Hello edmundo1,
As I make my self clear two time, make shure you do run fixdamage.exe as instructed.
Then, please post me fresh set of both FRST logs for re-analysis.
Ok magna86, fixdamage.exe was run. I then ran FRST and attached are the two txt files.
Hello edmundo1,
Run the following script (FixList) for FRST tool and then tell me how is the computer behavior now?
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Start
CloseProcesses:
CMD: ipconfig /flushdns
CMD: bitsadmin /reset /allusers
CreateRestorePoint:
Task: {49A9B64E-16B2-40CA-B54F-D3070FD4BEA9} - \Updater21804.exe No Task File <==== ATTENTION
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [FAStartup] => [X]
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKU\S-1-5-21-1745014122-396758096-3241855393-1000 -> {41A0FF5E-F138-478F-81AE-8AB4B26E8636} URL = http://www.search.ask.com/web?tpid=PLTSP-SAT&o=APN10960&pf=V7&p2=%5EB2A%5EYYYYYY%5EYY%5EUS&gct=&itbv=12.15.0.533&apn_uid=F8EB15CD-3237-4045-9845-525C87949504&apn_ptnrs=%5EB2A&apn_dtid=%5EYYYYYY%5EYY%5EUS&apn_dbr=iexplore.exe_6_11.0.9600.17126&doi=2014-07-03&trgb=IE&q={searchTerms}&psv=&pt=tb
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-1745014122-396758096-3241855393-1000 -> No Name - {504C5453-4F43-2D53-5000-7A786E7484D7} - No File
Toolbar: HKU\S-1-5-21-1745014122-396758096-3241855393-1000 -> No Name - {504C5453-502D-5341-5400-7A786E7484D7} - No File
CHR HKLM-x32\...\Chrome\Extension: [kdcnnmifdmlmjffdgeieikcokcogpbej] - C:\Program Files (x86)\OApps\chromeaddon2.crx [Not Found
Hosts:
C:\Program Files (x86)\OApps
EmptyTemp:
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
magna86: I ran the script as directed. Copy & pasted, ensured it was in the same folder as the FRST program which was desktop. Program ran well and lingered for extended periods on temps folders as it cleaned them out. The fixlog text file is attached. I will have ample opportunity to put this laptop through it’s paces between now and Sunday night. For the moment, it appears that everything is running fine. I am at this instance, seeing multiple instances of processes in the Task Manager Processes Window-such as qembhwh.exe which is showing up in the window 12 times, plus I am seeing regsvr32.exe and regsvr32.exe *32 as well as iexplore.exe & iexplore.exe *32; and explore.exe in the Windows Task Manager Processes list. Not sure this is normal or not as I never look at the task manager. I have had an occasional pop up from AVAST telling me that it has blocked a mal file from an IP address. Like before but not as many pop up warnings. Please advise!
Hi,
regsvr32 or explorer in task manager are Ok to be seen but qembhwh.exe is not.
-
Please post me the fresh FRST.txt logreprot.
Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:
[*]Type qembhwh.exe into the Search: field in FRST then click the Search File(s) button.
[*]FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
[*]Please attach it to your reply.
Attached are the fresh FRST Reports. Will do the search for the qembhwh now and then will post that log report
attached is the search log for qembhwh.exe file
Previously Avast Pop-ups notifying about blocking malicious files gave the source as iexplore.exe now the pop ups give the source as qembhwh.exe
Hi,
You have fake Google Chrome installed on your system. First, remove and uninstall current Chrome from your system. Delete all Chrome related, check box for “Also delete your browsing data.” in uninstall process. Then …
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Hosts:
HKU\S-1-5-21-1745014122-396758096-3241855393-1000\...\Run: [xqcvlrvi] => regsvr32.exe /s "C:\Users\Alienware laptop\AppData\Local\Apple Computer\xqcvlrvi.dll" <===== ATTENTION
HKU\S-1-5-21-1745014122-396758096-3241855393-1000\...\MountPoints2: {35c2c65f-569e-11e1-beb8-842b2b834543} - E:\LaunchU3.exe -a
Reboot:
C:\Users\Alienware laptop\AppData\Local\Apple Computer\xqcvlrvi.dll
C:\Users\Alienware laptop\AppData\LocalLow\EmieSiteList
C:\Users\Alienware laptop\AppData\Local\Google
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
Now (after fixlist) you can install fresh Google Chrome, from here:
http://www.google.com/chrome/
Then we shall strike with ComboFix …
- Please download ComboFix by sUBs (
http://www.mcshield.net/personal/magna86/Images/IconComboFix.png
) from here and save it to your Desktop.
[i]If you are unsure how ComboFix works, read this guide.
- Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.
Instructions how to disable avast:
• Right click on the avast! system tray icon (
http://www.mcshield.net/pg/images/avast5.png
) in the lower right corner of the screen and scroll up to avast! shield controls;
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.
