sppextcomobjhook.dll problem

[memesadboy]

i have this sppextcomobjhook.dll and sppextcomobj (had sppextcomobj patcher but i deleted it once and never reappeared ) 

i don't even know if it's a malware but i read everywhere that it is 

but what got me thinking its a malware is that when i did a scan for malwares it always says that windows skipped them during the scan 

so if this is a malware i want to know how to remove it definitely 

thanks

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download Malwarebytes Anti-Malware from here
 

• Right-click on the MBAM icon and select Run as administrator to run the tool.
• Click Yes to accept any security warnings that may appear.
• Once the MBAM dashboard opens, on the right detail pane click on the word "Current" under the Scan Status to update the tool database.
• On the left menu pane click the Settings tab, and then select the Protection tab on the top.
• Under the Scan Options, turn on the button Scan for rootkits and Scan within archives.
• Click the Scan tab on the right detail pane, select Threat Scan and click the Start Scan button
• Note: The scan may take some time to finish, so please be patient.
• If potential threats are detected, ensure to checkmark all the listed items, and click the Quarantine Selected button.
• While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
• The log can also be viewed by clicking the log to select it, then clicking the View Report button.
  

Please post the log for my review.

Note: If asked to restart the computer, please do so immediately.
===

Please download AdwCleaner by Xplode onto your Desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Click the LogFile button and the report will open in Notepad.
  

IMPORTANT

• If you click the Clean button all items listed in the report will be removed.
  

If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Check off the element(s) you wish to keep.
• Click on the Clean button follow the prompts.
• A log file will automatically open after the scan has finished.
• Please post the content of that log file with your next answer.
• You can find the log file at C:\AdwCleanerCx.txt (x is a number).
  

===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

Let me know what problems persists.

Wait for further instructions
==============================

 

[memesadboy]

Hey thanks for the response 

this is the Malwarebytes txt file : mbam.txt

this is adwcleaner txt files : AdwCleaner[C00].txt         and           AdwCleaner[S00].txt

and this is the FRST txt files : FRST.txt             and              Addition.txt

[nasdaq]

Hi,
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.

Let me know of any issues with this computer.

fixlist.txt

[memesadboy]

4 hours ago, nasdaq said:

 

here's the file :  Fixlog.txt 

well this pc became extremely laggy when i open it , it takes a long time  loading and everything became sluggish overtime

[nasdaq]

Hi,

--RogueKiller--

• Download & SAVE to your Desktop Download RogueKiller
• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or above, right-click the program file and select "Run as Administrator"
• Accept the user agreements.
• Execute the scan and wait until it has finished.
• If a Windows opens to explain what [PUM's] are, read about it.
• Click the RoguKiller icon on your taksbar to return to the report.
• Click open the Report
• Click Export TXT button
• Save the file as ReportRogue.txt
• Click the Remove button to delete the items in RED  
• Click Finish and close the program.
• Locate the ReportRogue.txt file on your Desktop and copy/paste the contents in your next.
  

=======

We will check your BIOS and Master boot record.

Read carefully and follow these steps.
TDSS

• Download TDSSKiller and save it to your Desktop.
• Doubleclick on TDSSKiller.exe to run the application.
• Then click on Start Scan.
• If a suspicious file is detected, the default action will be Skip, click on Continue.

• If an infected file is detected, the default action will be Cure, click on Continue.
  

• Important: Do NOT change the default action on your own unless instructed by a malware Helper! Doing so may render your computer unbootable.
  

• It may ask you to reboot the computer to complete the process. Click on Reboot Now.

• If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  

• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

===

Download http://public.avast.com/~gmerek/aswMBR.exe (aswMBR.exe) to your desktop. Double click the aswMBR.exe to run it.

• Click the "Scan" button to start scan.
• Upon completion of the scan, click Save log, and save it to your desktop. (Note - do not select any Fix at this time) <- IMPORTANT
• Please paste the contents of that log in your next reply.
  

