SysWOW64\dllhost.exe -- Malwarebytes Blocking Malicious Websites

[Jparker59]

Hi. My Malwarebytes keeps giving me a pop up indicating it is blocking malicious websites (the websites vary) and indicates the process is C:\windows\SysWOW64\dllhost.exe.  

 

I posted a couple of days ago about this with a FRST log and TwinHeadedEagle had me run ComboFix.  That initially appeared to work because immediatly after I did not see any pop ups indicating Malwarebytes was blocking malicious websites, so that thread was closed.  That thread is here https://forums.malwarebytes.org/index.php?/topic/159161-syswow64-cwindowssyswow64dllhostexe

 

Unfortunately, the problem is back (and I did not use my browser in the interim to go to any non-mainstream websites).  Please let me know what I should do.  Should I first run FRST again and post log?

 

Thanks.

[TwinHeadedEagle]

Hello,
 
 
Let's start here again:
 
 
Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[Jparker59]

Hello again.  The pop up messages about blocking malicious websites are no where as frequent as before, but are still happening sporadically.  I ran FRST.  The two logs are attached.

 

Thanks again for taking the time to help me.

 

 

 

 

FRST Log.txt

Addition Log.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 

Please re-run Malwarebytes' Anti-Malware.

• Click the History tab.
• Click Application Logs and double-click the newest Protection Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

fixlist.txt

[Jparker59]

Thanks.  I have done what you instructed and have attached the two logs.  The pop up messages that Malwarebytes is blocking malicious websites are still occurring.

 

 

Fixlog.txt

Protectionlog.txt

[TwinHeadedEagle]

Scan with TDSSKiller
 
Please download TDSSKiller by Kaspersky and save it to your desktop.

• Right-click on
• icon and select Run as Administrator to start the tool.

• Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
• Your machine may appear very slow and unusable after that - it's normal.
• TDSSKiller will run automaticaly. Click on Change parameters and click OK.
• Click the Start Scan button and wait patiently.
• If anything will be found follow this guidelines:A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    If Cure is not available, please choose Skip instead.
  • Do not choose Delete unless instructed!

 

 

 

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[Jparker59]

Hi.  I ran all the scans and steps recommended.  TDSSKiller found nothing.  All the requested logs are attached.  The pop ups indicating  blocked malicious websites have increased frequency.  Are almost constant now.  I only connect to the internet to do what you request and then disconnect.   Thanks for helping me.

TDSSKiller.3.0.0.40_25.10.2014_12.37.27_log.txt

FRST 10-25.txt

Addition 10-25.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 

Please re-run Malwarebytes' Anti-Malware.

• Click the History tab.
• Click Application Logs and double-click the newest Protection Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

fixlist.txt

[Jparker59]

Thanks again.  I did as you instructed.  The two logs are attached.

Malwarebytes log.txt

Fixlog.txt

[TwinHeadedEagle]

Good. How is your PC now?

[Jparker59]

I will use it for a day connected to the internet and see if I get any malicious website warnings and then let you know.  Thanks.

[Jparker59]

Hi.  My PC seemed okay for a while (yesterday), but now the same pop up messages about Malwarebytes blocking malicious websites are back.  Right now they are coming one after another. Just had about 4 or 5 in a row.  All different websites.  Is their anything else we can try?  Thanks.

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[Jparker59]

Thanks.  Here are the two logs.

 

 

Addition.txt

FRST.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

[Jparker59]

Thanks again for all your efforts to help me.  Attached is the fixlog.  Please note that when I hit "fix" on FRST, it generated the fixlog almost instantaneously.

 

 

Fixlog.txt

[Jparker59]

PS:  After doing the FRST "fix", the malicious website blocked attacks are still continuing.  Example attached.

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[Jparker59]

Here are the two logs.  Thanks.

Addition.txt

FRST.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

fixlist.txt

[Jparker59]

Hi.  Here is the fixlog.  After running the FRST fix, I then ran a FRST scan and have attached the two logs.  Thanks.

Fixlog.txt

FRST.txt

Addition.txt

[TwinHeadedEagle]

Good. How is your PC now?

[Jparker59]

I have been out of town and have not used the PC very much.  Let me use it a couple of days and report back.  So far I have not seen the pop ups since running the last fixlog.  Thanks.

[TwinHeadedEagle]

Okay, no problem.

[Jparker59]

We have not noticed any messages about blocked malicious websites since running the last FRST fix.  I am cautiously optimistic the malware is gone.  Thanks for all your help.  I will send you a token of appreciation through Paypal.