Malware in svchost.exe

system · November 5, 2014, 4:19pm

I started with one malware in the file.
Then I ran a dozen of utilities adviced by anti-malware pages - now I have more malware in svchost.exe!

Attached the required logs, I hope somebody can help.

I’ve run all the programs on this page without any help:
http://malwaretips.com/blogs/svchost-exe-virus-removal/

Pondus · November 5, 2014, 4:39pm

I've run all the programs on this page without any help:

hva fanden laver du mand ;D

If your AV and Malwarebytes dont fix it, then it is usually best left to a expert remover should be online soon

system · November 5, 2014, 4:58pm

Hi,

My name is Valinorum and I will be the acolyte today. Before we proceed, please, acknowledge yourself the following(s):

Please do not create any new threads on this while we are working on your system as it wastes another volunteer’s time. If you are being helped/have solved the issue/no longer wish to continue, notify me in your reply and I will quickly close this thread. Failing to comply will result in denial of future assistance.
- Please do not install any new software while we are working on this system as it may hinder our process.
- Malware removal is a complicated process so don’t stop following the steps even if the symptoms are not found. Keep up with me until I declare you clean.
- Please do not try to fix anything without being ask.
- Please do not attach your logs or put them inside code/quote tags. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.
- Please print or save the instructions I give you for quick reference. We may be using Safe mode which will cut you off from internet and you will not always be able to access this thread.
- Back up your data. I will not knowingly suggest your any course that might damage your system but sometimes Malware infections are so severe that only option we have is to re-format and re-install the operating system.
- If you are confused about any instruction, stop and ask. Do not keep on going.
- Do not repeat the steps if you face any problems.
- I am not an omniscient. There are things even I cannot foresee. But what I know took years to learn and perfect the skill. This site is run by volunteers who help people in need in their own free time. I would ask you to respect their time and be patient as sometimes real life demands our time and replies to you can be delayed.
- Private Message(PM) if and only if I have not responded to your thread within three days or your query is offtopic and personal. Do not PM me under any other circumstances. Your thread is the only medium of communication.
- The fixes are for your system only. Please refrain from using these fixes on other system as it may do serious damage.

Step #1 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[li]Open Notepad.exe. Do not use any other text editor software;
- Copy and Paste the contents inside the code-box to your Notepad –
[/li]

Start
Closeprocesses:
Emptytemp:
CustomCLSID: HKU\S-1-5-21-1849042483-4225610547-1581624173-1000_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\Kenneth\AppData\Local\Temp\19A404e.exe No File
C:\Users\Kenneth\AppData\Local\Temp\19A404e.exe
2014-11-04 21:12 - 2014-11-04 21:12 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Kenneth\Downloads\iExplore.exe
C:\Users\Kenneth\AppData\Local\Temp\07F571BD.dll
C:\Users\Kenneth\AppData\Local\Temp\18E7243C.dll
C:\Users\Kenneth\AppData\Local\Temp\1BB7A495.dll
C:\Users\Kenneth\AppData\Local\Temp\1E24AF82.dll
C:\Users\Kenneth\AppData\Local\Temp\28150A20.dll
C:\Users\Kenneth\AppData\Local\Temp\4745BA61.dll
C:\Users\Kenneth\AppData\Local\Temp\4E9E33D4.dll
C:\Users\Kenneth\AppData\Local\Temp\4ED19B1B.dll
C:\Users\Kenneth\AppData\Local\Temp\5697E2F8.dll
C:\Users\Kenneth\AppData\Local\Temp\5836EC05.dll
C:\Users\Kenneth\AppData\Local\Temp\60B5A76E.dll
C:\Users\Kenneth\AppData\Local\Temp\60F02F49.dll
C:\Users\Kenneth\AppData\Local\Temp\9E717D79.dll
C:\Users\Kenneth\AppData\Local\Temp\9E7451D1.dll
C:\Users\Kenneth\AppData\Local\Temp\D5F25A3D.dll
C:\Users\Kenneth\AppData\Local\Temp\DFAD9190.dll
C:\Users\Kenneth\AppData\Local\Temp\DFAFCA03.dll
C:\Users\Kenneth\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Kenneth\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpr1r4km.dll
C:\Users\Kenneth\AppData\Local\Temp\FC4B323F.dll
C:\Users\Kenneth\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Kenneth\AppData\Local\Temp\ose00000.exe
C:\Users\Kenneth\AppData\Local\Temp\Quarantine.exe
C:\Users\Mai\AppData\Local\Temp\21121134.dll
C:\Users\Mai\AppData\Local\Temp\3F6E6FF6.dll
C:\Users\Mai\AppData\Local\Temp\574DF244.dll
C:\Users\Mai\AppData\Local\Temp\789273DF.dll
C:\Users\Mai\AppData\Local\Temp\78AFC2BC.dll
C:\Users\Mai\AppData\Local\Temp\7A5B3A28.dll
C:\Users\Mai\AppData\Local\Temp\7A5EBF4D.dll
C:\Users\Mai\AppData\Local\Temp\82C0E18C.dll
C:\Users\Mai\AppData\Local\Temp\F9F2E438.dll
End

  [li]Click on [b]File[/b] > [b]Save as...[/b]

[list]
[li]Inside the File Name box type fixlist.txt
- From the Save as type drop down list, choose All Files
[/li]
- Save the file to your Desktop;
- Re-run FRST.exe and click Fix;

		[li][b]Note[/b]: If FRST advises there is a new updated version to be downloaded, do so/allow this.
	[/li]
	- After the completion, a log will be produced;
	- Attach the log in your next reply.
[/list][/li]

Required Log(s):
```
  [li]FRST Fix Log
```
[/li]
Regards,
Valinorum

system · November 5, 2014, 6:16pm

Done.

Now I’m in doubt whether to attach or include, as I’m instructed to do both in your post, so I will just include it here

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 04-11-2014
Ran by Kenneth at 2014-11-05 19:11:25 Run:1
Running from C:\Users\Kenneth\Desktop
Loaded Profile: Kenneth (Available profiles: Kenneth & Mai)
Boot Mode: Normal

==============================================

Content of fixlist:

Start
Closeprocesses:
Emptytemp:
CustomCLSID: HKU\S-1-5-21-1849042483-4225610547-1581624173-1000_Classes\CLSID{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 → C:\Users\Kenneth\AppData\Local\Temp\19A404e.exe No File
C:\Users\Kenneth\AppData\Local\Temp\19A404e.exe
2014-11-04 21:12 - 2014-11-04 21:12 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Kenneth\Downloads\iExplore.exe
C:\Users\Kenneth\AppData\Local\Temp\07F571BD.dll
C:\Users\Kenneth\AppData\Local\Temp\18E7243C.dll
C:\Users\Kenneth\AppData\Local\Temp\1BB7A495.dll
C:\Users\Kenneth\AppData\Local\Temp\1E24AF82.dll
C:\Users\Kenneth\AppData\Local\Temp\28150A20.dll
C:\Users\Kenneth\AppData\Local\Temp\4745BA61.dll
C:\Users\Kenneth\AppData\Local\Temp\4E9E33D4.dll
C:\Users\Kenneth\AppData\Local\Temp\4ED19B1B.dll
C:\Users\Kenneth\AppData\Local\Temp\5697E2F8.dll
C:\Users\Kenneth\AppData\Local\Temp\5836EC05.dll
C:\Users\Kenneth\AppData\Local\Temp\60B5A76E.dll
C:\Users\Kenneth\AppData\Local\Temp\60F02F49.dll
C:\Users\Kenneth\AppData\Local\Temp\9E717D79.dll
C:\Users\Kenneth\AppData\Local\Temp\9E7451D1.dll
C:\Users\Kenneth\AppData\Local\Temp\D5F25A3D.dll
C:\Users\Kenneth\AppData\Local\Temp\DFAD9190.dll
C:\Users\Kenneth\AppData\Local\Temp\DFAFCA03.dll
C:\Users\Kenneth\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Kenneth\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpr1r4km.dll
C:\Users\Kenneth\AppData\Local\Temp\FC4B323F.dll
C:\Users\Kenneth\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Kenneth\AppData\Local\Temp\ose00000.exe
C:\Users\Kenneth\AppData\Local\Temp\Quarantine.exe
C:\Users\Mai\AppData\Local\Temp\21121134.dll
C:\Users\Mai\AppData\Local\Temp\3F6E6FF6.dll
C:\Users\Mai\AppData\Local\Temp\574DF244.dll
C:\Users\Mai\AppData\Local\Temp\789273DF.dll
C:\Users\Mai\AppData\Local\Temp\78AFC2BC.dll
C:\Users\Mai\AppData\Local\Temp\7A5B3A28.dll
C:\Users\Mai\AppData\Local\Temp\7A5EBF4D.dll
C:\Users\Mai\AppData\Local\Temp\82C0E18C.dll
C:\Users\Mai\AppData\Local\Temp\F9F2E438.dll
End

