Help removing infections

Viruses and worms
1

I need some help in getting rid of malware. I keep getting Avast alerts saying the threat has been blocked for:

I already have Malwarebytes installed and I ran that. All it turned up was Picasa! Following another thread here, I uninstalled it, downloaded another copy to my desktop, installed and ran again. On reboot, Avast blocked the following:

URL: hxxp://simplesitescan.net/4141/SystemVisual_142669159173081.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

Can I get some help in getting rid of this and anything else what might be lurking? How do I ensure no re-infection?

Thanks
Terry

2

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

3

Hi,

Here are the log files.

Thanks!
Terry

4

Hello,

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
chrdefaults;
bitsadmin /allusers /reset;b
autoclean;
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

5

Here is the zoek results log file

6

Very good. How is your PC behaving now?

7

When it rebooted after zoek, Avast popped up 16 threat warnings, the majority of which were simplesitescan.

8

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

9

Hi,

Attached is the logfile.

… and so far no more ‘blocked threat’ popups.

Thanks
Terry

10

How is the situation now?

11

So far, no more ‘blocked file popups’.

Is my computer healed now?

12

Yes, it is.

13

Thank you. I’ll make a donation.

Can I remove all those executable files and log files?

Who would have been responsible for all these infections?

14

Thank you :slight_smile:

You’ve had Google Chrome hijacker. It is a common infection these days.

We will remove all used tools:

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

15

Done.

Thanks again for your time and expertise.

Terry

16

… rebooted, all files removed.