- Run ComboFix. Then, on disclaimer window, click I Agree! button.
[i][size=7pt]- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running. - If malware is detected, ComboFix will begin with its removal, and may need to restart Windows.
Note:If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart your computer.
[/i]
- When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt)
=> Attach log report (ComboFix.txt) back to topic.
ComboFix shall also create addition log (typical location: C:\Qoobox\ComboFix-quarantined-files.txt)
=> Please attach that report (ComboFix-quarantined-files.txt) as well.
Google chrome is not installed on this machine! At least not anywhere I was able to find!! I checked the list of programs and features in the control panel and not listed there!! I did a search for it and only found a shortcut which I deleted!! I currently running the other two items FRST and then combo fix and will post required logs when done!!
Okay magna86, attached find all of the requested logs.
I brought up task manager and there are still multiple processes of qembhwh.exe *32 running according to task manager!!
Hello,
Open notepad and copy/paste the text present inside the code box below:
DirLook::
C:\Users\Alienware laptop\AppData\Local\Apple Computer
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xqcvlrvi"=-
File::
c:\users\Alienware laptop\AppData\Local\Apple Computer\xqcvlrvi.dll
Save this as CFScript.txt
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows and refering to the picture above.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:[b]ComboFix.txt[/b] )
magna86, I could not find any log named combofix.txt. The logs it created when it ran are attached.
Okay, I keep getting alerts from AVAST that it blocked a Mal file. I tracked the process listed by the AVAST Pop Up back to this directory C:\Users\Alienware laptop\AppData\LocalLow
Couldn’t see anything on the path beyond LocalLow Folder. Turned on show System hidden files and was able to see quite the lot beyond LocalLow folder the path continues on after LocalLow folder above as follows \EmieSiteList\oflacmzwqzp\hsiuknol\qembhwh.exe
quembhwh.exe is just google chrome renamed. There is a whole bunch of crap stuff in this LocalLow folder that I couldn’t see till I turned on show Hidden SYstem Files.
Looking at this LocalLow Folder there are some common file folders in there that you would find elsewhere on the system but there is the following three weird name folders: EmieSiteList; EmieUserList, and EmieBrowserModeList. Each of those folders contains files and additional folders.
Magna86, Have you abandoned me? I still have this infection and waiting on your instructions for the next step?
Hi edmundo1,
I have not abandoned you. I do have my own personal life. Note that I am not avast associated, I am volunteer here.
Post me the fresh FRST.txt logreprot. I need to re-analyse all this since I don’t have ComboFix.txt logreprot.
magna86, don’t think for a minute that I am being ungrateful. I understand that you and the others are volunteers and are graciously donating your time to help people like me with these issues. I am grateful as hell that people like you exist and work diligently to resolve all of our infections. I was just getting nervous when I hadn’t heard anything back for a few days.
I’ve ran FRST again (After the program updated itself) and attached find the FRST.txt log and the addition.txt log.
Hello,
No worries… 
I can’t say that I see the problem here. Posted logs shows no malware, at least I can’t see the malware. Let’s preform some additional check …
Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:
[*]Type OSD_Service.exe;xqcvlrvi.dll into the Search: field in FRST then click the Search File(s) button.
[*]FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
[*]Please attach it to your reply.
.
Also, I would like to get the logs from some other point of view.
Please download Zoek tool by Smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here and save it to your Desktop.
Unpack the archive…
[*]Close any open browsers and temporarily disable your AntiVirus program. (if it is necessary)
If you are unsure how to do this please read this or this Instruction.
[*]Double click on zoek.exe to run the tool. Please wait while the tool does not start…
[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:
Uninstall-List;
StandardSearch;
AutoClean;
Reboot;
[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)
[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”
magna86, here are the requested logs from FRST and Zoek.
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Folder: C:\Users\Alienware laptop\AppData\LocalLow
Folder: C:\Users\Alienware laptop\AppData\Local\Apple Computer
Reboot:
C:\Users\Alienware laptop\AppData\Local\Apple Computer\xqcvlrvi.dll
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
.
Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:
[*]Type xqcvlrvi.dll into the Search: field in FRST then click the Search File(s) button.
[*]FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
[*]Please attach it to your reply.
magna86, ran the script in FRST, fixlog.txt file attached. Also ran the search in FRST for file xqcvlrvi.dll and the search.txt file created from that is also attached. There is still that folder with the qembhwh.exe (which is google chrome renamed), plus it also contains these other files: rundll32.exe; VisualElementsManifest.xml; and a file folder named 36.0.1985.143 all created on 02 January 2015 and I did not create these files and folders. And the folder 36.0.1985.143 contains a bunch of different files and folders that all appear to be google chrome related and were all created on 02 January 2015. When I had multiple redundant processes running in Task Manager baqck a week ago, it was 13 instances of qembhwh.exe that were running and when I tried to end those processes, they came right back on again. I just checked task manager and file qembhwh.exe is not running at all now.