Processes closed successfully.
“HKU\S-1-5-21-1849042483-4225610547-1581624173-1000_Classes\CLSID{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}” => Key deleted successfully.
“C:\Users\Kenneth\AppData\Local\Temp\19A404e.exe” => File/Directory not found.
C:\Users\Kenneth\Downloads\iExplore.exe => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\07F571BD.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\18E7243C.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\1BB7A495.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\1E24AF82.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\28150A20.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\4745BA61.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\4E9E33D4.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\4ED19B1B.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\5697E2F8.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\5836EC05.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\60B5A76E.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\60F02F49.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\9E717D79.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\9E7451D1.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\D5F25A3D.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\DFAD9190.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\DFAFCA03.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\dllnt_dump.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpr1r4km.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\FC4B323F.dll => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\Foxit Reader Updater.exe => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\ose00000.exe => Moved successfully.
C:\Users\Kenneth\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\21121134.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\3F6E6FF6.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\574DF244.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\789273DF.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\78AFC2BC.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\7A5B3A28.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\7A5EBF4D.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\82C0E18C.dll => Moved successfully.
C:\Users\Mai\AppData\Local\Temp\F9F2E438.dll => Moved successfully.
EmptyTemp: => Removed 911 MB temporary data.

The system needed a reboot.

==== End of Fixlog ====

Pondus · November 5, 2014, 6:21pm

Now I'm in doubt whether to attach or include, as I'm instructed to do both in your post, so I will just include it here :)

You can copy and paste if the log fits in one post..... however the diagnostic logs are often very long and may require 20 posts with copy and paste so we like to have that attached

So we just say attach it all to make it easy

system · November 5, 2014, 6:24pm

Ah, I see. Thanks.

I’ll now await and see if the error message has gone. Will take some days as I’m not online every day.

system · November 6, 2014, 3:14am

Step #2 ESET Online Scanner
Disable your security programs which includes but not limited to anti-virus, anti-malware, anti-spyware et cetera. Peruse this for additional information.

  [li]Download [b]esetsmartinstaller_enu.exe[/b] by clicking [url=http://download.eset.com/special/eos/esetsmartinstaller_enu.exe][b]here[/b][/url].
  - Right-click on the program and choose [i]Run as administrator[/i].
  - Accept their terms and condition and proceed.
  - Install [b]Add-On/Active X[/b] if prompted.
  - From the [b]Computer Scan Setting[/b] --

[list]
[li]Enable detection of potentially unwanted application
[/li]
- Click on Advanced Setting–

		[li]Check the following box --
		- [list]
			[li][b]Remove Found Threats[/b]
		[/li]
	[/list]
		- Check the following boxes --
		- [list]
			[li][b]Scan archives[/b];
			- [b]Scan for potentially unsafe applications[/b]
			- [b]Enable Anti-Stealth Technology[/b]
		[/li]
	[/list][/li]
	- Click on [b]Start[/b] and wait for the [b]virus signature database[/b] to update.
	- The online scan will begin [i]automatically[/i] and can take several hours.

