Malwarebytes scan shows 19 threats. Need Help ASAP

Vorridor · June 23, 2016

I'm sort of lost as far as what to do. I've read a few other post's on a few of these issues but all are different. So I ask here for help as I don't want to kill my old computer.

Malwarebytes Anti-Malware.lnk scan.txt

Vorridor · June 23, 2016

Sorry, the first txt doc is not showing anything, so here is a slightly older scan.

Malwarebytes Anti-Malware.lnk scan-1.txt

kevinf80 · June 24, 2016

Hello and welcome to Malwarebytes,

My screen name is kevinf80, i`m here to help clean up your system, continue as follows please:

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

user posted image

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. user posted image

Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

user posted image

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. user posted image

Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

user posted image

Internet Explorer - Click the Tools menu in the upper right-corner of the browser. user posted image

Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Change default download folder location in Edge -Boot to a user account with admin status, select start > file explorer > right click on "Downloads" folder and select "Properties"

In the new window select "Location" tab > clear the text field box and type in or copy/paste %userprofile%\Desktop > select "Apply" then "OK"

Be aware you are not changing the Browser download folder location, you are changing the user’s download directory location.....

Next,

Follow the instructions in the following link to show hidden files:

http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/

Next,

Download RKill from here: http://www.bleepingcomputer.com/download/rkill/

There are three buttons to choose from with different names on, select the first one and save it to your desktop.

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7/8/10, right-click on it and Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
If the tool does not run from any of the links provided, please let me know.

Next,

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete Apply Actions to any found entries.
Wait for the prompt to restart the computer to appear (if applicable), then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:
Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
Make sure Addition.txt is checkmarked under "Optional scans"
Press Scan button to run the tool....
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The tool will also make a log named (Addition.txt) Please attach those logs to your reply.

Let me see those logs in your reply...

Thank you,

Kevin...

Vorridor · June 24, 2016

Two nights ago I did the malwarebytes scan and I let it delete all threats. Upon reboot, I let the system settle at the desktop and it popped up a window that said:

"couldn't find dllhost.exe. Make sure you typed the name correctly and try again".

It kept showing this error so I did a system restore, it obviously restored the threats also, and the system had no change.

I have Malwarebytes re'installed and did a fresh scan, it showed the same 19 results. So I removed close to 100 gb of my personal data last night. I let it delete all of the orange highlighted threats, and kept the red ones that entail something about the dll's. The system is much snappier now, but I'm all too sure the problem still exists.

I will proceed with your steps tonight, as I'm away from my computer today. I do apologize for going ahead of you & myself and deleting the orange files, if it makes any difference, I can do another restore to bring back the said files. I will continue on with your steps until notified otherwise, if you should think I need to restore the said files, please alert me asap.

Direct contact is fine if you have hangouts on pc or Hangouts app on android.

Hangouts id: L Kaan

kevinf80 · June 24, 2016

Thanks for the update, run the scans i`ve requested and post the produced logs...

Thank you,

Kevin...

Vorridor · June 24, 2016

Here is the first log from rKill.

Rkill 2.8.4 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

More Information about Rkill can be found at this link:

http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 06/25/2016 01:53:28 PM in x86 mode.

Windows Version: Windows Vista (TM) Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* Cannot edit the HOSTS file.

* Permissions Fixed. Administrators can now edit the HOSTS file.

* HOSTS file entries found:

94.63.240.164 www.bing.com

Program finished at: 06/25/2016 01:55:09 PM

Execution time: 0 hours(s), 1 minute(s), and 41 seconds(s)

Rkill.txt

Vorridor · June 24, 2016

Update: When I started up to to the rKill log, it popped up the warning about dllhost.exe not being found again.

One of the threats that was shown in a previous Malwarebytes scan said something about dlhost.dll or .exe

Not sure if this is of any significance, but wanted to toss it in the bucket also.

I will have the next set of logs within a couple hours, I'm babysitter for a bit. Sorry for the delay.

kevinf80 · June 24, 2016

Thanks for the update, post logs whenever you`re ready...

