BSOD and Inbound svchost.exe

[tomalhossain]

Hi I'm running a Lenovo W530, Intel i7-3740QM, 2.7 GHz, 8.00 GB ram, and 64-bit operating system.

 

As a newbie to the world of software downloads, I torrented a bunch of audio production software recently which has unsurprisingly led to my laptop behaving rather weirdly at times though still fully functional. I have uninstalled the software I pirated and also removed bit-torrent from my computer, so I believe I am torrent free ( please correct me if I'm wrong) - the other music software on my laptop is KeyServed software provided by my college. I regret having pirated and will refrain from doing so in the future.

 

About a week ago I restarted my computer in order to finalize the installation of the Media Transfer Protocol Porting Kit so that I could transfer files from my phone. My laptop took an unusually long time on the shut-down screen (about 2 mins, when it usually is instantaneous.) After starting up, the Blue Screen of Death appeared for a split-second before moving onto the log in screen, so I was not able to catch what the issue was. Upon starting up, my desktop was black for about 1/2 min (once again odd because usually start-up is instantaneous), before the desktop appeared and the initial applications started up. Curious to read the BSOD message, I restarted the computer again (once again took long to shut down), but once again the message only appeared for quick moment. After 1/2 of black screen, once again the desktop appeared, and curious dialogue box entitled "Windows Explorer" (not the internet browser) read that I needed to restart my system w/ a "yes" or "no" option. I thought it was weird to be receiving this message considering that I had just restarted the computer twice, but I thought I might as well specifically click on it anyway. This time, the computer shut down normally, and the BSOD did not appear at all. However the screen was black for 1/2 again before the initial apps could start up and mid-way through loading said apps, my laptop froze for the first time that I've had it (about 5 months.) I manually shut down the computer (holding down the power button) and boot into safe mode w/out networking. I tried scanning the computer using Malwarebytes but there were no hits.

 

The next morning after starting up my computer, everything seemed to magically be back to normal, though that obviously can't be the case. I researched into System Restore options and realized that all my system restore points aside a single most recent one (which I believe to be insignificant and not when the Malware entered my PC) were missing.

 

A few days ago, I began receiving messages every dozen minutes or so from Malwarebytes stating the following -

 

Malicious Website Blocked

IP: 80.82.70.104

Port: 53

Type: Inbound

Process: C:\Windows\System32\svchost.exe

 

At this point, I am rather at a loss as to where to even begin troubleshooting. Thank you very very much in advance for any assistance whatsoever!

 

FRST.txt

Addition.txt

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 
Download Malwarebytes Anti-Rootkit to your desktop.

• Double-click the icon to start the tool.
• It will ask you where to extract it, then it will start.
• Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
• Click in the introduction screen "next" to continue.
• Click in the following screen "Update" to obtain the latest malware definitions.
• Once the update is complete select "Next" and click "Scan".
• When the scan is finished and no malware has been found select "Exit".
• If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
• Open the MBAR folder and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"

 

 

 

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[tomalhossain]

So upon downloading the Malwarebytes Anti-Rootkit software, a dialogue box opened up asking if I'd like to remove a probable root-kit detection right off the bat (which I agreed to.) Afterwards, in order to begin the standard scan, the software asked my to temporarily exit Malwarebytes Anti-Malware. After doing so, the Anti-Rootkit scan detected no malware, so I simply exited the application. As of yesterday, my free trial for the premium Malwarebytes ended so I no longer have Real-Time Protection (so I'm not sure if I would still be getting that message I was getting 2 days ago indicating Malicious Website Activity, i.e. inbound svchost.exe) 

 

I've attached the mbar-log, system-log, and frst & addition once more. 

 

Thanks!

mbar-log-2015-01-27 (00-19-48).txt

system-log.txt

Addition.txt

FRST.txt

[Naathim]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!