DLLHOST.exe com suragate

[Thomas_Dye]

Continuous website blocking pop ups from my malwarebytes premium software. sourced listed as: Dllhost from C:\windows\syswow64\diihost.exe .

 Read the 'what do I do now' file and tried to download the 'FARBAR recovery scan  tool' to get started.

Unable to download that tool as I get a popup labeled "security alert" and stating "your security setting do not allow this file to be downloaded."

 please help. and thanks

Thomas

[MrCharlie]

I attached FRST64.exe

See if that works....MrC

[Thomas_Dye]

thanks for the try. did not work. security alert is generic; don't think it is from my Mcafee. further thoughts?

thomas

[MrCharlie]

Try it in safe mode with networking.

MrC

[Thomas_Dye]

MrC,  it did not work in safemode with networking. arg. tried both your file above as well as the site download. neither worked, same  secutrity warning and download blocked.

thomas

[Thomas_Dye]

was able to thumb drive the FARBAR scan over from a second computer. files from FARBAR area attached.

 thanks, MrC.

 

 thomas

Addition.txt

FRST.txt

[MrCharlie]

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.

Run FRST.exe/FRST64.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then...........

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

http://www.bleepingcomputer.com/download/combofix/dl/12/ <---ComboFix direct download

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

 

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[Thomas_Dye]

MrC, able to get that fixlog.txt run. it is attached. next is combofix. working that now,

 and thanks,

 Thomas

Fixlog.txt

[Thomas_Dye]

MrC,  combofix logs is attached. and thanks again.

 thomas

combofix log.txt

[MrCharlie]

OK...Next:

Please download AdwCleaner from HERE or HERE to your desktop.

• Double click on AdwCleaner.exe to run the tool.

  Vista/Windows 7/8 users right-click and select Run As Administrator

• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are either adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Next..................

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Next.........

Please run a Threat Scan (Malwarebytes)

Click on settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware

Same for PUM (Potentially Unwanted Modifications)

Quarantine All that's found

MrC

[Thomas_Dye]

MrC Got it all done. the Adwcleaner file as well as the JRT file are attached. Ran the Malwarebytes scan and nothing was detected.

 thomas

AdwCleanerS0.txt

JRT.txt

[MrCharlie]

OK...one more scan:

Please run a free online scan with the ESET Online Scanner (it may take a while to run)

Note: You will need to use Internet Explorer for this scan.

First please Disable any Antivirus you have active, as shown in This Topic

Note: Don't forget to re-enable it after the scan.

http://www.eset.eu/online-scanner

Tick the box next to YES, I accept the Terms of Use.

Click Start

When asked, allow the ActiveX control to install

Click Start

Make sure that the options Remove found threats is unchecked and the option Scan unsafe applications is checked

Click Advanced settings and select the following:

Click Start

Wait for the scan to finish

If threats were found:

Click on "list of threats found"

Click on "export to text file" and save it as ESET SCAN and save to the desktop

Click on back

Put a checkmark in "Uninstall application on close"

Click on finish

Post back the log.....MrC

[Thomas_Dye]

MrC

  am using EI; unable to get the ESET online scanner to work. I checked accept and hit start. I get a pop up stating that an add on failed to start. tried a couple times. tried rebooting. same result. Malwarebytes and Mcfee are disabled.

thoughts?

 Arg.

 and thanks,

 Thomas

[MrCharlie]

Run Norton Power Eraser instead: (read the tutorial on how to run it)

http://security.symantec.com/nbrt/npe.aspx <---Norton Power Eraser

https://support.norton.com/sp/en/us/home/current/solutions/v69675421_EndUserProfile_en_us?OpenDocument&src=smr2011 <---tutorial

MrC

[Thomas_Dye]

MrC

   Was unable to download the Norton due to same pop up security alert as previous.

Norton Power eraser was transferred to machine via flash drive and then run.

 

  There were several results that were tagged. the screen shot attached is  what it showed me. three files are know as we added them. the pep reader I added weeks ago and use. the registry ( errors I assume, I don't know) ??

 I have not done anything with the results. Awaiting reply,

 and thanks again.

 Thomas 

Info20141028193013.xml

[MrCharlie]

Nothing to worry about there.

How is the computer????

If there's no other problems.......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• Do Not Attach It!!!

MrC

[Thomas_Dye]

Unable to copy/cut and paste. also was unable to download the program due to the same security alert pop up as previous. got that pop up even when I had disabled Mcfee and Malwarebytes. Used flash drive to get it on from a clean machine.

will try to post as a screenshot rather than attaching file. just seems odd.

 unable to post it here. file attached. sorry.

 thomas

 

 

 

[MrCharlie]

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

===============================

Adobe Reader is out of date <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

===============================

A little clean up to do....

Please Uninstall ComboFix: (------->if you used it<-------)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /



Then hit enter. (it may look like CF is re-installing but it's not)
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Thomas_Dye]

Couple of things, might not be important:

  Opened Abobe and checked for updates. no updates available. ->this happens frequently- where a page says I'm out of date, but I am not. I only go to my own software or the originating webpage to do this check.

 

Tried to uninstall combofix through command line as directed. got a pop up stating that 'cannot access specified file' then a pop up from Mcafee stating 'trogen detected' and 'reboot'. did so. after that combo fix was gone from computer. Also after restart my home page (in IE) was blank.

The tool deletion program worked well.

Hmm about it. seems to be working well -just strangeness as above.

 if nothing further will pop to your profile for a comment and a thank you. well deserved.

 thomas

[MrCharlie]

Also after restart my home page (in IE) was blank.

Is it OK now (maybe reboot again)

MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!