Hello
TL;DR - I highly suspect my windows 7 64bit PC is infected with POWELIKS hiding inside a registry key, I am unable to fix the problem myself or determine any other explanation to such strange behavior.
My problem started few days ago when I saw my PC visibly slowing down. Next thing I noticed was that whenever I tried to use Windows Explorer, it wouldn’t load. My first reaction was to do a scan with Avast, which unfortunately tourned out nothing. Task Manager started to show high (25%) CPU and memory (83000K) usage by dllhost.exe. Such thing never happened before with this service so I did a scan with ComboFix. It showed that there was a problem inside a sysWOW64, a file was moved to quarantine. The process however was still running. I tried to kill it with Task Manager, however every single time after a short period of time it was running again. Killing it however turned out to temporarily fix the explorer problem as after doing so, it would load up instantly without any problems. I search the google for a while and stumbled upon this page:
https://superuser.com/questions/833914/how-to-determine-what-is-running-in-dllhost-exe-thats-missing-processid-switch
The Fileless, Memory-Injecting, DLL Trojan that is described there, is supposed to be inside the key HKEY_CLASSES_ROOT\CLSID{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}
After checking regedit it turned out that in fact I do have such key and any try of deleting it or accessing it turned out error saying that I do not have priviliges to do so. The second fact that worries me is the trojan was supposed to be connected and running from this folder sysWOW64. Normal task manager was of no use so I installed Proccess Monitor and it does show a dllhost.exe running from this directory.
Unfortunately, since Avast does not see the virus and I am unable to fix the problem myself, I would highly appreciate any assistance.
Thank you in advance.
Attach your basic diagnostic logs. (MBAM and FRST)
Instructions: https://forum.avast.com/index.php?topic=194892
Attachments added as requested.
I am highly uncertain whether it has anything to do with the problem or not, but the File Explorer now too jumped to constant 30% CPU usage.
Can’t see them, try again.
Deleted and readded. They are there now surely.
we usually look for attachment in the reply, and not in edited previous post ???
Anyway we see them now
Please download Malwarebytes Anti-Rootkit from here
[*]Unzip the contents to a folder in a convenient location.
[*]Open the folder where the contents were unzipped and run mbar.exe
[*]Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
[*]Click on the Cleanup button to remove any threats and reboot if prompted to do so.
[*]Wait while the system shuts down and the cleanup process is performed.
[*]Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
[*]When done, please post the two logs produced they will be in the MBAR folder… mbar-log.txt and system-log.txt