Help with URL:Mal svchost.exe

system · 2015-07-17T01:47:26.000Z

My sons computer was infected and I managed to clean out most of it using Avast, Malwarebytes, and AdwCleaner but Avast still shows alerts every so often about blocking URL:Mal. I wanted to post my FRST logs for someone to hopefully help me to put a stop to it. Thanks in advanced!

EDIT posted new logs forgot to run as admin

TwinHeadedEagle · 2015-07-17T05:02:16.000Z

Hello,

https://sites.google.com/site/cannedfixes/junkware-removal-tool/JRTbythisisu.png
Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/junkware-removal-tool/JRTbythisisu.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[*]Follow the prompts and let this process run uninterrupted.
[*]This scan can take a while, depending on your System specs.
[*]Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.

Do not forget to re-enable your previously switched off protection software!
Please also manually reboot your machine after this procedure.

system · 2015-07-17T05:18:35.000Z

Here is the output. Thanks for the help.

TwinHeadedEagle · 2015-07-17T06:06:58.000Z

How is the situation now?

system · 2015-07-17T06:18:41.000Z

After following your instruction and rebooting the virus alerts were still present but I noticed they changed from svchost.exe to chrome.exe so I uninstalled chrome and delete all files and folders related to chrome. Since removing chrome I haven’t seen any virus notifications yet.

TwinHeadedEagle · 2015-07-17T06:25:00.000Z

Very good. Then we will consider this as solved

Post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

[*]Run the tool by right click on the
http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
icon and Run as administrator option.
[*]Make sure that these ones are checked:

[]Remove disinfection tools
[]Purge system restore
[*]Reset system settings

[*]Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:[B]DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Announcements