Vorridor · June 24, 2016

Ok I've ran a fresh scan in Malwarebytes and did the removal, it never prompted for a reboot. I exited and re'entered, and it does not show the scan log from today. It does however have 5 items quarantined:

\AppData\Roaming\dlhost.exe

\AppData\Roaming\svhost.exe

\AppData\Local\LHOOTSA

\AppData\Local\LhootSA\bin

\AppData\Local\LhootSA\bin\2.0.7.0

I have noticed about 4 or 5 different svhost.exe's running in services.

Options in Malwarebytes are to Restore, Delete, Delete All.

I will wait to take further action until I receive your input.

Vorridor · June 24, 2016

FRST Logs:

FRST.txt

Addition.txt

kevinf80 · June 25, 2016

Your system is still infected, continue as follows:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Go here: https://www.zemana.com/Download download and install Zemana Anti-malware. Allow a shortcut to be saved to your Desktop.. The tool will be active with a 15 day trial....

Right click on

Zemana Antimalware and select "Run as Administrator"

From the GUI select "Settings"

In the new window Select 1. Updates, when complete Select 2. Real Time Protection.

In the next window make sure 1. all boxes are checkmarked and the action is "Quarantine" and then " 2. Select the home icon.

In the new window select "Scan"

When the scan completes check each found entry (if any). For "Suspicious Browser Settings" choose REPAIR for all other entries choose QUARANTINE then select the "Next" tab

The action complete window will open, from there select the "Back" tab. That will take you back to the home screen...

On that screen select the "Reports" tab. (Looks like 3 chimneys)

On that screen select and highlite the scan details line, then select "Open Report"

Copy and paste that log to your reply...

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on the Scan in the Actions box
Please wait fot the scan to finish..
When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
Click on the Cleaning box.
Next click OK on the "Closing Programs" pop up box.
Click OK on the Information box & again OK to allow the necessary reboot
After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Download Sophos Free Virus Removal Tool and save it to your desktop.

Double click the icon and select Run
Click Next
Select I accept the terms in this license agreement, then click Next twice
Click Install
Click Finish to launch the program
Once the virus database has been updated click Start Scanning
If any threats are found click Details, then View log file... (bottom left hand corner)
Copy and paste the results in your reply
Close the Notepad document, close the Threat Details screen, then click Start cleanup
Click Exit to close the program
If no threats were found please confirm that result....

Let me see those logs, also give an update on any remaining issues or concerns....

Thank you,

Kevin...

Fixlist.txt

Vorridor · June 25, 2016

Fixlog.txt

Vorridor · June 25, 2016

Zemana log 2016.06.26-17.20.20-i0-t92-d1.txt

Vorridor · June 25, 2016

AdwCleaner[C1].txt

Vorridor · June 26, 2016

2016-06-27 00:22:16.385 Sophos Virus Removal Tool version 2.5.5

2016-06-27 00:22:16.385 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2016-06-27 00:22:16.385 Windows version 6.0 SP 1.0 Service Pack 1 build 6001 SM=0x300 PT=0x1 Win32

2016-06-27 00:22:16.386 Checking for updates...

