At least 8 popups for svhost

system · 2015-06-16T17:00:47.000Z

My internet seems to be slowed down a bit and I get alerts every so often, mostly when I reconnect to my wifi, and notes some URL:Mal for a bunch of random website links. I have attached my logs, however I could not get the 32-bit or the 64-bit FRST application to open on my PC… not sure why that is.

essexboy · 2015-06-16T17:04:19.000Z

Can you run FRST from safe mode ?

system · 2015-06-16T17:34:44.000Z

I tried the 32-bit and the 64-bit in safemode as well. I double click and it does nothing, I right click and go to run as admin and it does nothing. Acts as if I never even tried to open, no error message, nothing, just sits there and nothing in task manager.

essexboy · 2015-06-16T19:01:45.000Z

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropboxusercontent.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[]Select LOP and Purity
[]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

system · 2015-06-16T19:24:21.000Z

I got FRST to finally work, for some reason the automatic download of it kept corrupting, had to manually download. I have attached all logs, do you want me to post the OTL log as well?

essexboy · 2015-06-16T19:26:41.000Z

No need … Just looking now

essexboy · 2015-06-16T19:36:11.000Z

Working on a fix now, all this was installed at the same time as an activator http://download.kmspicofinal.com/ this will activate pirated copies of windows and office… Is your windows legal ?

