Dllhost.exe *32 over and over

[Alltraxjim]

I have the same issue as it looks like a bunch of folks....yesterday my computer started working like mad and slowing to a crawl.

 

Based on my research which brought me here, I have some kind of infection that has a symptom of creating a bunch of Dllhost.exe *32 files in my processes. I'm currently just ending the processes when they start showing up.

 

On occasion, I've gotten a pop up that says "powershell has stopped working"

 

I first tried to download the Farbar recovery scan tool;....however, I keep getting this...

 

"Your current security setting do not allow this file to download"

 

I have AVG Internet Security....should I turn off some setting? Firewall?

 

Thanks for any help.

Alltraxjim

[LiquidTension]

Hello Alltraxjim, welcome to Malwarebytes' Malware Removal forum!

My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. 

General P2P/Piracy Notice: 
 

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum. 
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

 
======================================================

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
• Ensure you are following this topic. Click  at the top of the page.

======================================================
 
Do the following, and see if you can download Farbar Recovery Scan Tool (FRST).

• Press the Windows Key  + r on your keyboard at the same time. Type inetcpl.cpl and click OK.
• Click Security. 
• Click Custom level....
• Scroll down to Downloads.
• Under File download, place a checkmark next to Enable.
• Click OK.

[Alltraxjim]

Hi and thanks so much for your help on this!

 

I followed your instruction to enable file download. The Farbar tool downloaded with no problem. I have run the scans and attached the logs below.

 

 

FRST.txt

Addition.txt

[LiquidTension]

Hello, 
 
Due to the nature of one of the infections present on your machine, I must ensure you are aware of the following. Please read the warning below, let me know what you think and how you wish to proceed. 
 

BACKDOOR WARNING
 
------------------------------

One or more of the identified infections is known to use a backdoor, that allows attackers to remotely control your computer, download/execute files and steal critical system, financial and personal information.

If your computer was used for online banking, has credit card information or other sensitive data, using a non-infected computer/device you should immediately change all account information (including those used for banking, Email, eBay, Paypal, online forums, etc).

Banking and credit card institutions should be notified of the possible security breach immediately. Please read the following article for more information: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Whilst the identified infection(s) can be removed, there is no way to guarantee the trustworthiness of your computer unless you reformat your Hard Drive and reinstall your Operating System. This is due to the nature of the infection, which allows the attacker remote control over the machine. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat/reinstall. Please read the following articles for more information.

• When should I re-format? How should I reinstall?
• Help: I Got Hacked. Now What Do I Do?
• Where to draw the line? When to recommend a format and reinstall?

You now have the choice between cleaning the infection(s) present or reformatting your computer. Ultimately, this decision is personal, and down to you and what you're most comfortable with. Please let me know how you wish to proceed, and if you have any questions.

[Alltraxjim]

Let's go ahead and clean the infection and avoid reformatting at this time. I understand what I read and will be aware of that and things I need to pursue in my future use on this computer.

 

Thanks!

[LiquidTension]

OK. Please work your way through the following. 

 

STEP 1
 ComboFix

• Note: Please read through these instructions before running ComboFix. 
• Please download ComboFix and save the file to your Desktop. << Important!
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click ComboFix.exe and select  Run as administrator to run the programme.
• Follow the prompts. 
   
• Allow ComboFix to complete it's removal routine (please refer to Important Notes:).
• Upon completion, a log (ComboFix.txt) will be created in the root directory (C:\). Copy the contents of the log and paste in your next reply.
• Re-enable your anti-virus software.
   

Important Notes:

• Do NOT mouse click ComboFix's window whilst it is running. This may cause the programme to stall.
• Do NOT use your computer whilst ComboFix is running.
• Your Desktop/taskbar may disappear whilst ComboFix is running; this is normal.
   
• If you get the message Illegal operation attempted on registry key that has been marked for deletion please reboot your computer.
• ComboFix will disconnect your machine from the Internet as soon as it starts.
• Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
• If you are unable to access the Internet after running ComboFix, please reboot your computer. 
   

