Many messages " avast has blocked c:\windows\syswow64\dllhost.exe "

Viruses and worms
1

I keep getting this message over and over again and my C:/TEMP area keeps filling up! I searched and found some help on this forum.

I have :

  1. run malwarebytes (all clean) log attached - wow64.txt
  2. downloaded and run frst - (frst.txt and additions.txt attached)
  3. downloaded and ran aswMBR (ASWmbr.TXT attached)

I need help please!! running windows 7, 64 bit
thank you!

2

Could you let me know if this stops it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-160899455-3500638814-341419740-1001\...\MountPoints2: {3eacf86f-2fb3-11e1-a1bb-c89cdc5a1628} - E:\LaunchU3.exe -a HKU\S-1-5-21-160899455-3500638814-341419740-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks! AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found AppInit_DLLs: C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL File Not Found AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => "c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll" File Not Found CHR HKU\S-1-5-21-160899455-3500638814-341419740-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION BHO-x32: No Name -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> No File Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File Toolbar: HKU\S-1-5-21-160899455-3500638814-341419740-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File CHR DefaultSearchKeyword: Default -> conduit.search CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\gcswf32.dll No File CHR Plugin: (Skype Toolbars) - C:\Users\Alicia Bustos\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.8.0.8855_0\npSkypeChromePlugin.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File CHR Plugin: (Driver Update) - C:\windows\system32\lenovo\update\npdueng.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File S2 70e6ca8c; "C:\windows\system32\rundll32.exe" "c:\progra~2\optimi~1\OptProCrashSvc.dll",ServiceMain 2014-12-29 16:52 - 2014-01-22 11:38 - 00000000 ____D () C:\Program Files (x86)\Mobogenie CustomCLSID: HKU\S-1-5-21-160899455-3500638814-341419740-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks? HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service" c:\progra~2\optimi~1 C:\ProgramData\flashax10.exe C:\PROGRA~2\SearchProtect EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

3

ok thank you… here are the text files
fixlog.txt
and
adwclener

so far it looks like no more messages!! thank you !!! will start up internet explorer again to see if messages stopped

4

How is the computer behaving now ?