another svchost.exe url:mal problem

system · 2015-07-06T02:33:06.000Z

I’m helping my in-laws, so I’m not sure how this problem started. I’ve run Avast, MBAM, and others, all with no success. As soon as the computer connects to the internet, it starts the problem again. Following is a typical sample.

URL: http://anythicago.com/4141/BorderlineRunner_142669490009128.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

I saw recommendations to run ZOEK. I ran it with scan all users selected, but it did not solve the problem. Seeing the previous recommendation to run the Farbar Recovery Tool, I ran that as well, and attached the FRST.txt and Addition.txt files.

Can you help?

Edit: Added MBAM log as well.

dbrisendine · 2015-07-06T07:00:42.000Z

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Download the script file that is attached by right clicking on it and selecting “Save Target As…” or “Save Link As …” (depends on the browser you are using). Please make sure that the file type is set as Text File (or All Files but NOT as a HTML file) and the files name is Fixlist.txt , have it on the Desktop, so that fixlist.txt is next to FRST64.exe,

Start FRST that is on the desktop by right clicking on file and selecting “Run as Administrator…”

When the tool opens click Yes to disclaimer. (if it still does)

Press the Fix button just once and wait. The script will be processed and your system restarted to complete the removal / breakage of the malware.

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/Press%20the%20FIX%20button_zpsdd5zi3mt.png

The tool will make a log on the Desktop (Fixlog.txt) please post it to your reply (attach or paste)

system · 2015-07-06T19:40:14.000Z

It seems better, thanks for your (fast) help. Not sure if you really need the fixlog, but I’ll attach it just in case it will be helpful.

dbrisendine · 2015-07-06T19:59:21.000Z

es.3.timba post:3:

It seems better, thanks for your (fast) help. Not sure if you really need the fixlog, but I’ll attach it just in case it will be helpful.

Log attached where???

Announcements