Infected with  Infection: URL: Mal Proces: C:\Win svchost.exe  need help

system · 2015-05-15T07:04:38.000Z

Hi all

I’ve been spending a couple of days trying to solve this problem!

When I tried to connect to the internet with Wifi, a lot of Avast! alerts comes out, from reddie.net, blackfight.info, epictory.com and others

Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

I have attached the logs, I hope somebody can help me.
Thank you in advance

TwinHeadedEagle · 2015-05-15T07:05:38.000Z

Hello,

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-05-15T18:02:23.000Z

Hello again

I had to run the script twice, the first time the scanning got stuck for several hours while scannig “chrome look”. Then I ran the script in safe mode and thescanning finnished without troubles.

Here is the zoek-results logfile after running the script.

By the moment there are no more alerts popping up

Thank you for your help

TwinHeadedEagle · 2015-05-15T19:44:43.000Z

Good. Is everything fine now?

system · 2015-05-16T14:08:47.000Z

Yes now is working properly,
thank you for the help

TwinHeadedEagle · 2015-05-16T15:44:59.000Z

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Announcements