2016-06-27 00:22:27.221 Update progress: proxy server not available

2016-06-27 00:24:00.088 Option all = no

2016-06-27 00:24:00.147 Option recurse = yes

2016-06-27 00:24:00.147 Option archive = no

2016-06-27 00:24:00.147 Option service = yes

2016-06-27 00:24:00.147 Option confirm = yes

2016-06-27 00:24:00.148 Option sxl = yes

2016-06-27 00:24:00.148 Option max-data-age = 35

2016-06-27 00:24:00.148 Option EnableSafeClean = yes

2016-06-27 00:24:03.907 Option vdl-logging = yes

2016-06-27 00:24:04.802 Customer ID: 094260ca9b3af99f9d4a3909fc47a743

2016-06-27 00:24:04.802 Machine ID: 1d629d137ff94cc9aaec9ed9613421f6

2016-06-27 00:24:04.924 Component SVRTcli.exe version 2.5.5

2016-06-27 00:24:04.925 Component control.dll version 2.5.5

2016-06-27 00:24:04.925 Component SVRTservice.exe version 2.5.5

2016-06-27 00:24:04.926 Component engine\osdp.dll version 1.44.1.2250

2016-06-27 00:24:04.926 Component engine\veex.dll version 3.65.0.2250

2016-06-27 00:24:04.927 Component engine\savi.dll version 9.0.1.2250

2016-06-27 00:24:04.954 Component rkdisk.dll version 1.5.30.0

2016-06-27 00:24:05.056 Version info: Product version 2.5.5

2016-06-27 00:24:05.056 Version info: Detection engine 3.65.0

2016-06-27 00:24:05.056 Version info: Detection data 5.26

2016-06-27 00:24:05.056 Version info: Build date 4/5/2016

2016-06-27 00:24:05.056 Version info: Data files added 527

2016-06-27 00:24:05.056 Version info: Last successful update (not yet updated)

2016-06-27 00:25:43.548 Downloading updates...

2016-06-27 00:25:43.674 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0

2016-06-27 00:25:43.674 Update progress: [I49502] Found supplement SAVIW32 LATEST

2016-06-27 00:25:43.674 Update progress: [I49502] Found supplement IDE527 LATEST

2016-06-27 00:25:43.674 Update progress: [I49502] Found supplement IDE528 LATEST

2016-06-27 00:25:43.674 Update progress: [I49502] Found supplement IDE529 LATEST

2016-06-27 00:25:43.674 Update progress: [I49502] Found supplement IDE530 LATEST

2016-06-27 00:25:43.674 Update progress: [I49502] Found supplement IDE531 LATEST

2016-06-27 00:25:43.674 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1

2016-06-27 00:25:43.674 Update progress: [I19463] Syncing product SAVIW32 70

2016-06-27 00:27:07.464 Update progress: [I19463] Syncing product IDE527 142

2016-06-27 00:27:33.169 Installing updates...

2016-06-27 00:28:06.017 Update progress: [I19463] Syncing product IDE528 127

2016-06-27 00:28:06.017 Update progress: [I19463] Syncing product IDE529 135

2016-06-27 00:28:06.018 Update progress: [I19463] Syncing product IDE530 129

2016-06-27 00:28:06.018 Update progress: [I19463] Syncing product IDE531 1

2016-06-27 00:28:37.889 Warning: failed to stop service (1053: The service did not respond to the start or control request in a timely fashion.)

2016-06-27 00:30:22.383 Update successful

2016-06-27 00:31:39.120 Option all = no

2016-06-27 00:31:39.120 Option recurse = yes

2016-06-27 00:31:39.120 Option archive = no

2016-06-27 00:31:39.121 Option service = yes

2016-06-27 00:31:39.121 Option confirm = yes

2016-06-27 00:31:39.121 Option sxl = yes

2016-06-27 00:31:39.125 Option max-data-age = 35

2016-06-27 00:31:39.125 Option EnableSafeClean = yes

2016-06-27 00:31:39.610 Option vdl-logging = yes

2016-06-27 00:31:39.799 Customer ID: 094260ca9b3af99f9d4a3909fc47a743

2016-06-27 00:31:39.800 Machine ID: 1d629d137ff94cc9aaec9ed9613421f6

2016-06-27 00:31:39.892 Component SVRTcli.exe version 2.5.5

2016-06-27 00:31:39.892 Component control.dll version 2.5.5

2016-06-27 00:31:39.892 Component SVRTservice.exe version 2.5.5

2016-06-27 00:31:39.893 Component engine\osdp.dll version 1.44.1.2250

2016-06-27 00:31:39.893 Component engine\veex.dll version 3.65.0.2250

2016-06-27 00:31:39.894 Component engine\savi.dll version 9.0.1.2250

2016-06-27 00:31:39.927 Component rkdisk.dll version 1.5.30.0

2016-06-27 00:31:39.927 Version info: Product version 2.5.5

2016-06-27 00:31:39.930 Version info: Detection engine 3.65.0

2016-06-27 00:31:39.930 Version info: Detection data 5.26

2016-06-27 00:31:39.930 Version info: Build date 4/5/2016

2016-06-27 00:31:39.930 Version info: Data files added 527

2016-06-27 00:31:39.930 Version info: Last successful update 6/26/2016 6:30:22 PM

