Please help: Infected with URL: Mal in my svchost.exe

system · June 16, 2015, 5:34pm

I’ve been infected and can’t find the reason.

Thank you for your help.

Best regards,
Gary

TwinHeadedEagle · June 16, 2015, 5:36pm

Hello,

Please follow this topic and attach required reports

https://forum.avast.com/index.php?topic=53253.0

system · June 16, 2015, 6:08pm

The four logs are already attached.

TwinHeadedEagle · June 16, 2015, 9:00pm

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · June 17, 2015, 2:49pm

Report attached

TwinHeadedEagle · June 17, 2015, 3:01pm

We will run one more Zoek fix:

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Fix with ZOEK

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
emptytemp;

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · June 17, 2015, 4:54pm

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by GaryFunk on Wed 06/17/2015 at 9:36:09.11.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\GaryFunk\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-06-17-144440.log 36098 bytes

==== System Restore Info ======================

6/17/2015 9:40:05 AM Zoek.exe System Restore Point Created Successfully.

==== Deleting Files \ Folders ======================

“C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences” deleted

==== C:\zoek_backup content ======================

C:\zoek_backup (files=937 folders=175 59712234 bytes)

==== Empty Temp Folders ======================

C:\Users\Administrator\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\DefaultAppPool\AppData\Local\Temp emptied successfully
C:\Users\GaryFunk\AppData\Local\Temp will be emptied at reboot
C:\Users\hc\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\GaryFunk\AppData\Local\Temp successfully emptied

==== EOF on Wed 06/17/2015 at 10:53:19.31 ======================

TwinHeadedEagle · June 17, 2015, 4:56pm

Very good. How is your PC behaving now?

system · June 17, 2015, 5:08pm

So far, there is no indication of the problem.

First, let me say a big Thank You! to you and the others that help us remove these nasty things. Your help and support are without question.

Second, I am now keeping my kids away from my computer.Other than that, can you give me some indication of how this got on my computer. I will assume it was from site they visited.

Best regards,
Gary Funk

TwinHeadedEagle · June 17, 2015, 5:16pm

Kids were probably installing some software bundled with Adware, I see no other way

Glad I could help. We will delete all used tools and I’ll give you some tips to harden your security and learn how to protect yourself

Please help: Infected with URL: Mal in my svchost.exe

Announcements