9 ESET SCAN.txt
  4. Thank you very much for your reply -- it appears we are successful, but still with one lingering question... "Fixlog" (from FRST using your "fixlist" file), "AdwCleaner[s0].txt" from AdwCleaner, "JRT,txt" from JRT and "mrt.txt" for Microsoft 64-bit Malicious Software Removal Tool are all attached here for your review, as requested. I was not able to open/view/attach the log file from MBAM scan, perhaps because I have the free version and not the premium version (?), but the results of that scan were "no issues found". At this point, over the last 12 hours, we no longer see any suspicious dllhost, fixmapi, etc processes running in the Task Manager -- i.e., none of the processes I identified in the original post. This is GOOD! One thing I do want to mention is that Internet Explorer still seems a bit slow to load webpages, and in Task Manager it appears to be using ~200MB of RAM per Explorer tab-- which seems very high, and I wonder if it's related to the apparent slow performance? We see it hogging RAM like this even for very simple pages, like the google search splash page -- i.e., not only on webpages heavy with content and scripting (such as yahoo). So, while the processes that were visible in Task Manager are now no longer there, I'm wondering whether we've still got something burrowed deeper into Internet Explorer. When I run IE on other laptops connected to this same home network, they do not hog RAM like I have described here for this desktop PC that you have helped me with. Is there anything else you recommend that I try? Thank you very much. Sincerely, dansky9 Fixlog.txt AdwCleanerS0.txt JRT.txt mrt.log
  5. Hello, and thank you in advance for any help with this. I am writing about my in-laws' computer, and hoping you can help them in the same way Valinorum helped me with my own PC a few months ago. In Windows Task Manager, there are multiple instances of dllhost.exe ("Com Surrogate"), fixmapi.exe ("FIXMAPI 1.0 MAPI Repair Tool"), dplaysvr.exe ("Microsoft DirectPlay helper"), dpnsvr.exe ("Microsoft DirectPlay8 server"), and NAPSTAT.exe ("Network Access Protection Client UI"). They are force-killable by me manually, but they return very quickly. Internet Explorer security level silently sets itself to "Custom", and even after I set it back to "Medium-High", within a few moments it will have gone back to "Custom". C:\Users\Owner\AppData\Local\Temp\ directory is constantly filling itself with MB of randomly named folders, several per minute. And internet access is extremely slow. The computer runs AVIRA anti-virus, but it is not effective against this. Malwarebytes free version finds things and quarantines them, but they return very quickly after. The OS is 64-bit Windows Professional. I ran FRST64 as instructed on the help forum main page. The "FRST" scan file, and the "Addition" file are attached. (If you also need the "Shortcut" file contents, I can provide.) Thank you! Sincerely, dansky9 Addition.txt FRST.txt
  6. Hello Valinorum, Please find the "DelFix.txt" log file attached here. Thank you very much! dansky9 DelFix.txt
  7. Hello Valinorum, Here is my latest activity: (1) Uninstalled uTorrent P2P software, as you suggested. (2) Ran FRST using the code you supplied -- again, this editor interface is not letting me paste anything in from notepad, so I will attach "fixlog.txt" to this post. Hope that's still OK... (3) Ran ESET Online Scanner as instructed, the result was "No Threats Found", so there was no log file. Since my last posting, the PC has still been running without the previous problem. Upon reviewing the fixlog, I hope you will be able to confirm my system is now clean. I do appreciate your help! Thanks, dansky9 Fixlog.txt
  8. Hello VALINORUM, Thank you very much for your prompt reply, and for your willingness to volunteer your time to help me and others with our malware problems. I want to let you know: last night after making my initial post, I tried one more thing -- I rebooted the PC, and before opening Internet Explorer, I immediately ran Malwarebytes program. It found and eliminated a Trojan. Then I ran Malwarebytes again and it found nothing. Then I ran CCleaner. Then I ran AVGFree 2015 full system scan and it found nothing. Then, after all those were done, I opened Internet Explorer and immediately went to Internet Security and confirmed that it was still set a "Medium High" and had not been mysteriously changed to "Custom". All this seems to have helped -- overnight and now this morning, there are no more "dllhost.exe *32" processes, nor even an always-present "dllhost.exe" process. And no more AVG threat detection pop-ups for "Poweliks". However, I have no confidence that I have solved the problem FOR GOOD, so I am still running the FRST scan as you instructed. But I wanted to mention all of the info above, so that you are aware of my system's current status when you review the logs. FRST made "FRST.txt" and "Addition.txt" -- and it also made "Shortcut.txt"; do you also need to see that? For some reason, I am not able to paste the contents of those two log files into the Post Editor screen, so I have attached the two files themselves to this post - hopefully you can see what you need from looking at those attachments. I'm sorry I could not paste directly, as you requested, but it's not letting me copy/paste into this post-editor function; my apologies if any inconvenience. Thanks sincerely, dansky9 FRST.txt Addition.txt
  9. Hello - I've been reading about a lot of people with similar problem. About 5 days ago, internet access slowed to a crawl, with lots of "this page cannot be displayed" failures. Opening Windows Task Manager, I noticed many "dllhost.exe *32" processes ("COM Surrogate"), which I could force-quit one by one - but not the "dllhost.exe" (without the "*32"), which it wouldn't let me kill. After force-quitting them all, a few minutes later they would re-appear. No matter how many force-quits, they always pop up. I am running Internet Explorer 11 (version 11.0.13 KB2987107), and in the Internet Option --> Security window, for the "Internet" security zone, I noticed the security level is set to "Custom". When I open the details, there are many things that are enabled. When I reset to default "Medium-High" (which is where I've previously always had it), many of those things are no longer enabled. (If necessary I can post a complete list.) After I do the reset to "Medium-High" and kill all the "dllhost.exe *32" processes, things appear as normal for a few minutes, when suddenly a new swarm of "dllhost.exe *32" processes appear and then when I check Internet Explorer security settings for the Internet, they have magically reset themselves to "Custom". I tried all of these, which did not solve anything: CCleaner, AVGFree 2015, Malwarebytes. (I don't have Norton, MacAfee, Kaspersky, etc.) I also noticed that C:\Users\<myname>\AppData\Local\Temp\ fills up with hundreds of folders, sometimes as many as 2-3 per minute for certain stretches when many of these dllhost processes are active. And, just today, as of 8:46AM, AVG 2015 threat detection is blocking/removing "Poweliks" exactly every 60 seconds with a pop-up window: Object Name = "HKEY_USERS\<lots of numbers>" (I can include it if necessary), and Process Name: "C:\Windows\SysWOW64\dllhost.exe" My PC is Dell XPS8300 running Windows 7 Home Premium Service Pack 1. My laptop which is connected to the home network, does not have these problems. I would GREATLY APPRECIATE any help you might offer! Thank you in advance.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.