Need help removing fffsee.com

[Doshipal]

Hi, My computer was running slow for past few days. The Taskmanager had several instance of dllhost.exe running. McAffee scan did not catch anything so I download Malwarebyte. It has quarantined some virus. Restarted the computer. Now It is blocking dllhost.exe almost continuously. Please help remove the problem. I am running Windows 7 64 bit.

 

Thank you,

 

[Naathim]

My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat

Before we start please note the following:

• Analysis and research take some time, also sometimes real life gets in the way, please be patient.
• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Paste the logs in your posts, attachments make my work harder and more complicated.
• Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Let's start and enjoy the fight!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

---

Scan with Malwarebytes' Anti-Malware

Please download and install Malwarebytes Anti-Malware, or re-run it if you already have it installed.

• First of all select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

There will be two versions to download: 32-bit and 64-bit. Please download the one that is designed for your system. If you don't know which one should it be, download both of them and try each other out. Only one will run - this is the right one. Please leave it and delete the other.

• Right-click on icon and select Run as Administrator to start the tool.

  > XP users click run after receipt of Windows Security Warning - Open File.

  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.

• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

 

[Doshipal]

Hi Naat,

I have run the malwarebyte scan and the Farbar Recovery Scan. Attached are the log files. Please let me know further instructions.

Thanks,

Mahesh

Malwarebytes Scan Log Oct 30.txt

FRST.txt

Addition.txt

[Naathim]

Hi

Yup, we have some work to do here. First the bad guy with a sledgehammer, remnants after.



Scan with ComboFix

This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!

Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.
If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.
Don't forget to re-enable your previously switched-off protection software!

[Doshipal]

Hi Naat,

 

I have run the Combofix. Please see the attached log file.

 

I forgot to mention that I have 3 external drives which I have disconnected from the computer 2 days ago (before running any scans). Will it cause a problem when connected?

 

Please let me know the next step.

 

Thanks

Mahesh

ComboFix.txt

[Naathim]

Some more work to be done with that tool.

Fix with ComboFix

Let's prepare a Script for ComboFix to mark some things for being deleted.

• Press the + R on your keyboard at the same time.
• A Run window should appear in the lower left corner. Type in notepad.exe and press Enter.
• In the shown window paste in the following script:

  Domains::File::c:\users\MD\AppData\Roaming\wrieh.dllDDS::uInternet Settings,ProxyOverride = *.local

• Go to File menu and select Save as.
• Make sure that the Save as type option is set to Text files (*.txt) and the place to save will be your desktop.
• Name the file CFScript and select Save.

Your CFScript.txt file should appear on your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Now drag your CFScript file and drop it onto the icon:

  

• This will start ComboFix. Let it run uninterrupted!
• A reboot may be needed during this run. Allow it.
• When finished, it shall produce a log for you at C:\ComboFix.txt and display it.

Please include that log in your next reply.

If you'll encounter any issues with internet connection after running ComboFix, please visit this link.

If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

Do not forget to turn on your previously switched-off protection software!

[Doshipal]

Hi Naat,

 

I ran the Combofix again with the script I copied from your message. Attached is the log file.

 

Let me know my next step.

 

Thanks,

Mahesh

ComboFix (2).txt

[Naathim]

Another one round.

Fix with ComboFix

Let's prepare a Script for ComboFix to mark some things for being deleted.

• Press the + R on your keyboard at the same time.
• A Run window should appear in the lower left corner. Type in notepad.exe and press Enter.
• In the shown window paste in the following script:

  Folder::c:\users\MD\AppData\Roaming\622b2e3a

• Go to File menu and select Save as.
• Make sure that the Save as type option is set to Text files (*.txt) and the place to save will be your desktop.
• Name the file CFScript and select Save.

Your CFScript.txt file should appear on your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Now drag your CFScript file and drop it onto the icon:

  

• This will start ComboFix. Let it run uninterrupted!
• A reboot may be needed during this run. Allow it.
• When finished, it shall produce a log for you at C:\ComboFix.txt and display it.

Please include that log in your next reply.

If you'll encounter any issues with internet connection after running ComboFix, please visit this link.

If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

Do not forget to turn on your previously switched-off protection software!

[Doshipal]

Hi Naat,

 

I  ran the ComboFix 3rd time with the script provided. Attached is the log file.

 

Please let me know what else need to be done.

 

Thanks,
Mahesh

ComboFix (3).txt

[Naathim]

Now please post me fresh FRST logs. Make sure the Addition option is checked before pressing Scan.

[Doshipal]

Hi Naat,

 

Attached is the first and addition log.

 

Thanks,

Mahesh

FRST.txt

Addition.txt

[Naathim]

Uninstall Glarysoft, this software is dubious and not recommended. Beside of that it is damaged.

Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and let this process run uninterrupted.
• This scan can take a while, depending on your System specs.
• Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.

Do not forget to re-enable your previously switched off protection software!

