Hello!
It seems I have been infected…
I get a popup everytime i start my computer saying an infection have been blocked.
PRINT: http://gyazo.com/44b8bb18e149ecf01f330f5e18dafe12
svchost.exe seems to be the infected file.
The URL differs everytime i restart the computer.
I’ll attach the logs.
Let me know if this stops it
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint: EmptyTemp: CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that
Seems to have fixed it for now.
Thank you very much.
I guess i’ll reach out to you if the problem occurs again during the next 24 hours or so ?
Again, Thank you very much :)!
EDIT: Do you know what could have caused this btw?
I dont believe I have downloaded anything scum the last few weeks…
If you look on the fixlog you will notice that at least one BITs job was cancelled… That was the bad boy, but how it gets onto the system I have no idea. All I see if the after effects
Just a little extra information.
svchost.exe seems to be the infected file.It is not svchost.exe that seems to be infected. svchost is a host process that makes it possible for other processes to run. Ofcourse there are exceptions but almost all times it is the process that is using the svchost that is the culprit. If you want to see what is using svchost, you can use process explorer from Sysinternals (now owned by Microsoft).