2016-06-27 00:58:25.192 Could not open C:\System Volume Information\{36c8c69b-3a46-11e6-a64e-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.321 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.321 Could not open C:\System Volume Information\{4986e934-3734-11e6-9173-001a92ebf673}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.321 Could not open C:\System Volume Information\{534fe8ab-34b7-11e6-bcfb-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.322 Could not open C:\System Volume Information\{745502ab-33ff-11e6-b438-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.322 Could not open C:\System Volume Information\{8f538159-39bc-11e6-bf56-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.322 Could not open C:\System Volume Information\{8f53815f-39bc-11e6-bf56-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.322 Could not open C:\System Volume Information\{8f538165-39bc-11e6-bf56-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.322 Could not open C:\System Volume Information\{8f53816b-39bc-11e6-bf56-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.323 Could not open C:\System Volume Information\{8f538171-39bc-11e6-bf56-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.347 Could not open C:\System Volume Information\{a7fbab42-3bf7-11e6-a69e-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.373 Could not open C:\System Volume Information\{b78f8386-3a4c-11e6-b827-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.374 Could not open C:\System Volume Information\{b78f838c-3a4c-11e6-b827-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.396 Could not open C:\System Volume Information\{b78f8398-3a4c-11e6-b827-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.397 Could not open C:\System Volume Information\{b78f839e-3a4c-11e6-b827-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.398 Could not open C:\System Volume Information\{b78f83c5-3a4c-11e6-b827-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.398 Could not open C:\System Volume Information\{e890a5e5-3401-11e6-b9fa-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.399 Could not open C:\System Volume Information\{e890a5ea-3401-11e6-b9fa-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.399 Could not open C:\System Volume Information\{e890a5f0-3401-11e6-b9fa-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 00:58:25.400 Could not open C:\System Volume Information\{fcc4599d-3b0b-11e6-ba36-000272a146a3}{3808876b-c176-4e48-b7ae-04046e6cc752}

2016-06-27 01:09:10.874 >>> Virus 'Mal/Generic-L' found in file C:\Users\Public\Downloads\Reverb files 4-18-2015\PS3\PS3\GTA V.exe

2016-06-27 01:17:06.441 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb

2016-06-27 01:17:06.504 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb

2016-06-27 01:17:31.336 Could not open C:\Windows\System32\config\COMPONENTS

2016-06-27 01:17:32.490 Could not open C:\Windows\System32\config\RegBack\COMPONENTS

2016-06-27 01:17:32.558 Could not open C:\Windows\System32\config\RegBack\DEFAULT

2016-06-27 01:17:32.620 Could not open C:\Windows\System32\config\RegBack\SAM

2016-06-27 01:17:32.624 Could not open C:\Windows\System32\config\RegBack\SECURITY

2016-06-27 01:17:32.661 Could not open C:\Windows\System32\config\RegBack\SOFTWARE

2016-06-27 01:17:32.742 Could not open C:\Windows\System32\config\RegBack\SYSTEM

2016-06-27 01:29:26.993 Could not open C:\Windows\Temp\TMP00000035D04DC6F35959CADB

2016-06-27 01:29:27.074 Could not open C:\Windows\Temp\TMP0000003A1F432BBD7A0DD848

2016-06-27 02:10:09.735 >>> Virus 'Mal/Generic-L' found in file D:\Downloads\PS3\GTA V.exe

2016-06-27 02:11:31.408 The following items will be cleaned up:

2016-06-27 02:11:31.408 Mal/Generic-L

SophosVirusRemovalTool.log

Vorridor · June 26, 2016

Cleanup log