STEP 2
 TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select  Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to:
  • Loaded Modules
  • Detect TDLFS file system
  • Verify file digital signatures
• Note: If you receive the following message: Extended Monitoring Driver is required, click Reboot now, and continue from here following the reboot.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach the log in your next reply.
   

STEP 3
 Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

======================================================
 
STEP 4
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• ComboFix.txt
• TDSSKiller log (attached)
• FRST.txt
• Addition.txt

[Alltraxjim]

I have the logs ready to go....but I have tried everything to copy and paste into this reply and nothing happens!

I can copy & paste into another notepad window or into a MS-Word document....but I cannot figure out how to get

it to copy & paste into this reply box. Any suggestions?

[LiquidTension]

This is an issue with Internet Explorer. 

 

Please attach the files in your post, or use an alternative browser.

[Alltraxjim]

I am trying to be patient. I was able to cut & paste into the reply box using Google Chrome. However, when I click the "post" button, it has been saving the post for about 1 hour (it appears to be hung up....although I understand it was a very long post because of the cut & paste.). I'm giving it a bit more time but at some point, I will probably just attach the files if you are OK with that.

 

Alltraxjim

[LiquidTension]

Attaching is fine.

[Alltraxjim]

OK, log files are attached. Thanks so much.

ComboFix.txt

TDSSKiller.3.0.0.41_29.10.2014_13.36.16_log.txt

FRST.txt

Addition.txt

[LiquidTension]

Hello, 

 

Do you recognise these folders/files?

2014-10-27 10:34 - 2014-10-27 10:34 - 00100571 _____ () C:\Tfmm4BkupTSSAA_StateXC_2014_D2only-01.zip
2014-09-30 07:02 - 2014-09-30 07:02 - 00338574 _____ () C:\Tfmm4BkupGLC2014_HSMSES-01.zip
2014-10-28 13:18 - 2013-02-28 15:36 - 00000000 ____D () C:\tfmeets4
2014-10-27 21:14 - 2013-03-16 19:08 - 00002196 _____ () C:\tcl61-01.tcl
2014-10-27 21:14 - 2013-03-16 19:08 - 00002196 _____ () C:\tcl60-01.tcl
2014-10-27 21:14 - 2013-03-16 19:08 - 00002196 _____ () C:\tcl59-01.tcl
2014-10-27 10:38 - 2013-03-16 19:08 - 00001830 _____ () C:\tcl58-01.tcl
2014-10-27 10:38 - 2013-03-16 19:08 - 00001708 _____ () C:\tcl57-01.tcl
2014-10-27 10:38 - 2013-03-16 19:08 - 00001464 _____ () C:\tcl56-01.tcl
2014-10-27 10:37 - 2013-03-16 19:08 - 00003050 _____ () C:\tcl54-01.tcl
2014-10-27 10:37 - 2013-03-16 19:08 - 00001830 _____ () C:\tcl53-01.tcl
2014-10-27 10:37 - 2013-03-16 19:08 - 00001830 _____ () C:\tcl52-01.tcl
2014-10-27 10:37 - 2013-03-16 19:08 - 00001342 _____ () C:\tcl55-01.tcl
2014-10-27 10:36 - 2013-03-16 19:08 - 00003050 _____ () C:\tcl49-01.tcl
2014-10-27 10:36 - 2013-03-16 19:08 - 00001464 _____ () C:\tcl50-01.tcl
2014-10-27 10:36 - 2013-03-16 19:08 - 00001342 _____ () C:\tcl51-01.tcl
2014-10-27 10:35 - 2013-03-16 19:08 - 00003050 _____ () C:\tcl48-01.tcl
2014-10-27 10:35 - 2013-03-16 19:08 - 00003050 _____ () C:\tcl47-01.tcl
2014-10-27 10:35 - 2013-03-16 19:08 - 00002684 _____ () C:\tcl46-01.tcl
2014-10-26 16:44 - 2013-03-16 19:08 - 00001830 _____ () C:\tcl45-01.tcl
2014-10-26 16:44 - 2013-03-16 19:08 - 00001464 _____ () C:\tcl44-01.tcl
2014-10-26 16:27 - 2013-03-16 19:08 - 00001830 _____ () C:\tcl43-01.tcl
2014-10-26 16:26 - 2013-03-16 19:08 - 00003050 _____ () C:\tcl41-01.tcl
2014-10-26 16:26 - 2013-03-16 19:08 - 00003050 _____ () C:\tcl40-01.tcl
2014-10-26 16:26 - 2013-03-16 19:08 - 00001708 _____ () C:\tcl42-01.tcl
2014-10-24 11:04 - 2012-03-25 11:51 - 00000000 ____D () C:\tempMM
2014-10-23 15:50 - 2014-05-20 11:11 - 00000000 ____D () C:\Lynx
2014-10-21 22:21 - 2013-03-16 19:08 - 00002074 _____ () C:\tcl39-01.tcl
2014-10-21 22:20 - 2013-03-16 19:08 - 00003416 _____ () C:\tcl38-01.tcl
2014-10-21 22:19 - 2013-03-16 19:08 - 00009394 _____ () C:\tcl36-01.tcl
2014-10-21 22:19 - 2013-03-16 19:08 - 00002440 _____ () C:\tcl37-01.tcl
2014-10-21 22:18 - 2013-03-16 19:08 - 00004148 _____ () C:\tcl35-01.tcl
2014-10-21 22:17 - 2013-03-16 19:08 - 00004514 _____ () C:\tcl34-01.tcl
2014-10-21 22:16 - 2013-03-16 19:08 - 00002440 _____ () C:\tcl33-01.tcl
2014-10-21 22:15 - 2013-03-16 19:08 - 00005002 _____ () C:\tcl32-01.tcl
2014-10-13 10:23 - 2013-03-16 19:08 - 00006588 _____ () C:\tcl31-01.tcl
2014-10-13 10:22 - 2013-03-16 19:08 - 00005612 _____ () C:\tcl30-01.tcl
2014-09-29 23:21 - 2013-09-09 08:54 - 00000000 ____D () C:\TLS_exports
2014-09-29 13:23 - 2013-03-16 19:08 - 00002562 _____ () C:\tcl29-01.tcl
2014-09-29 13:01 - 2013-03-16 19:08 - 00003172 _____ () C:\tcl28-01.tcl
2014-09-29 13:00 - 2013-03-16 19:08 - 00002684 _____ () C:\tcl27-01.tcl

