Blackfight, Epictory and Reduled & svchost.exe alerts

system · 2015-05-13T09:32:56.000Z

For just over a week, I’ve been getting alerts from Avast saying Malware has been trying to attack svchost.exe
I’ve ran Boot Scan with avast, Threat Scan with Malwarebytes, adwcleaner and used Sophos virus Removal tool as well as avast-browers-cleanup.
It’s happened during using the google chrome, as well as times when I wasn’t in any browser at the time.
I’ve been looking at other topics but they say
“This fix is only valid for this specific machine, using it on another may break your computer”.

Can anyone help?

Asyn · 2015-05-13T09:37:18.000Z

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

system · 2015-05-13T09:40:33.000Z

Monitoring.

system · 2015-05-13T10:24:43.000Z

Hi,

Thank you for being patient with me, and sorry for the lengthy time for me to get back to you.
Here are the logs received from the scans.

system · 2015-05-13T10:38:47.000Z

Helllo,

My name is Argus and and I will be helping you with your computer problems.

Before we begin, please note the following:

[]I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
[]The logs can take some time to research, so please be patient with me.
[]Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
[]Instructions that I give are for your system only!
[]Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
[]Please perform all steps in the order received. If you can’t understand something don’t hesitate to ask.
[*]Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not be able to help you if you do not follow my instructions.

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b
bitsadmin /reset /allusers;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-05-13T11:23:29.000Z

I was unsure whether you meant copy and paste straight into the post or attach the zoek result. So i’ve attached the results in case.

system · 2015-05-13T11:33:24.000Z

Re-run zoek and run this script:

createsrpoint;
autoclean;
C:\Users\Minion\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences;f
emptyalltemp;
ipconfig /flushdns;b

Attach here report.

system · 2015-05-13T11:57:53.000Z

Hi, here’s the report after running the new script.

system · 2015-05-13T11:59:48.000Z

How is the situation now?

system · 2015-05-13T12:17:59.000Z

Well, I haven’t received any alerts concerning the malicious entities.
In regards to that, thank you for helping me with the issue, donated for your services.

Thanks again.

system · 2015-05-13T12:20:50.000Z

Glad we could help.

The following will implement some post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

[*]Run the tool by right click on the
http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
icon and Run as administrator option.
[*]Make sure that these ones are checked:

[]Remove disinfection tools
[]Purge system restore
[*]Reset system settings

[*]Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:[B]DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

system · 2015-05-13T12:29:53.000Z

Done and cleaned.
Thanks for the help.

Anything else I need to do, or was DelFix the last step?

system · 2015-05-13T12:33:54.000Z

Anything else I need to do, or was DelFix the last step?

No nothing, that’s all.

Regards and thanks.

Announcements