		[li][b]Note:[/b] Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.
	[/li]
	- After the Scan finishes --
	- 
		[li][b]If no threats were found:[/b]

[list]
[li]Put a checkmark in Uninstall application on close.
- Close the program and report that nothing was found
[/li]
- If threats were found:

			[li]Open the file located in [b]C:\Program Files\ESET\ESET Online Scanner\log.txt[/b] (32-bit) or [b]C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt[/b] (64-bit).
			- Attach the log file in your next reply.
		[/li]
	[/list][/li]
[/list][b]Note:[/b] Enable your security programs afterwards.[/li]

Required Log(s):
```
  [li]ESET Log
```
[/li]
Regards,
Valinorum

system · November 6, 2014, 8:58pm

Waouw - did that scan take long time - more then two hours.

The svchost problem seems gone - but the eset log still shows something (don’t know if it is important):

ESETSmartInstaller@High as downloader log:
all ok

product=EOS

version=8

OnlineScannerApp.exe=1.0.0.1

OnlineScanner.ocx=1.0.0.7623

api_version=3.0.2

EOSSerial=093fcf7b1834cf47bb979a170555d846

engine=20963

end=finished

remove_checked=true

archives_checked=true

unwanted_checked=true

unsafe_checked=true

antistealth_checked=true

utc_time=2014-11-06 08:54:15

local_time=2014-11-06 09:54:15 (+0100, Romance Standard Time)

country=“Denmark”

lang=1033

osver=6.1.7601 NT Service Pack 1

compatibility_mode_1=‘avast! Antivirus’

compatibility_mode=783 16777213 100 95 1736902 6668094 0 0

compatibility_mode_1=‘’

compatibility_mode=5893 16776573 100 94 143921 166938446 0 0

scanned=334822

found=33

cleaned=33

scan_time=9314

sh=355EF3DF30DB2A249AB12BA8939C6E1CC9DE9078 ft=1 fh=36dbadd70f91bf18 vn=“a variant of Win32/Systweak.A potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir”
sh=B312E79757AFDF6BB9DD07F5D3E88066B5C1D438 ft=1 fh=d702af4396ccb3ce vn=“Win32/Adware.WhenU.SaveNow potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Originalfiler\daemon406-x86.exe”
sh=6776C10ED51761FB2A94E6C7E92D8667EDCB7FD5 ft=0 fh=0000000000000000 vn=“Win32/Keygen.IH potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Originalfiler\Macromedia\Macromedia.Studio.8.Final.by.salusoft.iso”
sh=1FCAE7414FCA45C38FC233739641EC6E8DDC827B ft=0 fh=0000000000000000 vn=“a variant of Win32/Keygen.CY potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Originalfiler\Macromedia\Dreamweaver MX\MACROMEDIA.DREAMWEAVER.MX.6.0.FINAL.KEYGEN.ONLY-JiOO\jidwmx6.zip”
sh=3043DACB2438C56322C3A2A14F72CD6B5DB05C66 ft=0 fh=0000000000000000 vn=“a variant of Win32/Keygen.CY potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Originalfiler\Zepto Gemalvej\Nero6\Ahead.Nero.Burning.ROM.v6.6.0.8.KeyMaker.Only.rar”
sh=01CBE9084FA2D3B19F4B284A79836301AA674F03 ft=0 fh=0000000000000000 vn=“Win32/Keygen.HB potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Originalfiler\Zepto Gemalvej\Stuff\373a7fae459652dcd08461a7493ce5c194f.zip”
sh=86DE7E6795D270D1BF128CFD77E80C2005384BBA ft=1 fh=20bd36dfd16fd7c7 vn=“Win32/AdWare.1ClickDownload.AW application (cleaned by deleting - quarantined)” ac=C fn=“C:\Users\Kenneth\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000”
sh=774EABA10B0D7644465F3184E86EB96223008E44 ft=1 fh=b6bf59c4aa673b88 vn=“a variant of Win32/InstallCore.PZ potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Users\Kenneth\Downloads\Brothersoft_downloader_For_XnView (1).exe”
sh=774EABA10B0D7644465F3184E86EB96223008E44 ft=1 fh=b6bf59c4aa673b88 vn=“a variant of Win32/InstallCore.PZ potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Users\Kenneth\Downloads\Brothersoft_downloader_For_XnView.exe”
sh=DDE5551B7CA6522DB310C021DB3763B55F2C52BA ft=1 fh=410e69f6807960b8 vn=“a variant of Win32/DownloadGuide.C potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Users\Kenneth\Downloads\download_audiograbber.exe”
sh=B4A0A4759726D8122549DE3B16FADF88BECA0F8E ft=0 fh=0000000000000000 vn=“Win32/Adware.ADON potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\All Users\Menuen Start\Programmer\eBay.url”
sh=32DFA9ABB1485EBFBD9156F6785558D048DDAF49 ft=1 fh=208c1d4fffc3a024 vn=“multiple threats (cleaned by deleting - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\duax.exe”
sh=BD493E5ECB7CA0C7B8BFDD317591E031E9C18D04 ft=1 fh=4332aca03e78d178 vn=“Win32/AdWare.1ClickDownload.AT application (cleaned by deleting - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\14_0_4734_1000_ProfessionalPlus_volume_x86_en_us_iso.exe”
sh=EE4AA09AC89189D5141BDA5C7A1182C5CCCFC9BD ft=1 fh=b7bdae8a20172211 vn=“a variant of Win32/InstallIQ.A potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\7Zip_d3433514.exe”
sh=3A62E63E1C2115FB866D16CD67D32F8A46C68178 ft=1 fh=519a7d767a85e97c vn=“Win32/OpenCandy potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\avc-free.exe”
sh=F42B85031D49668C5972266B468DF75996D549D4 ft=1 fh=3485168f5473c621 vn=“Win32/AdWare.1ClickDownload.AT application (cleaned by deleting - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\Axure_RP_Pro_6_5_0_3003_Keygen (1).exe”
sh=F42B85031D49668C5972266B468DF75996D549D4 ft=1 fh=3485168f5473c621 vn=“Win32/AdWare.1ClickDownload.AT application (cleaned by deleting - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\Axure_RP_Pro_6_5_0_3003_Keygen (2).exe”
sh=F42B85031D49668C5972266B468DF75996D549D4 ft=1 fh=3485168f5473c621 vn=“Win32/AdWare.1ClickDownload.AT application (cleaned by deleting - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\Axure_RP_Pro_6_5_0_3003_Keygen.exe”
sh=B48D59D767B109552A989B5E3E381C72FAAE2D80 ft=1 fh=69149626ef23ba1d vn=“Win32/OpenCandy potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\CrystalDiskInfo6_0_1-en.exe”
sh=3A5AADF9C98DC459914D5CF4D3E9D9029BB5472D ft=1 fh=898f8c7a865511cc vn=“a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\CuteWriter.exe”
sh=1867142971E46CEFBDC91D1C32BDDB89B9CC2FCB ft=1 fh=bed49cb1acf2aab9 vn=“Win32/DownWare.L potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\DTLite4471-0333.exe”
sh=2E79F1CFB60D8C13835E28FCABC38A962604D7C2 ft=1 fh=0ad0c83031f474cd vn=“Win32/AdWare.1ClickDownload.AT application (cleaned by deleting - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\The_Intouchables_(2011)720p_BRrip_sujaidr (1).exe"
sh=2E79F1CFB60D8C13835E28FCABC38A962604D7C2 ft=1 fh=0ad0c83031f474cd vn=“Win32/AdWare.1ClickDownload.AT application (cleaned by deleting - quarantined)” ac=C fn="C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\The_Intouchables(2011)_720p_BRrip_sujaidr.exe”
sh=0962BFF662EDDFEF0D18DD55188C583792072232 ft=1 fh=94e09f7f006b441f vn=“a variant of Win32/OpenInstall potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\VLCv210RC1 (1).exe”
sh=0962BFF662EDDFEF0D18DD55188C583792072232 ft=1 fh=94e09f7f006b441f vn=“a variant of Win32/OpenInstall potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\VLCv210RC1 (2).exe”
sh=0962BFF662EDDFEF0D18DD55188C583792072232 ft=1 fh=94e09f7f006b441f vn=“a variant of Win32/OpenInstall potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Downloads\VLCv210RC1.exe”
sh=3304E307E63DC82662C547E3C090720268B19965 ft=1 fh=16a38cd40d7f9a21 vn=“Win32/Somoto.F potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Hentede filer\burn4free_setup.exe”
sh=0078F57B9B78D11CE0BC235F344C0ECC85D0B313 ft=1 fh=aa82b79cf2daaa47 vn=“Win32/OpenCandy potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Hentede filer\cdbxp_setup_4.3.8.2474.exe”
sh=6C958FBC122A438ECC2B8116934718CD765385DF ft=1 fh=bb1f3b8f8e7edcc5 vn=“a variant of Win32/InstallCore.D potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Hentede filer\cnet2_duax_exe.exe”
sh=18826753F88DEDA161E228A7B89207445F7EE84E ft=1 fh=bb1f3b8f65322d86 vn=“a variant of Win32/InstallCore.D potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Hentede filer\cnet2_sid1200_exe(1).exe”
sh=18826753F88DEDA161E228A7B89207445F7EE84E ft=1 fh=bb1f3b8f65322d86 vn=“a variant of Win32/InstallCore.D potentially unwanted application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Dokumenter\Hentede filer\cnet2_sid1200_exe.exe”
sh=2E79F1CFB60D8C13835E28FCABC38A962604D7C2 ft=1 fh=0ad0c83031f474cd vn=“Win32/AdWare.1ClickDownload.AT application (cleaned by deleting - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Lokale indstillinger\Application Data\Google\Chrome\User Data\Default\File System\001\t\00\00000000”
sh=C16776FA60D85CFB36127E1E8D15C02237DD5EE1 ft=1 fh=9f9dd17bc1f105b0 vn=“Win32/OpenCandy potentially unsafe application (deleted - quarantined)” ac=C fn=“C:\Windows.old\Documents and Settings\Kenneth\Lokale indstillinger\Temporary Internet Files\Content.IE5\1EPKZV6V\cdbxp_setup_4.5.0.3717[1].exe”

