'svchost.exe' Several Malware Alerts, please help! 

system · 2015-06-22T13:04:56.000Z

Hi!

I’m hoping someone can help me. I noticed that several other posts have the same issues however I didn’t want to get in the way of any one else’s advice so I started my own. I’ve been having issues with these blighters below for a few days now! (avast is currently popping up with alerts as I type!)

URL:http:// anythicago.com/4141/RelayTurbo_142668814314552.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

URL:http:// simplesitescan.net/4141/LighterInit_142669556111830.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

URL:http:// alwaysisobar.com/4141/CutterGeneration_142669028208336.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

URL:http:// bestdriverstar.net/4141/CutterSystem_142669222915982.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

URL:http:// opticguardzip.net/4141/CutterSystem_142669222919983.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

I’ve ran avast, malwarebytes and adwcleaner. Seemed to get rid of the optics one for a bit however after a couple of hours that one came back to.

I would appreciate it is someone would kindly help, I don’t want to begin the zoek process until someone gives the go ahead, really do not want to mess my laptop up anymore!

TwinHeadedEagle · 2015-06-22T13:20:32.000Z

Hello,

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

system · 2015-06-22T14:12:24.000Z

Apologies, now know how to attach!

TwinHeadedEagle · 2015-06-22T14:51:17.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

system · 2015-06-22T15:37:10.000Z

Please see attached.

Tabs have been removed from chrome, is that to be expected? So have saved passwords etc.

Seems to not be popping up anymore, will continue to monitor.

TwinHeadedEagle · 2015-06-22T16:20:52.000Z

Nope, saved passwords shouldn’t be removed. How is the situation now?

system · 2015-06-22T18:25:04.000Z

Everything’s been fine up to now. The pop up was every minute or so and that is definitely not happening.

Thank you, you’ve really gotten me out of a tough situation!

system · 2015-06-28T20:35:22.000Z

I’m having the same problem. I see that this is all tailored to the individual machine. What should I do in order to remove it from mine?

DavidR · 2015-06-28T20:37:58.000Z

akipolies post:8:

I’m having the same problem. I see that this is all tailored to the individual machine. What should I do in order to remove it from mine?

Start your own new topic and follow the instructions given by TwinHeadedEagle in Reply #1 and attach the logs in your new topic.

system · 2015-06-28T20:40:04.000Z

Gotcha.

Announcements