I keep getting this pop up from avast of a svchost.exe malware.
It says the location is C:\Windows\System32\svchost.exe
and the URL written is "hxxp://opticized.net/?..
It pops up every two minutes or so…
PLEASE HELP! It’s the first time a virus has breached my computer.
Running windows 7 64 bit
Log from scanning through FRST has been attached.
FRST.txt
Addition.txt
Let me know if this stops it
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
HKU\S-1-5-21-1193811734-3295663295-4293864617-1000\...\Run: [iLivid] => "C:\Users\Haji\AppData\Local\iLivid\iLivid.exe" -autorun HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1406049356&from=cor&uid=ST31000524AS_9VPG08J8XXXX9VPG08J8&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1406049356&from=cor&uid=ST31000524AS_9VPG08J8XXXX9VPG08J8&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1406049356&from=cor&uid=ST31000524AS_9VPG08J8XXXX9VPG08J8&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1406049356&from=cor&uid=ST31000524AS_9VPG08J8XXXX9VPG08J8&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1406049356&from=cor&uid=ST31000524AS_9VPG08J8XXXX9VPG08J8&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1406049356&from=cor&uid=ST31000524AS_9VPG08J8XXXX9VPG08J8&q={searchTerms} HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File R1 {dda91daf-e6f8-4453-88d1-df18d861c904}w64; C:\Windows\System32\drivers\{dda91daf-e6f8-4453-88d1-df18d861c904}w64.sys [48792 2014-10-29] (StdLib) 2014-10-08 11:18 - 2014-10-08 11:19 - 00000000 _____ () C:\Users\Haji\AppData\Local\{B8A6933E-22F5-435C-ADC7-D0DB1DF7FFB2} 2014-10-08 11:18 - 2014-10-08 11:18 - 00000000 ____H () C:\Users\Haji\AppData\Local\BITF891.tmp C:\Users\Haji\AppData\Local\iLivid EmptyTemp: CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner by Xplode onto your desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.