svchost with blackled, reddie, epictory

system · 2015-05-09T16:08:46.000Z

Hi,
Lately every time I turn on my computer, Avast alerts me, letting me know it has blocked a harmful webpage with the address h**p://blackled.info/4141/LibrarySystem… etc as well as reddie and one or two more sites. The pop ups show that it’s all related to “C:\Windows.…\svchost.exe”.
I have attached the files as per the requirement.
Please note I have tried ADWcleaner from Xplod to remove epictory, and that site does not show now, but the remaining sites as mentioned still show on the pop ups
Can someone please help me get rid of this?
Thanks in advance
Shiv

TwinHeadedEagle · 2015-05-09T16:11:20.000Z

Hello,

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-05-09T16:46:12.000Z

Thank you.
I have run the file and attached the results here. This time after I rebooted, the pop up did not appear.

TwinHeadedEagle · 2015-05-09T16:46:59.000Z

Good. How is your PC behaving now?

system · 2015-05-09T16:49:37.000Z

You replied while I was editing my last post
Thank you so much.

TwinHeadedEagle · 2015-05-09T17:39:41.000Z

So, everything is fine?

system · 2015-05-10T03:08:09.000Z

Yes, thank you, it seems to be fine now. Do I need to do anything?

TwinHeadedEagle · 2015-05-10T09:26:41.000Z

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Announcements