Trojan on svchost.exe

[Teo1906]

Hello all, since yesterday i have a problem on my pc i think i caught a malware. I ran anti malware analys and it is working better but malwarebytes still detect a trojan in

« C:\Windows\SysWOW64\svchost.exe »

i tried everything to delete it without succes please could someone help me out. 

Thanks

Ps: sorry for my english i’m french

[Maurice Naggar]

Hello Teo1906   

I will be helping and guiding you, going forward.

 

The notice message is a notification from the malicious website protection.

The real time web protection is keeping the pc safe.

This message does NOT mean there is a malware.   Please always keep that in mind.

For Your Information:

The website  Block message indicates that a potential risk was blocked by the malicious website protection. 

The Malwarebytes web protection, by default, will always show each IP block occurrence.

The Malwarebytes Webs protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC.

 

See our info page https://www.malwarebytes.com/lp/ip-blocking/?ipblock=true

 

Incoming block notice can be ignored, our software is blocking the threat and there is nothing more that can be done.

On Outbound blocks, any attempted connection was stopped.

 

No action is required unless you’re also experiencing malware symptoms or there are multiple (different) IPs (ex;123.23.34 and 4.44.56).

 

[ # 2 ]

We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.615.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

Thank you.

[Teo1906]

Thanks Maurice for your fast reply, i didn't know about that. In fact the message i showed you on the pic is popping very often (something like every 2-3 minuts).

Here is the zip you asked, thanks for your help.

mbst-grab-results.zip

[Maurice Naggar]

The block notices are just courtesy ones.

You can set the notice display timeout to 3 seconds  ( the minimum)

and also,  set the task tray notices to off.

This can help to reduce the irritation of the displays.

Start Malwarebytes.
Click the Settings button.
Click the Application tab.

Scroll down to the section Notifications.
look at the "Close notifications after:"
and select "after 3 seconds" 

and on the next line on the program screen options,

CLICK to OFF  for "Show Malwarebytes notifications in the Windows System Tray".

Then close Malwarebytes.

These measure hopefully will help a bit  .   I will have more for you very soon.

[Maurice Naggar]

Hello,

The block notices mention the IP address 85.25.119.25

It is not clear ( at this time) what that is.

Lets do this special scan with Malwarebytes and let us see the result.

You will want to close all web browsers, before pressing Scan button.

Run a scan with Malwarebytes.
Start Malwarebytes from the Start menu.

Click Settings. Then click the Protection tab.
Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON
Click it to get it ON

Click the SCAN button.
Select a Threat Scan ( which should be the default).

When the scan phase is done, be real sure you Review and have all detected lines items  ( if any )    check-marked on each line on the left. That too is very critical.

Then click on Quarantine selected.

 

Be sure all items were removed  ( if any are reported).

[Teo1906]

I turned on the scan for rootkits option because it wasn't. Here is the report, there was some threat. Thanks again

Results.txt

[Maurice Naggar]

Thank you for the Malwarebytes scan report.

I wish to bring your attention to the notations

"Aucune action de l'utilisateur"

which means "no action" taken by you to insure each line is ticked

and so that it ( each line) is removed by the program.

You must review each line that is tagged.

Place a check mark on each line that is shown.

Then affirmatively make sure all is removed.

.

To that end, if you click the very top left checkbox you can force all lines to be selected for removal. Be sure each line is checked.

Then you can proceed to click on the blue button Quarantine selected.

 

Can you please re-do the same scan as before & this time be very sure each line is tick  ( check marked)  and then click " Quarantaine sélectionnée "

 

 

[Teo1906]

Sorry about that, in fact i did it but after exporting the report. I have deleted all the threat and rebooted my pc and i ran another analys. The scan found again 11 other threats i have done the same thing but this time i exported the report after selecting quarantine, here it is. Thanks

2.txt

[Maurice Naggar]

Thank you for that scan report.  The result and the actions are better.

There were some issues relate to Google Chrome browser.

So I recommend what follows.

I need you to go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".
.

Then keep me advised on the overall situation.

Sincerely,

[AdvancedSetup]

Hello @Teo1906 are you still with us?

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks