svchost (svchost.exe trojan.agent) cannot get ridd of it

jreilly · June 5, 2012

Extra svchost.exe *32 is eating up memory (wirth a description of winrscmde).

Additionally, when malwarebytes is turned on, the system is displaying messages that outgoing attempts to contact a web site were blocked (see log ). Also attached are logs from 'attach' , 'dds' and 'protection'

I need help in getting rid of these problems.

Attach.txt

DDS.txt

mbam-log-2012-06-04 (10-21-54).txt

protection-log-2012-06-04.txt

Maniac · June 5, 2012

Hello jreilly and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Step 1

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
Click the Start Scan button.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Step 2

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

TDSSKiller log
Malwarebytes' Anti-Malware log
a new fresh DDS log file

jreilly · June 6, 2012

i have run the programs that you requested and attached the files that I could. The

The tdsskiller quartine created multiple folders with multiple files in the folders and the system will not allow me to attach them. How can I get this data to you?

The object file has the following data in it.

[infectedObject]

Verdict: Rootkit.Boot.Pihar.b

Attach 6-6-12.txt

DDS 6-6-12.txt

mbam-log-2012-06-06 (08-51-34).txt

Maniac · June 6, 2012

I don't want from you to attach those files. Take a look at my instructions again:

Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

In your next reply, post the following log files:

jreilly · June 6, 2012

MBR000/object

[infectedObject]

Type: MBR

Name: \Device\Harddisk0\DR0

---------------------------------

mbr0000/tsk0000

[infectedFile]

Type: Raw image

---------------------------------------

mbr0000\tsk0001

[infectedFile]

Type: Raw BB image

-----------------------------------------

tdlsf0000/object

[infectedObject]

Verdict: TDSS File System

Name: \Device\Harddisk0\DR0

------------------------------------

tdlsf0000/tsk0000

[infectedFile]

Name: ph.dll

Size: 28672