1

Been getting lots of daily avast pop up warnings that look like the following.

URL: hxxp://bestdriverstar.net/4141/RelayTurbo_142668814330855.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

The url in the avast popup warning is different sometimes. Attached below are my logs from Malwarebytes, Farbar, and aswMBR. On a side note I got a blue screen and shut down while running aswMBR

Thank you

2

Hi no1b4me72, welcome to the forum :slight_smile:

As it is past midnight here in Europe, most experts will be sleeping right now.
Be patient, you will be helped as soon as possible.

Greetz, Red.

3

Thanks Rednose. Have a good evening…

4

Hello

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

5

Here’s the zoek-results log attachment.

6

Re-run zoek and run this script:

mdlgoanmklkbmpnloohhfolfgibmieog;chr
C:\Users\user\AppData\Local\Chromium\User Data\Default\Preferences;f
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
createsrpoint;
autoclean;
emptyalltemp;

Post its content into your next reply.

7

2nd zoek log attachment after running script.

8

Is everything ok now?

9

Have been at work. Will give it 24 hours and report back if there are anymore Avast alerts. Thanks for your assistance argus…

10

No problem.