Svchost.exe Url:Mal

Viruses and worms
21

No problem, this was a new variant of the blackbeard Trojan. I have uploaded samples to Avast for them to analyse

22

I restarted the computer after running the Delfix program, and I was greeted with the avast block message again. This time it is only the explorer file not svchost.exe file. Also it has only popped up once since it first rebooted and then stopped

23

Could you reboot again please as that may be an FP on stardock. Let me know if it comes up again

24

Same thing again, but its just the explorer file, and it only pops up when I first boot up. I get 2 notifications.

25

Could you screenshot the notification please and attach it here

26

Here is the pic when I click more details I can restart the computer again if you need to see the pop up too

27

If you right click the Avast icon and select show last popup it will be there

28

Here is the Popup

29

Intriguing

Lets very quickly run combofix to check the file signature

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

30

Ok new problem now. When I was running combofix it froze while it was trying to create a restore point. I brought up the task manager and see a lot of instances of dllhost.exe *32. The Description says COM surrogate. The CPU usage is at 100%.

31

OK reboot and run Combofix from safe mode please, if that fails

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please copy and paste log back here.
[*]The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

32

Here is the new Combofix log

33

OK explorer appears to be OK … Is Avast still alerting on it on boot ?

34

Same thing, this time it first logged me into a temporary account I logged out then tried to log back in and it went to the correct account. I was then greeted by the same pop up all over again.

35

Go to Virustotal
Click Choose File and navigate to c:\Windows\explorer.exe and select it
Then press scan it

Once it has completed could you copy the link and post it here

36

Could you disable Skype from starting with the computer and see if that cures it

37

Here is the link and I will try to disable skype and see https://www.virustotal.com/en/file/6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a/analysis/1395510239/

Update: When I disabled Skype I still received the message about explorer being infected.

38

OK something is using explorer to try and update … Lets find it

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please copy and paste log back here.
[*]The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

39

Here are the logs

40

Sneaky there was a hidden task there that ran after we removed it the first time

Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that