Jump to content

svchost.exe trying to access malicious site

astralbanana
 Share

Recommended Posts

MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

RogueKiller<---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Removing malware can be unpredictable
...things can go very wrong!
Backup
any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>
Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>
Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites
astralbanana

astralbanana

Posted
  • Author
Posted

Here:

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 8 (6.2.9200 ) 64 bits version

Started in : Normal mode

User : Panu [Admin rights]

Mode : Scan -- Date : 04/11/2013 15:35:38

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤

-> E:\Users\Default\NTUSER.DAT

-> E:\Users\UpdatusUser\NTUSER.DAT

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: KINGSTON SVP200S360G +++++

--- User ---

[MBR] 711440857fbdcc464f6c5fef314d94d5

[bSP] 7f44289925f0fc0e8b5a434bc0b8de66 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 350 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 718848 | Size: 56889 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: SAMSUNG HD103SJ +++++

--- User ---

[MBR] 9ec95883c4283a5d526c3112b7dd8c86

[bSP] d50daa7ec9574ca203daadb37591ffb6 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 903766 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_04112013_02d1535.txt >>

RKreport[1]_S_04112013_02d1535.txt

Thanks for the help.

Link to post
Share on other sites
astralbanana

astralbanana

Posted
  • Author
Posted

Here

2013/04/11 11:59:56 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50386, Process: chrome.exe)

2013/04/11 12:00:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50390, Process: chrome.exe)

2013/04/11 12:00:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50391, Process: chrome.exe)

2013/04/11 12:00:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50398, Process: chrome.exe)

2013/04/11 12:00:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50400, Process: chrome.exe)

2013/04/11 12:00:36 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50428, Process: chrome.exe)

2013/04/11 12:00:36 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50440, Process: chrome.exe)

2013/04/11 12:01:08 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50463, Process: chrome.exe)

2013/04/11 12:01:16 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50475, Process: chrome.exe)

2013/04/11 12:01:32 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50500, Process: chrome.exe)

2013/04/11 12:02:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50531, Process: chrome.exe)

2013/04/11 12:02:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50535, Process: chrome.exe)

2013/04/11 12:02:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50537, Process: chrome.exe)

2013/04/11 12:02:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50557, Process: chrome.exe)

2013/04/11 12:02:04 +0300 MASIINA Panu IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 50559, Process: chrome.exe)

2013/04/11 12:17:00 +0300 MASIINA Panu IP-BLOCK 46.164.175.99 (Type: incoming, Port: 22686, Process: tixati.exe)

2013/04/11 12:22:05 +0300 MASIINA Panu IP-BLOCK 89.28.97.110 (Type: incoming, Port: 22686, Process: tixati.exe)

2013/04/11 12:36:05 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:05 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:05 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:13 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:13 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:13 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:13 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:13 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:21 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 12:36:21 +0300 MASIINA Panu IP-BLOCK 5.248.134.199 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:25:10 +0300 MASIINA Panu IP-BLOCK 218.10.86.154 (Type: incoming, Port: 22686, Process: tixati.exe)

2013/04/11 13:32:22 +0300 MASIINA Panu IP-BLOCK 31.133.36.87 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:32:30 +0300 MASIINA Panu IP-BLOCK 31.133.36.87 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:32:30 +0300 MASIINA Panu IP-BLOCK 31.133.36.87 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:32:30 +0300 MASIINA Panu IP-BLOCK 31.133.36.87 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:32:30 +0300 MASIINA Panu IP-BLOCK 31.133.36.87 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:32:30 +0300 MASIINA Panu IP-BLOCK 31.133.36.87 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:32:30 +0300 MASIINA Panu IP-BLOCK 31.133.36.87 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:15 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:15 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:15 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:23 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:23 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:23 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:23 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:23 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:50:23 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:27 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:27 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:27 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:35 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:35 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:35 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:35 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:35 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 13:57:35 +0300 MASIINA Panu IP-BLOCK 178.158.120.140 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:47 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:47 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:47 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:55 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:55 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:55 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:55 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:55 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:00:55 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:12:15 +0300 MASIINA Panu IP-BLOCK 89.28.97.110 (Type: incoming, Port: 22686, Process: tixati.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:44 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:23:52 +0300 MASIINA Panu IP-BLOCK 195.88.139.78 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:08 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:08 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:08 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:16 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:16 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:16 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:16 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:16 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:32:16 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:36:56 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:36:56 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:36:56 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:36:56 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:36:56 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:37:04 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:37:04 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:37:04 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:37:04 +0300 MASIINA Panu IP-BLOCK 31.133.39.73 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:36 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:36 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:36 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:36 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:36 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:44 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:44 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:44 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:51:44 +0300 MASIINA Panu IP-BLOCK 31.133.37.82 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:16 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:17 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:17 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:25 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:25 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:25 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:25 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:25 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 14:52:25 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 14:58:17 +0300 MASIINA Panu IP-BLOCK 89.28.97.110 (Type: incoming, Port: 22686, Process: tixati.exe)

