globalroot\systemroot\svchost.exe

Viruses and worms
1

I am having problems with this- I have avast in silent gaming mode bcz it is going off constantly. I have read some other threads about this topic and I have attached the logs. I ran combofix but I am still having the same problem.

Thanks in advance

2

If avast is going off constantly, what are the warnings given by avast?

3

Could you post a screenshot of the alert please and attach the OTL logs

4

Infection Details
URL: "http://shopspotsshop.com/search?q
Process: “\.\globalroot\systemroot\svchost.exe”
Infection: “URL:Mal”

Warn your friends to avoid this website
Threat stats for last 30 days
Blocked infected sites: 81,948,600
Infected domains: 487,175

Is this sufficent?

5

Sorry, missed these

6

[list]I see that you have run Combofix, could you post the log please

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from “Start with Windows”
Reboot and then run OTL

http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL O2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found. O3 - HKU\S-1-5-21-3421619078-42470213-4233049981-1000\..\Toolbar\WebBrowser: (no name) - {12A9DB21-42A2-492D-A85C-CDDE0C88B608} - No CLSID value found. O3 - HKU\S-1-5-21-3421619078-42470213-4233049981-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application

http://dl.dropbox.com/u/73555776/TDSSFront.JPG

[*]Then click on Change parameters.

http://dl.dropbox.com/u/73555776/TDSSConfig.JPG

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

[*]Click the Start Scan button.

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

http://dl.dropbox.com/u/73555776/TDSSFound.JPG

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

[*]Get the report by selecting Reports

http://dl.dropbox.com/u/73555776/TDSSEnd.JPG

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.