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.
===

Wait for further instructions.

[memesadboy]

Hey

here's the TDSSkiller :    TDSSKiller.txt

and the roguekiller  :  ReportRogue.txt

but i can't give you the aswMBR one because i ran it twice and windows encountered a problem and restarted twice by itself 

 

[nasdaq]

Hi,

Remove these items with the TDSSKiller tool.

15:55:48.0845 11080  Suspicious service (Hidden): TrueSight

15:55:48.0882 11080  [ 0D5A09B08568760AE85A801FCBC0F83D ] TrueSight       C:\Windows\System32\drivers\TrueSight.sys
15:55:48.0882 11080  TrueSight ( HiddenService.Multi.Generic ) - warning
15:55:48.0882 11080  TrueSight - detected HiddenService.Multi.Generic (1)

Restart the computer normally.

Let me know what problem persists.

[memesadboy]

i don't know how but i guess you meant rescan and delete whats detected 

i rescanned but it didn't detect anything this time 

 

[nasdaq]

Has your issue been solved?

[memesadboy]

well the "sppex" stuff is still here and pc still slow

 

[memesadboy]

no *

 

[nasdaq]

Hi,

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

If the problem persists let look in  the registry.

Farbar Recovery Scan Tool (FRST) - Registry Search
Follow the instructions below to download and execute a Registry search on your system with FRST, and provide the log in your next reply.

• Right-click on the executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• Accept the disclaimer by clicking on Yes, and FRST will then do a back-up of your Registry which should take a few seconds;
• In the Search text area, copy and paste the following:
  

SppExtComObj

• Once done, click on the Search Registry button and wait for FRST to finish the search;
  

• On completion, a log will open in Notepad. Copy and paste its content in your next reply;
  

[memesadboy]

hey 

did you forget to give me the  Fixlist.txt or i just don't get what to download if so can you explain again sorry

[nasdaq]

Hi,

Sorry, I sure did.

Here it is.

 

fixlist.txt

[memesadboy]

hey

here's the fixlog : Fixlog.txt

the sppextcomobj stuff is still there so here's the searchreg : SearchReg.txt

[memesadboy]

i still need help btw

 

[nasdaq]

Hi,
Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

fixlist.txt

[memesadboy]

omg after the restart my pc took 5 minutes to load the screen i don't get it 

here's the fixlog : Fixlog.txt

btw can you tell where the virus came from ?

Edited August 31, 2018 by memesadboy

[nasdaq]

Hi,

It's impossible to find out how you got infected or where it comes from.

Restart the computer normally.

If the problem persists run this tool.

--RogueKiller--

• Download & SAVE to your Desktop Download RogueKiller
• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or above, right-click the program file and select "Run as Administrator"
• Accept the user agreements.
• Execute the scan and wait until it has finished.
• If a Windows opens to explain what [PUM's] are, read about it.
• Click the RoguKiller icon on your taksbar to return to the report.
• Click open the Report
• Click Export TXT button
• Save the file as ReportRogue.txt
• Click the Remove button to delete the items in RED  
• Click Finish and close the program.
• Locate the ReportRogue.txt file on your Desktop and copy/paste the contents in your next.
  

=======

[memesadboy]

it got slower , btw i only got these do i delete them ? : 

heres the file : roguekiller.txt

[memesadboy]

btw i don't know if this is related but when i open up the pc and its super slow the disk in the task manager is 100% (antimalware service executable is the one filliing it) 

[nasdaq]

Yes run the RogueKiller and fix them.

They should be set to the default by the program.

Keep me posted.

 

 

 

[memesadboy]

hey i deleted them but nothing changed , i think it got a little slower actually 

i can delete the dll one but the app it says something along the lines of only trustedinstaller can touch that 

[nasdaq]

Hi,

Lets reset these settings.

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Any change?

 

fixlist.txt