essexboy · 2015-06-16T20:21:38.000Z

Is this a legal copy of windows ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: IFEO\adwcleaner_4.204.exe: [Debugger] svchost.exe IFEO\AnVir.exe: [Debugger] svchost.exe IFEO\AutoLogger.exe: [Debugger] svchost.exe IFEO\CCleaner64.exe: [Debugger] svchost.exe IFEO\FRST.exe: [Debugger] svchost.exe IFEO\FRST64.exe: [Debugger] svchost.exe IFEO\RegWorks.exe: [Debugger] svchost.exe IFEO\RSITx64.exe: [Debugger] svchost.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1742688847-84516211-800876738-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION Winsock: Catalog9 01 C:\Windows\SysWOW64\Meoooskh.dll [286720 2015-05-25] () Winsock: Catalog9 02 C:\Windows\SysWOW64\Meoooskh.dll [286720 2015-05-25] () Winsock: Catalog9 03 C:\Windows\SysWOW64\Meoooskh.dll [286720 2015-05-25] () Winsock: Catalog9 04 C:\Windows\SysWOW64\Meoooskh.dll [286720 2015-05-25] () Winsock: Catalog9 15 C:\Windows\SysWOW64\Meoooskh.dll [286720 2015-05-25] () Winsock: Catalog9-x64 01 C:\Windows\system32\Meoooskh64.dll [360448 2015-05-25] () Winsock: Catalog9-x64 02 C:\Windows\system32\Meoooskh64.dll [360448 2015-05-25] () Winsock: Catalog9-x64 03 C:\Windows\system32\Meoooskh64.dll [360448 2015-05-25] () Winsock: Catalog9-x64 04 C:\Windows\system32\Meoooskh64.dll [360448 2015-05-25] () Winsock: Catalog9-x64 15 C:\Windows\system32\Meoooskh64.dll [360448 2015-05-25] () S3 X6va017; \??\C:\Windows\SysWOW64\Drivers\X6va017 [X] S3 X6va021; \??\C:\Windows\SysWOW64\Drivers\X6va021 [X] S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X] S3 xhunter1; \??\C:\Windows\xhunter1.sys [X] 2015-05-25 02:23 - 2015-05-25 03:49 - 00000112 _____ C:\ProgramData\WLU8aH.dat 2015-05-25 02:10 - 2015-05-25 02:10 - 00003984 _____ C:\Windows\System32\Tasks\LaunchPreSignup 2015-05-25 02:09 - 2015-05-25 03:51 - 00000000 ____D C:\Program Files (x86)\SafeGuard 2015-05-25 02:09 - 2015-05-25 02:09 - 00000000 ____D C:\ProgramData\10963361899322722656 2015-05-25 02:08 - 2015-05-25 03:51 - 00000000 ____D C:\Program Files (x86)\Priceless 2015-05-25 02:08 - 2015-05-25 02:08 - 00000005 _____ C:\end 2015-05-25 01:47 - 2015-06-06 02:38 - 00000000 ____D C:\ProgramData\2bcafb04000065ba 2015-05-25 01:38 - 2015-05-25 01:50 - 00000000 ____D C:\Program Files (x86)\Itibiti Soft Phone 2015-05-25 01:37 - 2015-05-25 01:56 - 00000000 ____D C:\Users\Adamm\AppData\Roaming\WTools 2015-05-25 01:37 - 2015-05-25 01:54 - 00000000 ____D C:\Users\Adamm\AppData\Roaming\Store 2015-05-25 01:37 - 2015-05-25 01:47 - 00000000 ____D C:\Program Files (x86)\Super Optimizer 2015-05-25 01:36 - 2015-06-16 14:47 - 00001020 _____ C:\Windows\Tasks\CsVwO2fQyGFyqtK.job 2015-05-25 01:36 - 2015-05-25 02:20 - 00004632 _____ C:\Windows\SysWOW64\Meoooskh.ini 2015-05-25 01:36 - 2015-05-25 02:20 - 00002536 _____ C:\Windows\SysWOW64\MeoooskhOff.ini 2015-05-25 01:36 - 2015-05-25 02:20 - 00002536 _____ C:\Windows\system32\MeoooskhOff.ini 2015-05-25 01:36 - 2015-05-25 01:36 - 00004028 _____ C:\Windows\System32\Tasks\CsVwO2fQyGFyqtK 2015-05-25 01:36 - 2015-05-25 00:10 - 00360448 _____ C:\Windows\system32\Meoooskh64.dll 2015-05-25 01:36 - 2015-05-25 00:10 - 00286720 _____ C:\Windows\SysWOW64\Meoooskh.dll 2015-05-25 01:36 - 2013-08-22 09:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak 2015-05-25 01:35 - 2015-05-25 01:41 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-05-25 01:35 - 2015-05-25 01:35 - 00000000 ____D C:\Users\Adamm\AppData\Local\globalUpdate 2015-06-15 20:21 - 2014-06-30 20:31 - 00000000 ____D C:\Windows\1C4551A64743409391E41477CD655043.TMP Task: {1D471FDA-84ED-412F-8BF7-6D2B65578652} - System32\Tasks\CsVwO2fQyGFyqtK => C:\Users\Adamm\AppData\Roaming\CsVwO2fQyGFyqtK.exe <==== ATTENTION Task: {5B04B10C-D496-44B3-87B1-D8F5623EF409} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION Task: {7A10A66A-C32E-4A50-A9D1-D08B0CEC0851} - \Run_Bobby_Browser No Task File <==== ATTENTION Task: {A4CD96F3-4CEC-4A3A-9306-43FF226482D2} - System32\Tasks\{EB485032-FC2A-466E-BEDB-43A107263273} => pcalua.exe -a C:\ProgramData\{67C33A62-5B1D-43D1-9600-16006F36EB2B}\setup.exe Task: C:\Windows\Tasks\CsVwO2fQyGFyqtK.job => C:\Users\Adamm\AppData\Roaming\CsVwO2fQyGFyqtK.exe <==== ATTENTION HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tammgF119.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tammgR119.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Meoooskh => ""="service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tammgF119.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tammgR119.sys => ""="Driver" C:\ProgramData\hash.dat C:\ProgramData\WLU8aH.dat C:\Users\Adamm\Downloads\Random\ATR.exe C:\Users\Adamm\AppData\Roaming\CsVwO2fQyGFyqtK.exe C:\Program Files (x86)\OLBPre
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-06-17T05:07:17.000Z

I bought this windows disc from someone at work, think he spliced something in it? I just assumed it was a legit copy but from what you stated and I researched, I am iffy about it. I’m going to go get another copy. Here’s the log you asked for.

essexboy · 2015-06-17T13:53:16.000Z

Could you run a fresh FRST scan now please and let me know what problems you are experiencing

system · 2015-06-17T16:55:00.000Z

The alerts have stopped and everything seems better, thank you!

essexboy · 2015-06-17T17:19:24.000Z

One final thing to do

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.

If you have bookmarks, let’s save them by exporting them - Export Bookmarks
Then I need you to go Google Sync and sign into your account
Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
Now we need to uninstall chrome via control panel.
Note: When asked about user data or settings you must remove this also so please check the box.
Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
Import your bookmarks back into Chrome
Sign back in to your Chrome browser so that your bookmarks sync with your online account.

system · 2015-06-17T20:30:50.000Z

Done! Thank you, still no problems as of right now.

essexboy · 2015-06-17T20:33:26.000Z

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix
Select the options as shown

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

https://dl.dropboxusercontent.com/u/73555776/javara.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe

Announcements