« previous next »
Pages: [1]   Go Down

Author Topic: SVCHOST.EXE infected with malware  (Read 5373 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
SVCHOST.EXE infected with malware
« on: June 09, 2015, 06:38:22 PM »
Hello

It seems to be a very common problem lately. However, I can't find out any other possibility than coming here and request some help. It has been a week or two that I have been infected by URL such as anythicago & more.
Would you help me to go through ?
thank you very much in advance !!

FRST + Addition attached
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: SVCHOST.EXE infected with malware
« Reply #1 on: June 09, 2015, 06:39:12 PM »
Monitoring...
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: SVCHOST.EXE infected with malware
« Reply #2 on: June 09, 2015, 07:50:48 PM »
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on icon and select Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
Code: [Select]
createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: SVCHOST.EXE infected with malware
« Reply #3 on: June 09, 2015, 09:56:11 PM »
I Still have some coming back when I reboot !
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: SVCHOST.EXE infected with malware
« Reply #4 on: June 09, 2015, 10:11:58 PM »
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on icon and select Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please include their content into your next reply.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: SVCHOST.EXE infected with malware
« Reply #5 on: June 09, 2015, 10:57:31 PM »
done !
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: SVCHOST.EXE infected with malware
« Reply #6 on: June 09, 2015, 11:00:18 PM »
You cannot have two antivirus products on the same PC. Either uninstall McAfee or Avast.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: SVCHOST.EXE infected with malware
« Reply #7 on: June 09, 2015, 11:05:08 PM »
McAfee is now unistalled
« Last Edit: June 09, 2015, 11:11:22 PM by jonasthing »
Logged

Offline Rednose

  • Pirate Party Member
  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 3739
  • Bits of Freedom : https://www.bof.nl
    • Nederlandstalig Avast! forum
Re: SVCHOST.EXE infected with malware
« Reply #8 on: June 09, 2015, 11:23:02 PM »
Hi jonasthing :)

After unintalling McAfee, did you also run the McAfee Consumer Product Removal (MCPR) tool to get rid of all leftovers ?
For instructions see http://service.mcafee.com/FAQDocument.aspx?lc=1033&id=TS101331 and scroll down to step 2.

Greetz, Red.
Logged
OS: Win 10 / iOS 17 / Debian 12 / Tails 5
Real Time: Avast Premium Security
On Demand: Malwarebytes
VPN: NordVPN ( NordLynx ) with Threat Protection ( Lite )

REDACTED

  • Guest
Re: SVCHOST.EXE infected with malware
« Reply #9 on: June 10, 2015, 08:01:35 AM »
Thank you Rednose,
However, I still get Malwares attacking me this morning. Is there anithing else I can do ? :)

Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: SVCHOST.EXE infected with malware
« Reply #10 on: June 10, 2015, 08:50:44 AM »
Can you make a picture of this warning?
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: SVCHOST.EXE infected with malware
« Reply #11 on: June 10, 2015, 09:10:58 AM »
So, this is a little preview of what my PC suffers now. Is it what you mean ?

URL : http://simplesitescan.net/4141/CutterSystem_142669222922984.dll
Infection : URL:Mal
Processus : C:\Windows\System32\svchost.exe

URL : http://simplesitescan.net/4141/PragmaEngine_142669353208041.dll
Infection : URL:Mal
Processus : C:\Windows\System32\svchost.exe

URL : http://opticguardzip.net/4141/SystemVisual_142669159145377.dll
Infection : URL:Mal
Processus : C:\Windows\System32\svchost.exe

URL : http://opticguardzip.net/4141/CutterSystem_142669222929184.dll
Infection : URL:Mal
Processus : C:\Windows\System32\svchost.exe

you can add also alwaysisobar and anythicago...

Thank you very much TwinHeadedEagle

EDIT : It appears mostly when I restart turn my PC from standby mode, but less when I reboot
« Last Edit: June 10, 2015, 09:16:35 AM by jonasthing »
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: SVCHOST.EXE infected with malware
« Reply #12 on: June 10, 2015, 01:10:43 PM »
Fix with ZOEK

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on icon and select Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
Code: [Select]
createsrpoint;
chrdefaults;
ffdefaults;
bitsadmin /reset /allusers;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: SVCHOST.EXE infected with malware
« Reply #13 on: June 10, 2015, 10:17:53 PM »
there it is !

it sounds better tonight, I will give a confirmation tomorrow !

Thank you very much anyway !

EDIT : THANK YOU :D
« Last Edit: June 11, 2015, 12:49:16 PM by jonasthing »
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: SVCHOST.EXE infected with malware
« Reply #14 on: June 12, 2015, 02:11:27 PM »
Everything okay now?
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE
Pages: [1]   Go Up
« previous next »