Please help: Infected with URL: Mal in my svchost.exe

system · 2015-06-16T17:34:27.000Z

I’ve been infected and can’t find the reason.

Thank you for your help.

Best regards,
Gary

TwinHeadedEagle · 2015-06-16T17:36:57.000Z

Hello,

Please follow this topic and attach required reports

https://forum.avast.com/index.php?topic=53253.0

system · 2015-06-16T18:08:36.000Z

The four logs are already attached.

TwinHeadedEagle · 2015-06-16T21:00:48.000Z

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-06-17T14:49:37.000Z

Report attached

TwinHeadedEagle · 2015-06-17T15:01:54.000Z

We will run one more Zoek fix:

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Fix with ZOEK

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
emptytemp;

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-06-17T16:54:57.000Z

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by GaryFunk on Wed 06/17/2015 at 9:36:09.11.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\GaryFunk\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-06-17-144440.log 36098 bytes

==== System Restore Info ======================

6/17/2015 9:40:05 AM Zoek.exe System Restore Point Created Successfully.

==== Deleting Files \ Folders ======================

“C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences” deleted

==== C:\zoek_backup content ======================

C:\zoek_backup (files=937 folders=175 59712234 bytes)

==== Empty Temp Folders ======================

C:\Users\Administrator\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\DefaultAppPool\AppData\Local\Temp emptied successfully
C:\Users\GaryFunk\AppData\Local\Temp will be emptied at reboot
C:\Users\hc\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\GaryFunk\AppData\Local\Temp successfully emptied

==== EOF on Wed 06/17/2015 at 10:53:19.31 ======================

TwinHeadedEagle · 2015-06-17T16:56:41.000Z

Very good. How is your PC behaving now?

system · 2015-06-17T17:08:54.000Z

So far, there is no indication of the problem.

First, let me say a big Thank You! to you and the others that help us remove these nasty things. Your help and support are without question.

Second, I am now keeping my kids away from my computer.Other than that, can you give me some indication of how this got on my computer. I will assume it was from site they visited.

Best regards,
Gary Funk

TwinHeadedEagle · 2015-06-17T17:16:51.000Z

Kids were probably installing some software bundled with Adware, I see no other way

Glad I could help. We will delete all used tools and I’ll give you some tips to harden your security and learn how to protect yourself

Announcements