Please also manually reboot your machine after this procedure.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• The program will begin to update the database (if internet connection is operational). Please wait a little bit.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please include the contents of that file in your reply.

[Doshipal]

Hi Naat,

 

I ran both junkware removal and adware cleaner tools. Attached are the log files.

 

Please let me know the next step.

 

Thanks,

Mahesh

JRT.txt

AdwCleanerS0.txt

[Doshipal]

Naat,

I also removed the Glary utility as per your instructions.

Mahesh

[Naathim]

That was pretty much junk.


Let me see where are we and please inform me how is your machine at the moment



Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

[Doshipal]

Hi Naat,

 

The PC is running well. No popups, CPU and Memory usage is normal. I am able to do things.

 

Attached is the new log files.

 

Let me know if I need to do anything else.

 

Thanks,
Mahesh

Addition.txt

FRST.txt

[Naathim]

Hello

I am sorry for a little delay, I had a very hectic family Sunday.



Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;{429FCEA7-30EC-4DA4-88A8-42CA47BA3958};cemptyclsid;emptyfolderscheck;deleteC:\Program Files (x86)\Glary Utilities 3;fsProcObsrv;sC:\Users\MD\Downloads\Glary_Utilities_v5.9.0.16.exe;fautoclean;C:\Users\MD\AppData\Roaming\GlarySoft;fsC:\ProgramData\GlarySoft;fsC:\Users\MD\AppData\Roaming\rfdplr.dll;fC:\Windows\System32\Tasks\{DFCDFECE-5A2B-9DC2-4E5C-E1DB0E6BDE5C};f{3BC54003-5801-4E91-B7F5-F3BF5CD0DC8F};cC:\ProgramData\TEMP;fsmd C:\ProgramData\TEMP >>%temp%\log.txt;b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.
Don't forget to re-enable your switched-off protection software!

[Doshipal]

Hi Naat,

 

I ran the Zoek with the script you provided. Attach is it's log.

 

Please let me know the next step. Also I am wondering if it will be okay when I plug in the external drives.

 

Thanks,
Mahesh

zoek-results.txt

[Naathim]

Fine, now some general scans.



Scan with Malwarebytes' Anti-Malware

Please re-run Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.



Scan with ESET Online Scanner

This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
Please visit ESET Online Scanner website.
Click there Run ESET Online Scanner.

If using Internet Explorer:

• Accept the Terms of Use and click Start.
• Allow the running of add-on.

If using Mozilla Firefox or Google Chrome:

• Download esetsmartinstaller_enu.exe that you'll be given link to.
• Double click esetsmartinstaller_enu.exe.
• Allow the Terms of Use and click Start.

To perform the scan:

• Make sure that Enable detecion of potentially unwanted applications is checked.
• In the Advanced Settings dropdown menu:
  • Make sure that Remove found threats is unchecked.
  • Scan archives is checked.
  • Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.
  • Use custom proxy settings is unchecked.
• Click Start
• The program will begin to download it's virus database. The speed may vary depending on your Internet connection.
• When completed, the program will begin to scan. This may take several hours. Please, be patient.
• Do not do anything on your machine as it may interrupt the scan.
• When the scan is done, click Finish.
• A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.

Please include this logfile in your next reply.
Don't forget to re-enable previously switched-off protection software!



Scan with Security Check

Please download Security Check by Screen317 and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow onscreen instructions inside the black box. This scan won't take long.
• Soon a notepad document called checkup.txt will open automaticaly.

Please include the content of that document.

[Doshipal]

Hi Naat,

 

I ran all 3 Scanners as per your instructions. Attached are the log files.

 

Thanks,
Mahesh

Malwarebytes Scan Log Nov 4.txt

log ESET.txt

checkup.txt

[Naathim]

OK, now a little cleanup for my mess



Clean with DelFix

Please download DelFix by Xplode and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Ensure that Remove disinfection tools, Purge system restore and Reset system settings are checked.
• Push Run.
• When finished, it will display a notepad report.

Include it for my review.
Please also manually reboot your machine after posting your logfile.

[Doshipal]

Hi Naat,

 

Attached is the report of DelFix.

 

Thanks,

Mahesh

DelFix.txt

[Naathim]

Hello

Below you will find my thoughts about securing your machine. Go ahead through it, you will benefit from some useful advice about safe computing.

Recommended reading:

MUST READ - security tips: Computer Security - a short guide to staying safer online.

MUST READ - general maintenance: What to do if your Computer is running slowly?

Recommended additional software:

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

CryptoPrevent - to secure yourself from very severe CryptoLocker infection.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

My help is always free, but if you are happy with the help provided and wish to help my fight against malware, please consider making a donation.

All donations are to refund a new HDD to replace the old one, which recently passed away!

Now if you have any other questions, feel free to ask me. Otherwise simply acknowledge my recommendations and this topic will be closed.

Stay safe,

Naat

[Doshipal]

Hi Naat,

 

Thank you very much for all your help. I am adding the additional software you recommended.

 

Mahesh

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!