system · November 7, 2014, 12:58pm

Perusing your logs, I see no infection currently present in your system. Unless you are having any issue(s), the machine appears to be Malware-free as we speak.

[b]♣ Removal of Tools and Quarantined Files ♣ [/b]

Despite the tools we have used are clean, they are powerful removal tools and made in a way so that they carry out any commands given to them without (most cases) asking for a confirmation. In the hands of an inept person, they can make the machine un-bootable – a scenario we do not wish to see. Also, we need to remove the quarantined files/folders from your system as a dormant malware can be as bad as an active one if given the proper environment. I shall now give you the guidelines to remove the tools and the quarantined files from your system.

Cleanup with Delfix
Please download DelFix by Xplode to your Desktop.
Download Link

  [li]Double-click to run the program;
  - [list]
  	[li][b]Note[/b]: Windows Vista/7/8 users right-click and choose [i]Run as administrator[/i]
  [/li]
  - Make sure that all the boxes are checked;
  - Click [b]Run[/b];
  - A log will be opened after the operation is finished;
  - [i]Copy[/i] and [i]Paste[/i] it in your next reply

[/list][/li]

[b]♣ Prevention and Future Guidelines ♣ [/b]

Prevention is better than cure – goes the old saying. As much as we love to see you visit our site, we do not want to see you having your PC infected by malwares again.

Keep Windows up-to-date.
It is extremely important that you keep your operating system (Windows) updated when updates are made available. It is set to alert you, so be sure not to ignore these notices and to allow the updates to install. Many of these are critical security packages which could very possibly be the difference between your picking up a future infiltration and simply passing right by it unharmed.
- Run antivirus software and keep it up-to-date, too.
  Antivirus software is your safety net if all other protections fail. The first line of defense is smart computing, of course, but everyone needs a backup. Once they’re installed, check periodically to ensure they have been successfully updating as well. An out-of-date antivirus is not a happy antivirus!
- Keep your web browser plugins and other programs updated also.
  This tip is rarely shared by technicians and its importance is not widely recognized, but it’s absolutely critical. Programs such as Java, Adobe Flash Player and Adobe Reader, Internet Explorer, and myriad other such web-exposed items are deeply vulnerable to attack, which can quickly lead to a hopelessly infected system no matter what protection you currently have installed. The reason is that these programs are ubiquitous, but are also not perfect and are extremely complex… and as such, security vulnerabilities are discovered and exploited by hackers hoping to gain control over your machine. By performing every update for these programs as soon as it’s made available, you will greatly reduce your exposure to dangerous internet threats.

