SysWOW64 problems

[gotaprob]

Scheduled scan on Oct 24 kept starting and stopping, manuel scan ran  ..no threats detected

Scanned Oct 25 @ 12:54 pm no threat detected  another scan ran @ 11pm and detected Trojan.

Trojan was in quarantine and removed

However, continuously receiving malicious website blocked messages....from several domains and some unnamed, all outbound,  mostly sysWOW64dllhost.exe and svchost.exe

Usually CPU almost maxed out

Popups whether online or off and also when internet access is disconnected from pc so know bug is there

Pc is very slow and has little quirks such as mouse jumpy

Please help,

 

Farbar results attached

 

 

 

FRST.txt

Addition.txt

[MrCharlie]

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.

Run FRST.exe/FRST64.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

============================

Then...........

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

http://www.bleepingcomputer.com/download/combofix/dl/12/ <---ComboFix direct download

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

 

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[gotaprob]

fixlog attached

 

P.S. Thank you for your help

 

Will send others asap

Fixlog.txt

[gotaprob]

combofix file attached

 

sorry not earlier but had company  and just completed

ComboFix.txt

[gotaprob]

Forgot to mention...no popups notices since combofix ran, I was receiving many hundreds a day since the 25th.....  have not uninstalled Combofix  yet as I knew you would need to see log first to check for lingering problems ...everything seems to be working

 

Log is attached in previous reply

[MrCharlie]

Good.....if there's no other problems:

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• Do Not Attach It!!!

MrC

[gotaprob]

For some reason it will not let me copy and paste results here..tried both with notepad and then copied and pasted to Word but neither will  do it

 

    am typing results

 

Results of screen317's security check version 0.99.89

Windows 7 service pack 1x64 (UAC is enabled)

Internet Explorer 11

................ Anti Virus Firewall Check .................

Windows Firewall Enabled!

Microsoft Security Essentials

Antivirus up to date!

................Anti-malware/Other utilities check.................

Adobe Flash Player 15.0.0.152

Adobe Reader XI

Google Chrome 38.0.2125.104

Google Chrome 38.0.2125.111

Google Chrome Plug-ins....

..............Processes Check: objlist.exe by Laurent........

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbam.exe

Malwarebytes Anti-Malware mbamscheduler.exe

...............System Health check ............

Total fragmentation on Drive C:  1%

...............End of Log...................

 

This is what was on log

[MrCharlie]

That looks OK.......

A little clean up to do....

Please Uninstall ComboFix: (------->if you used it<-------)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter. (it may look like CF is re-installing but it's not)

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:

If you used FRST and can't delete the quarantine folder:

Download the fixlist.txt to the same folder as FRST.exe.

Run FRST.exe and click Fix only once and wait

That will delete the quarantine folder created by FRST.

The rest you can manually delete.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[gotaprob]

All is well...thank you!!!! posted message on your profile and a thank you gift.

[MrCharlie]

OK...Take Care MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!