multiple dllhost, dplaysvr, fixmapi, NAPSTAT

[dansky9]

Hello, and thank you in advance for any help with this. 

 

I am writing about my in-laws' computer, and hoping you can help them in the same way Valinorum helped me with my own PC a few months ago.

 

In Windows Task Manager, there are multiple instances of dllhost.exe ("Com Surrogate"), fixmapi.exe ("FIXMAPI 1.0 MAPI Repair Tool"), dplaysvr.exe ("Microsoft DirectPlay helper"), dpnsvr.exe ("Microsoft DirectPlay8 server"), and NAPSTAT.exe ("Network Access Protection Client UI").  They are force-killable by me manually, but they return very quickly.

 

Internet Explorer security level silently sets itself to "Custom", and even after I set it back to "Medium-High", within a few moments it will have gone back to "Custom".

 

C:\Users\Owner\AppData\Local\Temp\ directory is constantly filling itself with MB of randomly named folders, several per minute.  And internet access is extremely slow.

 

The computer runs AVIRA anti-virus, but it is not effective against this.  Malwarebytes free version finds things and quarantines them, but they return very quickly after.

 

The OS is 64-bit Windows Professional.  I ran FRST64 as instructed on the help forum main page.  The "FRST" scan file, and the "Addition" file are attached.  (If you also need the "Shortcut" file contents, I can provide.)

 

Thank you!

 

Sincerely,

dansky9

 

Addition.txt

FRST.txt

[kevinf80]

Hello and welome,

 

P2P/Piracy Warning:

 

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

 

Next,

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

 

 

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

 

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

 

 

In most cases, a restart will be required.

 

 

Wait for the prompt to restart the computer to appear, then click on Yes.

 

 

When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to  your reply.

 

Or select "Export" you are given the option to export as a Text file (*.txt) or XML file (*.xml) Choose text file, save the exported file to a place of your choice. That file can be attached to your reply...

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Let me see those logs, also give an update on any remaining issues or concerns...

 

Thanks,

 

Kevin...

 

 

 

 

 

 

 

Fixlist.txt

[dansky9]

^{Thank you very much for your reply -- it appears we are successful, but still with one lingering question...}

 

^{"Fixlog" (from FRST using your "fixlist" file), "AdwCleaner[s0].txt" from AdwCleaner, "JRT,txt" from JRT and "mrt.txt" for Microsoft 64-bit Malicious Software Removal Tool are all attached here for your review, as requested.}

 

^{I was not able to open/view/attach the log file from MBAM scan, perhaps because I have the free version and not the premium version (?), but the results of that scan were "no issues found".}

 

^{At this point, over the last 12 hours, we no longer see any suspicious dllhost, fixmapi, etc processes running in the Task Manager -- i.e., none of the processes I identified in the original post.  This is GOOD!}

 

^{One thing I do want to mention is that Internet Explorer still seems a bit slow to load webpages, and in Task Manager it appears to be using ~200MB of RAM per Explorer tab-- which seems very high, and I wonder if it's related to the apparent slow performance?  We see it hogging RAM like this even for very simple pages, like the google search splash page -- i.e., not only on webpages heavy with content and scripting (such as yahoo).}

 

^{So, while the processes that were visible in Task Manager are now no longer there, I'm wondering whether we've still got something burrowed deeper into Internet Explorer.  When I run IE on other laptops connected to this same home network, they do not hog RAM like I have described here for this desktop PC that you have helped me with.}

 

^{Is there anything else you recommend that I try?}

 

^{Thank you very much.}

 

^Sincerely,

^dansky9

 

Fixlog.txt

AdwCleanerS0.txt

JRT.txt

mrt.log

[kevinf80]

Malwarebytes always produces a log after a scan has been run, regardless of whether Premium or Free version is installed..

 

Go here: http://support.microsoft.com/kb/923737 follow the instructions and reset Internet Explorer settings, does that help?

 

Next,

 

We still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin.

 

(To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART  Installer during the process)

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 

• 
  

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats"  is UNticked
Click on Advanced Settings, ensure the following options are checked:
 
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
 
Select "Change" next to Current scan targets A new window will open, select any extra drives, Flash drives etc as required.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

 

When the scan is complete

 

• 
  

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

 

If threats were found

 

• 
  

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

 

close program

 

Copy and paste the report in next reply. also let me know if any remaining issues or concerns...

 

Thanks,

 

Kevin..

[dansky9]

Kevin --

 

Thank you for your reply.  I have run ESET as you instructed, and the result was >250 threats found.  The "ESET SCAN" results log file is attached here.

 

I also reset all the IE settings, as you recommended.  It seems to have helped a little - Internet Explorer runs a little faster now and takes only ~90MB RAM per instance, instead of >200MB as was the case before.

 

What is the next step?

 

Thank you very much,

dansky9

 

ESET SCAN.txt

[kevinf80]

Run ESET as you did previously, this time make sure that the option "Remove found threats"  is Ticked

 

Post that log, let me know if any remaining issues or concerns...

[dansky9]

Kevin,

 

ESET found and removed several threats, the log file is attached here for your review.

 

Thanks,

dansky9

 

ESET SCAN 2.txt

[kevinf80]

What is the current status of the system, are there any remaining issues or concerns

[dansky9]

Kevin,

 

I ran ESET scan a few more times, and it kept finding the many "how_decrypt" files in various directories.  With a little research, I learned these are associated with ransomware that encrypts personal files and demands $500 to get the decryption key.  So far, we have not had this problem with files being encrypted. 

 

So, I found and manually deleted all the "how_decrypt" files everywhere on all drives and ran ESET again -- this time, it found no threats, so I selected "uninstall upon close".  Then I ran a complete scan with MBAM, and it found no threats.

 

Now, Internet Explorer is running again at the expected typical speeds -- not buggy or laggy, like before.  (Even though it still occupies >200MB RAM per instance, which I guess must just be typical for this machine.)

 

I think we're finished successfully -- THANK YOU VERY MUCH!!

 

Are there any final clean-up steps to the process?

 

Regards,

dansky9

[kevinf80]

Yes to complete....

 

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version of Java components and upgrade the application.

 

Upgrading Java:

 

Go to http://java.com/en/ and click on "Do I have Java"

It will check your current version and then offer to update to the latest version

Watch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it.

 

***Note: Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if so - remove them. <<-- Very Important

 

Next,

 

Download "Delfix by Xplode" and save it to your desktop.

 

Or use the following if first link is down:

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

 

• 
  

    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:

 

C:\Windows\ERUNT

 

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

 

Any remnant files/logs from tools we have used can be deleted…

 

Next,

 

Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

Let me know if we are ok to close out....

 

Thank you,

 

Kevin...

[dansky9]

We are GOOD!!  Thank you very much, Kevin.

 

Regards,

dansky9

[kevinf80]

Excellent, good to hear all is well again.

 

Take care and surf safe,

 

Kevin....

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!