Problem with svchost.exe process. Malicous websiteblocked - inbound connection

[John876]

I thought that can help...

 

FRST.txt

Addition.txt

[MrCharlie]

I don't see anything but.....

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.

Run FRST.exe/FRST64.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

MrC

[John876]

Ok.

Fixlog.txt

[John876]

And again blocking

protection log.txt

[MrCharlie]

You re-installed Windows, what do you want me to do????

 

MrC

[John876]

hi.

I want your help because is the same problem when i had previous windows before formatting disk ( one partition C )...

I do not know why this shows up and what is the reason...

[MrCharlie]

My initial instruction to you stated:

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

So after all the time I spent with you, you go ahead and re-install Windows.
So that negates everything I we did.

=========================================

Go back from the start and download fresh programs and run them.

Make sure you have created a restore point and.....
Download Delfix from Here and save it to your desktop.

• Place a check mark in front of .......
• Create registry backup <---only!
• Uncheck the rest!
• Click the Run button.
  
  Close the tool out when it's done....we'll use it later.
  
  =========================
  
  TDSSKiller and ComboFix
  AdwCleaner and JRT
  ESET online scanner
  
  MrC

[John876]

What is the correct size memory of that process? The biggest of those all has 144 884 KB...

[John876]

I have 10 processes svchost.exe.

[John876]

In driver manager I found driver port called Nuvoton Communications Port (COM1). When i disabled it, since that time i don't receive information about blocking malicious website to that svchost.exe process...

I'll do scans for a while.

[John876]

In addition to now i have ten svchost.exe processes, before that i had ninne.

[John876]

These are logs.

JRT.txt

AdwCleanerR0.txt

ComboFix.txt

TDSSKiller.3.0.0.40_07.09.2014_22.23.22_log.txt

[MrCharlie]

In driver manager I found driver port called Nuvoton Communications Port (COM1). When i disabled it, since that time i don't receive information about blocking malicious website to that svchost.exe process...
I'll do scans for a while.

That's for your HP computer support

====================================

I have 10 processes svchost.exe.

Normal

====================================

The logs look OK

MrC

[John876]

Thanks for reply.

Let's wait to next day. When something will happen i'll post this.

[John876]

Okay - I'm sure that this driver port made problems. Can i delete him? As i posted earlier, When i disabled it, since that time i don't receive information about blocking malicious website.
John876

[MrCharlie]

Yes you can, MrC

[John876]

It's one thing which i don't understand.... When i disable it, the incoming connection doesn't appears but if i uninstall driver, after reboot it appears.
So i must only disable it.
Okay. Problem has been resolved but if you could send me a pv how to uninstall this driver without any troubles, i would be very satisfied.
I really thank you for assistance MrCharlie.

[MrCharlie]

C:\Windows\system32\drivers\parport.sys

See if you can rename it to .old

MrC

[John876]

Okay, thanks so much.
Thread can be closed.

[MrCharlie]

OK........

A little clean up to do....

Please Uninstall ComboFix: (------->if you used it<-------)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter. (it may look like CF is re-installing but it's not)

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:

If you used FRST and can't delete the quarantine folder:

Download the fixlist.txt to the same folder as FRST.exe.

Run FRST.exe and click Fix only once and wait

That will delete the quarantine folder created by FRST.

The rest you can manually delete.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!