Quick overview, I am cleaning up my parents laptop for them as they noticed that is was running very slowly. They only had the McAfee anti virus software free trial that came with the computer, it expired over a year ago. I recently downloaded malwarebytes and Avast, ran them multiple times and clean everything they said to remove.
I ran windows defender and it said that the computer was infected with the Zbot Virus as well. It was removed however, Malwarebytes and Avast are now popping up every 2 minutes with the “malicious website blocked” message. They show that the wininit.exe, dllhost.exe, and svchost.exe are the processes being used.
I need the help of experts to get this cleaned up. I have attached my scan logs.
Thank you for posting your logs. Please do not make any changes to the machine now that the logs have been posted. One of the malware removal specialist will be along to assist you. They come on the forum at different times, so please be patient. Thank you.
[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Thank you for taking the time to help me with this essexboy. Attached is the combofix log I tried to paste the TDSSKiller report but it exceeded the 20000 character limit for a post. I have attached the report log instead.
Could you screenshot one of the alerts and post that please
Please download AdwCleaner by Xplode onto your desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.
Yes, I haven’t had an alert from Avast in 30 minutes. Malwarebytes is still popping up every minute or so. Depending on what I am doing the pop up shows one of 3 processes being used. Either, svchost.exe, dllhost.exe or wininit.exe and the port number changes every time.
Not sure if this will help you in narrowing down the issue or not, but I have noticed that whenever the *32 version of the process is running in task manager that is when I am getting the pop up messages from avast and malwarebytes.
For example wininit.exe and wininit.exe *32 were both running and I was getting the messages saying that the wininit.exe process was being blocked. I ended the wininit.exe *32 process and then the svchost.exe *32 process started running. The very next pop up message was showing that both avast and malwarebytes were blocking the svchost.exe process.
Same thing happens to the *32 version of dllhost.exe