 

STEP 1
 Uninstall Software

• Press the Windows Key  + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall.
• Note: Ensure you decline offers of additional software if applicable.
  • AVG Security Toolbar 
• Follow the prompts.
• Reboot if necessary.
   

STEP 2
 Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key  + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exeC:\Program Files (x86)\Common Files\AVG Secure Search() C:\Program Files (x86)\AVG Secure Search\vprot.exeC:\Program Files (x86)\AVG Secure SearchHKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-08-26] ()HKLM-x32\...\Run: [] => [X]SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={3B4B95EB-DADD-4CE9-B110-FFC7DEDCEBE9}&mid=723c10d65b5747d1b3690d47e7df627c-7367922a558f587c1c28e5c41c27f3241f356dbe〈=en&ds=AVG&pr=pr&d=2012-04-01 23:44:54&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={3B4B95EB-DADD-4CE9-B110-FFC7DEDCEBE9}&mid=723c10d65b5747d1b3690d47e7df627c-7367922a558f587c1c28e5c41c27f3241f356dbe〈=en&ds=AVG&pr=pr&d=2012-04-01 23:44:54&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll No FileBHO-x32: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssie.dll No FileBHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No FileToolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No FileHandler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No FileHandler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No FileHandler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No FileFF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\17.3.0.49CHR Extension: (AVG Safe Search) - C:\Users\JK\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla [2012-04-09]CHR Extension: (AVG Do-Not-Track) - C:\Users\JK\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2012-04-09]CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx []C:\ProgramData\AVG Secure SearchR2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-12] (AVG Secure Search)C:\Users\JK\AppData\Local\Temp\{4CE00DEB-733F-44C9-BDA9-D426A95722B2}.exeHKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\54533662.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\54533662.sys => ""="Driver"CMD: ipconfig /flushdnsCMD: netsh winsock reset allCMD: netsh int ipv4 resetCMD: netsh int ipv6 resetEmptyTemp:end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 3
 AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select  Run as administrator to run the programme.
• Follow the prompts. 
• Click Scan. 
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
• Follow the prompts and allow your computer to reboot. 
• After rebooting, a log (AdwCleaner[s0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 