2013/04/11 15:01:21 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:21 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:21 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:29 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:29 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:29 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:29 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:29 +0300 MASIINA Panu IP-BLOCK 77.222.132.154 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:01:37 +0300 MASIINA Panu IP-BLOCK 115.136.206.176 (Type: incoming, Port: 22686, Process: tixati.exe)

2013/04/11 15:07:13 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:13 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:13 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:13 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:13 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:13 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:21 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:21 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:07:21 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:49 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:49 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:49 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:57 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:57 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:57 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:57 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:57 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:18:57 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:30:34 +0300 MASIINA Panu IP-BLOCK 82.114.87.61 (Type: incoming, Port: 22686, Process: tixati.exe)

2013/04/11 15:32:34 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:34 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:34 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:42 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:42 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:42 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:42 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:42 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: outgoing, Port: 65336, Process: svchost.exe)

2013/04/11 15:32:42 +0300 MASIINA Panu IP-BLOCK 31.133.47.12 (Type: incoming, Port: 65336, Process: svchost.exe)

As you can see, there are some browser entries at the top, but mostly svchost.

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

It maybe that Malwarebytes is just doing its job, but lets run some scans to be sure:

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK, run this scan which will just produce 2 logs, please post them:

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://www.itxassociates.com/OT-Tools/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

To attach a log:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

----------------------------

I don't see anything in the logs.

Did you run a scan with Defender?

We can run an online scan also if needed.

---------------------------

Lets check for any adware while you're here:

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode.

  1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.

You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:

/DisableAskDetection - This option disables Ask Toolbar detection.

-------------------------------

Here's so info on............

IP Blocking

IP blocks can indicate a number of things:

  • They could indicate that MBAM is doing its job of blocking bad content on websites.

  • In some cases the blocks are a false positive.

  • However, they can also be a sign of infection, especially if the blocks are outgoing and they occur when no browsers are open.

--> There is more information about the IP blocking module in the FAQ - Section G (and in the Helpdesk topics HERE and HERE).

They include instructions on how to set MBAM to ignore a particular IP, if you wish to do so.

They also contain instructions on how to determine what process might be trying to make the connections.

You may also research the IP in question at www.ip-lookup.net or a similar site.

On the other hand, if you think the IP blocks might be a false positive, then please read this sticky topic before starting a new topic in the False Positives forum.

Alternatively, if you think you might be infected, based on the IP blocks and/or other suspicious computer behavior, then please read the following for the available options to have a malware expert assist you with cleaning process Available Assistance For Possibly Infected Computers.

http://helpdesk.malw...malicious-site-

http://helpdesk.malw...re-block-Skype-

http://helpdesk.malw...g-my-antivirus-

http://helpdesk.malw...-pro-a-firewall

MrC

Link to post
Share on other sites
astralbanana

astralbanana

Posted
  • Author
Posted

# AdwCleaner v2.200 - Logfile created 04/11/2013 at 17:30:47

# Updated 02/04/2013 by Xplode

# Operating system : Windows 8 Pro (64 bits)

# User : Panu - MASIINA

# Boot Mode : Normal

# Running from : C:\Users\Panu\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Found : HKCU\Software\APN PIP

Key Found : HKLM\Software\PIP

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\Panu\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [696 octets] - [11/04/2013 17:30:47]

########## EOF - C:\AdwCleaner[R1].txt - [755 octets] ##########

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Run this scan:

Download aswMBR to your desktop.

http://public.avast....erek/aswMBR.exe

Double click the aswMBR.exe to run it.

If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".

Click the "Scan" button to start scan.

On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Run TDSSKiller instead, it should work OK with W8:

Please read the directions carefully so you don't end up deleting something that is good!!

If in doubt about an entry....please ask or choose Skip!!!!

Don't Delete anything unless instructed to!

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

If a suspicious object is detected, the default action will be Skip, click on Continue

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:

Please download the latest version of TDSSKiller from here and save it to your Desktop.

  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
    image000q.png
  • Put a checkmark beside loaded modules.
    2012081514h0118.png
  • A reboot will be needed to apply the changes. Do it.
  • TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  • Then click on Change parameters in TDSSKiller.
  • Check all boxes then click OK.
    clip.jpg
  • Click the Start Scan button.
    19695967.jpg
  • The scan should take no longer than 2 minutes.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
    67776163.jpg
    Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
    If in doubt about an entry....please ask or choose Skip
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    62117367.jpg
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  • A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
  • Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If in doubt about an entry....please ask or choose Skip

Don't Delete anything unless instructed to!

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Those files are OK just > UnsignedFile.Multi.Generic <

So we ran 2 of the best scanners available, TDSSKiller and MBAR and both came up clean.

Your AV came up clean as well as Malwarebytes and ESET online scanner .

I didn't see anything in the scan from OTL.

RogueKiller and AdwCleaner scans were OK.

-------------------------

One thing I would suggest is installing CCleaner to clean out temp files on the system, just stay away from the registry cleaner!

http://www.piriform.com/ccleaner

http://www.howtogeek...-9-tips-tricks/ <---CCleaner tutorial

-------------------------

If you're not sadified with my answers , as a paying customer, you may contact the help desk here:

http://www.malwareby...ntact_consumer/

-------------------------

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!

MrC

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept