Assistance with svchost.exe url malware

system · 2015-06-11T22:33:40.000Z

Been getting lots of daily avast pop up warnings that look like the following.

URL: hxxp://bestdriverstar.net/4141/RelayTurbo_142668814330855.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

The url in the avast popup warning is different sometimes. Attached below are my logs from Malwarebytes, Farbar, and aswMBR. On a side note I got a blue screen and shut down while running aswMBR

Thank you

Rednose · 2015-06-11T22:36:40.000Z

Hi no1b4me72, welcome to the forum

As it is past midnight here in Europe, most experts will be sleeping right now.
Be patient, you will be helped as soon as possible.

Greetz, Red.

system · 2015-06-11T22:40:36.000Z

Rednose post:2:

Hi no1b4me72, welcome to the forum

As it is past midnight here in Europe, most experts will be sleeping right now.
Be patient, you will be helped as soon as possible.

Greetz, Red.

Thanks Rednose. Have a good evening…

system · 2015-06-12T03:13:34.000Z

Hello

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-06-12T18:55:22.000Z

Here’s the zoek-results log attachment.

system · 2015-06-12T19:05:41.000Z

Re-run zoek and run this script:

mdlgoanmklkbmpnloohhfolfgibmieog;chr
C:\Users\user\AppData\Local\Chromium\User Data\Default\Preferences;f
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
createsrpoint;
autoclean;
emptyalltemp;

Post its content into your next reply.

system · 2015-06-12T22:38:08.000Z

2nd zoek log attachment after running script.

system · 2015-06-13T02:00:47.000Z

Is everything ok now?

system · 2015-06-13T19:51:47.000Z

Have been at work. Will give it 24 hours and report back if there are anymore Avast alerts. Thanks for your assistance argus…

system · 2015-06-13T19:53:34.000Z

No problem.

Announcements