STEP 4
 Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Note: If you unchecked any items in AdwCleaner, please backup the associated folders/files before running JRT.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select  Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted. 
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.
   

======================================================

STEP 5
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Do you recognise the folders/files?
• Did the programme uninstall OK?
• Fixlog.txt
• AdwCleaner[s0].txt
• JRT.txt

[Alltraxjim]

I do recognize all of those folders/files. They are needed for my work.

The program uninstalled OK....no problems

Here are the logs-

 

FIXLOG

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-10-2014

Ran by JK at 2014-10-30 00:11:31 Run:1

Running from C:\Users\JK\Desktop

Loaded Profiles: JK &  (Available profiles: JK)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

start

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe

() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe

C:\Program Files (x86)\Common Files\AVG Secure Search

() C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Program Files (x86)\AVG Secure Search

HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-08-26] ()

HKLM-x32\...\Run: [] => [X]

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={3B4B95EB-DADD-4CE9-B110-FFC7DEDCEBE9}&mid=723c10d65b5747d1b3690d47e7df627c-7367922a558f587c1c28e5c41c27f3241f356dbe〈=en&ds=AVG&pr=pr&d=2012-04-01 23:44:54&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}

SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={3B4B95EB-DADD-4CE9-B110-FFC7DEDCEBE9}&mid=723c10d65b5747d1b3690d47e7df627c-7367922a558f587c1c28e5c41c27f3241f356dbe〈=en&ds=AVG&pr=pr&d=2012-04-01 23:44:54&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}

BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll No File

BHO-x32: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssie.dll No File

BHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)

Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No File

Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File

Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File

FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\17.3.0.49

CHR Extension: (AVG Safe Search) - C:\Users\JK\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla [2012-04-09]

CHR Extension: (AVG Do-Not-Track) - C:\Users\JK\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2012-04-09]

CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx []

C:\ProgramData\AVG Secure Search

R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-12] (AVG Secure Search)

C:\Users\JK\AppData\Local\Temp\{4CE00DEB-733F-44C9-BDA9-D426A95722B2}.exe

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\54533662.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\54533662.sys => ""="Driver"

CMD: ipconfig /flushdns

CMD: netsh winsock reset all

CMD: netsh int ipv4 reset

CMD: netsh int ipv6 reset

EmptyTemp:

end

*****************

 

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe => No running process found

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe => No running process found

"C:\Program Files (x86)\Common Files\AVG Secure Search" => File/Directory not found.

C:\Program Files (x86)\AVG Secure Search\vprot.exe => No running process found

"C:\Program Files (x86)\AVG Secure Search" => File/Directory not found.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\vProt => Value not found.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.

"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.

"HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.

"HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}" => Key deleted successfully.

"HKCR\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}" => Key deleted successfully.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}" => Key deleted successfully.

"HKCR\Wow6432Node\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}" => Key deleted successfully.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key deleted successfully.

"HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} => Value not found.

"HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.

"HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.

"HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => Key not found.

"HKCR\PROTOCOLS\Handler\linkscanner" => Key deleted successfully.

"HKCR\CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1}" => Key deleted successfully.

"HKCR\Wow6432Node\PROTOCOLS\Handler\linkscanner" => Key not found.

"HKCR\Wow6432Node\CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1}" => Key deleted successfully.

"HKCR\Wow6432Node\PROTOCOLS\Handler\viprotocol" => Key not found.

"HKCR\Wow6432Node\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}" => Key not found.

"HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin" => Key not found.

HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\avg@toolbar => Value not found.

C:\Users\JK\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla directory not found.

C:\Users\JK\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof directory not found.

"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof" => Key not found.

"C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx" => File/Directory not found.

"C:\ProgramData\AVG Secure Search" => File/Directory not found.

vToolbarUpdater18.1.9 => Service not found.

C:\Users\JK\AppData\Local\Temp\{4CE00DEB-733F-44C9-BDA9-D426A95722B2}.exe => Moved successfully.

"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\54533662.sys" => Key deleted successfully.

"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\54533662.sys" => Key deleted successfully.

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

 

=========  netsh winsock reset all =========

 

 

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

 

 

========= End of CMD: =========

 

 

=========  netsh int ipv4 reset =========

 

Reseting Global, OK!

Reseting Interface, OK!

Reseting Unicast Address, OK!

Restart the computer to complete this action.

 

 

========= End of CMD: =========

 

 

=========  netsh int ipv6 reset =========

 

Reseting Interface, OK!

Restart the computer to complete this action.

 

 

========= End of CMD: =========

 

EmptyTemp: => Removed 638.8 MB temporary data.

 

 

The system needed a reboot. 

 

==== End of Fixlog ====

 

 

ADWCLEANER [sO] LOG

 

# AdwCleaner v3.311 - Report created 30/10/2014 at 06:32:34

# Updated 30/09/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : JK - JK-PC

# Running from : C:\Users\JK\Desktop\AdwCleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

 

***** [ Scheduled Tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17344

 

 

-\\ Google Chrome v

 

[ File : C:\Users\JK\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [2080 octets] - [30/10/2014 00:26:27]

AdwCleaner[s0].txt - [2017 octets] - [30/10/2014 06:32:34]

 

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [2077 octets] ##########

 

 

JRT LOG

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.3.3 (10.21.2014:1)

OS: Windows 7 Home Premium x64

Ran by JK on Thu 10/30/2014 at  6:46:47.36

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

Successfully deleted: [File] C:\windows\prefetch\DRIVERINSTALLER.EXE-60359B37.pf

 

 

 

~~~ Folders

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Thu 10/30/2014 at  6:50:22.58

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[LiquidTension]

Good job.

Please provide an update on your computer after completing the instructions below. Are there any outstanding issues?

 

STEP 1

 Malwarebytes Anti-Malware (MBAM)

• Open Malwarebytes Anti-Malware and click Update Now.
• Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.
• Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• Click Copy to Clipboard and paste the log in your next reply. 
   

STEP 2
 ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Hide advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click . If no threats were found, skip the next two bullet points. 
• Click  and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to  and click .
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 3
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• MBAM Scan log
• ESET Online Scan log
• Are there any outstanding issues?

[Alltraxjim]

Thanks for everything you are doing. I'm a little behind due to some work but I'll be working on this tonight and hope to get everything to you in the morning.

[LiquidTension]

OK, sounds good. 

[Alltraxjim]

Here is the MBAM log below....there were no threats and no log created for the ESET Online Scan.

I don't seem to have any outstanding issues and the computer seems to be running fine.

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 10/31/2014

Scan Time: 12:46:10 AM

Logfile: MBAM_Log.txt

Administrator: Yes

 

Version: 2.00.3.1025

Malware Database: v2014.10.31.02

Rootkit Database: v2014.10.22.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: JK

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 375195

Time Elapsed: 36 min, 31 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Warn

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[LiquidTension]

Very good. 
We need to update your vulnerable software to reduce the risk of reinfection.
 
STEP 1
 Update Outdated Software
Outdated software contain security risks that must be patched. Please download and install the latest version of the programmes below.

•  Adobe Air
•  Adobe Reader (uncheck the "Optional Offer")
•  Java (watch out for "Optional Offers" or bundled software)
•  Follow these instructions to check for and download the latest Windows Updates.
   

STEP 2
 Remove Outdated Software

• Press the Windows Key  + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall one at a time.
• Note: The programmes below may not be present. If this is the case, please skip to the next step.
  • Adobe Reader X (10.1.9) MUI
  • Java 7 Update 13
  • JavaFX 2.1.1
• Follow the prompts, and reboot if necessary.
   

STEP 3
 Disable Java in Your Browser
Due to frequent exploits we recommend you disable Java in your browser.
For information on Java vulnerabilities, please read the following article (point #7).

• Click the Windows Start Button  and type Java Control Panel (or javacpl) in the search bar. 
• Click on the Java Control Panel. Once opened, click the Security tab.
• Deselect the check box for Enable Java content in the browser. This will disable the Java plug-in in the browser. 
• Click Apply. When the  Windows User Account Control (UAC) appears, allow permissions to make the changes. 
• Click OK in the Java Plug-in confirmation window.
• Restart your browser(s) for changes to take effect.
• More information can be found here and here.
   

STEP 4
 Security Check

• Please download SecurityCheck and save the file to your Desktop.
• Double-click SecurityCheck.exe and follow the onscreen instructions inside the black box.
• A log (checkup.txt) will automatically open on your Desktop.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 5
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• checkup.txt
• How is your computer performing? Are there any outstanding issues?

[LiquidTension]

Hello, 

 

Do you still require assistance?

[Alltraxjim]

I appreciate your patience so much on this. I won't be as busy for the next few days so I can continue on a faster pace with any instructions you provide. I will work thru the items you asked me to perform on Friday and send you that checkup.txt. The computer does seem to be working fine although I've not used it any since Friday.

[LiquidTension]

No problem at all.

We are almost finished in any case.

[Alltraxjim]

Here is the checkup.txt copy & paste.

Everything seems to be working fine.

 

 Results of screen317's Security Check version 0.99.89  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

AVG Internet Security 2013   

 Antivirus up to date!   