A great way to do this is to install the Filehippo Update Checker and run it regularly. Also, try not to ignore any notifications you receive regarding updates to programs already installed on your PC.

No scripts is an excellent security device too. I like it but it is not for everyone because it requires you to take action if you want to see some things (pop ups, banners etc.) on sites you visit.

Download NoSript by Giorgio Maone.

Note: Sometimes you will get a site telling you that you need to install Java when actually all you need to do is enable the site through the no script icon down on the right hand side of your computer.

- [b]Watch out for new threat named CryptoLocker[/b]

CryptoLocker is a new type ransomware family malware that encrypts your important files and asks for a ransom to decrypt them. At the moment of posting this reply there are no tools that can undo the havoc this malware causes. We can help you to remove the malware from your system but the files that was encrypted cannot be recovered without the decryption key. So, I ask for your forbearance and practice constant vigilance. Please read the following article to acknowledge yourself about the safety measures.
How to prevent your computer from becoming infected by CryptoLocker.

- [b]And last of all, surf smart.[/b]

It doesn’t matter how well the autopilot system works if the pilot keeps flying the plane into mountain ranges. Don’t forget that no matter how much you have protecting yourself, your security ultimately begins and ends with you. Don’t visit dangerous or questionable web sites, avoid suspicious links on Facebook and emails/email attachments you’re unsure about, and just generally keep your wits about you, and you’ll be much safer. Also, avoid illegal downloads, cracks, “warez”, and all other too-good-to-be-true internet offerings: they’re typically laden with malware. Be smart and you can avoid most threats lurking about the darker corners of the internet! And for even more tips, see our article, How Did I Get Infected in the First Place?

My help is free but if you feel like making my day you may donate any amount you wish by clicking the ‘donate’ button. I really appreciate your kindness.

https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif

Regards,
Valinorum

system · November 7, 2014, 6:35pm

Thanks

Log:

DelFix v10.8 - Logfile created 07/11/2014 at 19:35:02

Updated 29/07/2014 by Xplode

Username : Kenneth - KENNETH-PC

Operating System : Windows 7 Professional Service Pack 1 (32 bits)

~ Activating UAC … OK

~ Removing disinfection tools …

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\TDSSKiller.3.0.0.41_04.11.2014_21.10.21_log.txt
Deleted : C:\Users\Kenneth\Desktop\Addition.txt
Deleted : C:\Users\Kenneth\Desktop\Fixlog.txt
Deleted : C:\Users\Kenneth\Desktop\FRST.exe
Deleted : C:\Users\Kenneth\Desktop\FRST.txt
Deleted : C:\Users\Kenneth\Desktop\Rkill.txt
Deleted : C:\Users\Kenneth\Downloads\Addition.txt
Deleted : C:\Users\Kenneth\Downloads\AdwCleaner (1).exe
Deleted : C:\Users\Kenneth\Downloads\AdwCleaner.exe
Deleted : C:\Users\Kenneth\Downloads\aswmbr.exe
Deleted : C:\Users\Kenneth\Downloads\aswMBR.txt
Deleted : C:\Users\Kenneth\Downloads\esetsmartinstaller_enu.exe
Deleted : C:\Users\Kenneth\Downloads\FRST (1).exe
Deleted : C:\Users\Kenneth\Downloads\FRST.exe
Deleted : C:\Users\Kenneth\Downloads\FRST.txt
Deleted : C:\Users\Kenneth\Downloads\MBR.dat
Deleted : C:\Users\Kenneth\Downloads\RogueKiller.exe
Deleted : C:\Users\Kenneth\Downloads\tdsskiller.exe
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

~ Creating registry backup … OK

~ Cleaning system restore …

New restore point created !

~ Resetting system settings … OK

########## - EOF - ##########

system · November 7, 2014, 6:50pm

Surf safely.