Possible malware, ads running in background, high cpu usage

[cheesevault]

Okay it finally let me go into the F8 menu and now I'm running a system restore. 

[cheesevault]

It seems to have restores successfully, even though it told me it didn't.  This is interesting.  Apparently this point was right when I uninstalled avast because it was throttling my network.

I'm reinstalling avast now.

[MrCharlie]

OK...let me know....MrC

[cheesevault]

Everything seems to be fine.  Avast is not blocking anything and no ads are playing.  If I look in my shields, it is only blue, nothing is red, so that means it's not blocking anything.  I'm going to do a reboot and I'll let you know.

This seems like a miracle.

[cheesevault]

The reason I'm stumped is that I tried to system restore before this (through my desktop), and it didn't work.  So I'm amazed this worked.

[cheesevault]

My processor is not being hogged anymore either.  So that had to have been the virus or whatever you want to call it.  

 

[cheesevault]

So in short, everything is fixed it seems.

Yay!

[MrCharlie]

So everything is OK now???

Please download SystemLook from the link below and save it to your Desktop.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:

  :Filefindrpcss.dll

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

MrC

[cheesevault]

My old issues are gone, but now avast is freaking out over skype and it is blocking some things.  I'm going to uninstall it for now and see if it stops.

[cheesevault]

This is the log for my avast webshield.  I uninstalled skype and the blocks seem to have stopped.

*

* avast! Real-time Shield Scan Report

* This file is generated automatically

*

* Started on: Thursday, January 02, 2014 10:43:57 AM

*

 

1/2/2014 10:58:02 AM http://irtonger-um2.net/load.php?id=15&p=2&t=0&e=0 [L] URL:Mal (0)

1/2/2014 10:58:02 AM http://mersingers3.org/load.php?id=15&p=2&t=0&e=0 [L] URL:Mal (0)

1/2/2014 10:58:04 AM http://blander6.net/load.php?id=15&p=2&t=0&e=0 [L] Win32:Blackbeard-C [Cryp] (0)

1/2/2014 10:59:04 AM http://irtonger-um2.net/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 10:59:04 AM http://mersingers3.org/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 10:59:05 AM http://blander6.net/load.php?id=15&p=2&t=0&e=1 [L] Win32:Blackbeard-C [Cryp] (0)

1/2/2014 11:00:06 AM http://irtonger-um2.net/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 11:00:06 AM http://mersingers3.org/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 11:01:06 AM http://irtonger-um2.net/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 11:01:06 AM http://mersingers3.org/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 11:02:06 AM http://irtonger-um2.net/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 11:02:06 AM http://mersingers3.org/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 11:03:07 AM http://irtonger-um2.net/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

1/2/2014 11:03:07 AM http://mersingers3.org/load.php?id=15&p=2&t=0&e=1 [L] URL:Mal (0)

[cheesevault]

SystemLook 30.07.11 by jpshortstuff

Log created at 11:08 on 02/01/2014 by Matt

Administrator - Elevation successful

 

========== Filefind ==========

 

Searching for "rpcss.dll"

C:\Windows\System32\rpcss.dll --a---- 509440 bytes [00:00 14/07/2009] [01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_c5bfcda3579104e3\rpcss.dll --a---- 509440 bytes [00:00 14/07/2009] [01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

 

-= EOF =-

[MrCharlie]

Can you do this for me:

https://forums.malwarebytes.org/index.php?showtopic=139374&p=772108

MrC

[cheesevault]

Yeah, I posted that basically just as you asked to do do it again.  Here it is again just in case you can't see it or something.

 

SystemLook 30.07.11 by jpshortstuff

Log created at 11:08 on 02/01/2014 by Matt

Administrator - Elevation successful

 

========== Filefind ==========

 

Searching for "rpcss.dll"

C:\Windows\System32\rpcss.dll --a---- 509440 bytes [00:00 14/07/2009] [01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_c5bfcda3579104e3\rpcss.dll --a---- 509440 bytes [00:00 14/07/2009][01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

 

-= EOF =-

[MrCharlie]

rpcss.dll was the problem:


Before:
[-] 2009-07-14 . 72BD0807B457076792BCD5AC79F1AB17 . 510464 . . [6.1.7600.16385] .. c:\windows\system32\rpcss.dll
.

After:
C:\Windows\System32\rpcss.dll --a---- 509440 bytes [00:00 14/07/2009] [01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

------------------------------

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• Do Not Attach It!!!

MrC

[cheesevault]

 Results of screen317's Security Check version 0.99.78  

 Windows 7  x64 (UAC is enabled)  

 Out of date service pack!! 

``````````````Antivirus/Firewall Check:`````````````` 

avast! Antivirus   

 Antivirus up to date!   

`````````Anti-malware/Other Utilities Check:````````` 

 JavaFX 2.1.1    

 Java 7 Update 45  

 Adobe Flash Player 11.9.900.170  

 Adobe Reader 10.1.8 Adobe Reader out of Date!  

 Google Chrome 31.0.1650.57  

 Google Chrome 31.0.1650.63  

 Google Chrome plugins...  

````````Process Check: objlist.exe by Laurent````````  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast avastUi.exe  

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 1% 

````````````````````End of Log`````````````````````` 

[MrCharlie]

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Results of screen317's Security Check version 0.99.78
Windows 7 x64 (UAC is enabled)
Out of date service pack!! <----Visit Windows Update for this

-----------------------------

Adobe Reader 10.1.8 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

--------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /



Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Please download OTC to your desktop. (This will clean up most of the tools and logs)
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-------------------------------

Any questions...please post back.
If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[cheesevault]

Hello, I've ran the OTC and everything seems to be gone except for the Qoobox folder, and it won't let me delete it.

[cheesevault]

I had combofix on my desktop but when I used system restore it went away.  Should I redownload it and then uninstall it?  Would that get rid of it?

[cheesevault]

Nevermind, I got it.  Everything seems to be off now.

Thanks for all of your help, Charlie!

[MrCharlie]

OK....Take Care MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!