`````````Anti-malware/Other Utilities Check:````````` 

 Java 8 Update 25  

 Java version out of Date! 

 Adobe Flash Player 15.0.0.152  

 Adobe Reader XI  

 Google Chrome 38.0.2125.104  

 Google Chrome 38.0.2125.111  

````````Process Check: objlist.exe by Laurent````````  

 AVG avgwdsvc.exe 

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0% 

````````````````````End of Log`````````````````````` 

[LiquidTension]

Great!
Now for the good news. 
 
All Clean!
Congratulations, your computer appears clean!
I no longer see signs of malware on your computer, and feel satisfied that our work here is done. The steps below will remove the tools we have used, and reset any settings changed. I have also provided a list of resources and tools that you may find useful. 
 
My help will always be free. But if you are happy with the help provided, and would like to support my fight against malware and/or buy me a beer, please consider a donation. 
 
 
STEP 1
 ComboFix Uninstall

• Press the Windows Key + r on your keyboard at the same time. Type the following text into the Run box:

  ComboFix /Uninstall

• Click OK.
• Note: It may appear as if Combofix is installing. This is not the case; the programme is uninstalling. Please do not interrupt the process.
   

STEP 2
 DelFix

• Please download DelFix and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  • Reset system settings
• Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
 
======================================================
 
I have compiled below a list of resources you may find useful. The articles document information on computer security, common infection vectors and how you can stay safe on the Internet.

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP
   

The following programmes come highly recommended in the security community.

•  AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), preventing your files from being encrypted.
•  Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
•  Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
•  NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
•  Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
•  Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
•  SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
•  Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

-- Please feel free to ask if you have any questions or concerns on computer security or the programmes above.
 
======================================================
 
Please confirm you have no outstanding issues, and are happy with the state of your computer. Once I have confirmation things are in order, we can wrap things up and I will close this thread. 
 
Thank you for using Malwarebytes.
 
Safe Surfing.
Adam (LiquidTension).

[Alltraxjim]

Once again, I appreciate the help very much. Everything is working fine and I believe I'm all set if you wanted to close this up.

 

Alltraxjim

[LiquidTension]

Excellent. I'm very glad to hear.

 

I have marked this topic as solved.

 

All the best,

Adam