I am also getting svchost.exe URL: MAL pop ups. Please help!

Viruses and worms
1

I feel this started when I installed a CBR Reader. I installed it and noticed it installed a whole bunch of other shit so I immediately tried to get rid of all the extra crap. I guess it left something behind that I can’t remove. I don’t remember where I got it from but I don’t download from suspicious places so it has to be quite a reputable place. I would have done a search for CBR file reader or something and looked at the top few links on google. I have the file with me but I can’t attach it. The file name is cbrreader_setup.exe. I can send it via email if you want to look at it. Avast did not flag it so I am not sure it is the source. But it is the only suspicious thing I can remember.

I have ran all manner of scans on MalwareBytes and Avast and have cleaned out anything reported as suspicious but the problem persists.

Here are the logs you need.

2

Hello

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

3

Hello,

The log file is attached.

4

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

5

Went through the instructions. Here’s the log.

6

Is everything ok now?

7

It is very random in its appearance. I will give it a couple of hours and see if anything pops up. But the items you flagged in your fix list were the annoying crap that was installed. So I have high hopes. If it doesn’t come back in a few hours, your next beer is on me.

8

deal :slight_smile:

9

Enjoy a cold one on me :slight_smile: