Svchost.exe

waddler_8

If you manage to get back online...

Mrs_Chip wrote: »

I also suspect svchost.exe is a virus as it keeps coming back with a different PID when I kill it. Something is also hijacking my searches and sending me off to random other pages.

Svchost itself isn't malware. I believe you have a rootkit (TDSS?), and what it does is inject a (hidden) dll into svchost - hence the problems with svchost and the redirected search results.

From this we could possibly see exactly which variant of TDSS you have (If it is TDSS), & then proceed to fix it.

waddler_8 wrote: »

Download this and save it to your desktop.

http://public.avast.com/~gmerek/aswMBR.exe

When you've downloaded it...

• Double click aswMBR.exe to run it
• 
  Click No to the prompt to download Avast! virus definitions.
• Click the Scan button.
• When the scan reports "Scan finished successfully", click Save log & save the log to your desktop.
• Click OK when prompted. aswMBR.txt & MBR.dat will be appear on your desktop.
• Click EXIT.
• Copy & paste the contents of aswMBR.txt here.

Should it report something, don't try to fix anything with it yet, just post the log.

It may be best at this stage to back up and reinstall windows.

Kalahary

You can update OpenOffice too, latest version is 3.3. Or switch to LibreOffice if you don't like Oracle.

Mrs_Chip

Well I got back online by manually assigning an IP address, still got to sort out how to enable IP routing and Dhcp again.

Here are the results from the Avast scan:


swMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-03 16:51:08

---

16:51:08.718 OS Version: Windows 5.1.2600 Service Pack 3
16:51:08.718 Number of processors: 2 586 0x1C02
16:51:08.718 ComputerName: PENNYPERSONAL UserName: Penny
16:51:09.343 Initialize success
16:51:34.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
16:51:34.453 Disk 0 Vendor: WDC_WD800BEVS-22RST0 04.01G04 Size: 76319MB BusType: 3
16:51:36.484 Disk 0 MBR read successfully
16:51:36.484 Disk 0 MBR scan
16:51:36.500 Disk 0 Windows VISTA default MBR code
16:51:36.500 Disk 0 scanning sectors +156296385
16:51:36.609 Disk 0 scanning C:\WINDOWS\system32\drivers
16:51:46.218 Service scanning
16:51:48.296 Modules scanning
16:51:52.640 Disk 0 trace - called modules:
16:51:52.671 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
16:51:52.671 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87178ab8]
16:51:52.687 3 CLASSPNP.SYS[f75f3fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x87165d98]
16:51:52.703 Scan finished successfully
16:52:08.546 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Penny\Desktop\MBR.dat"
16:52:08.578 The log file has been saved successfully to "C:\Documents and Settings\Penny\Desktop\aswMBR.txt"

Mrs_Chip

Re the Windows reinstall - I can run this from my pc (tech guys restore) - what do I lose if I do this? I have an external harddrive what is the best way to back up - use tech guys option again?

waddler_8

All the data on the drive will be wiped so you'll lose any custom settings (windows would be reinstalled with default settings, or as it was set when you first got it at least), & you'll lose your installed programs etc & all personal data (docs, photo's, music etc) accumulated since you first started using the pc.

Obviously you'd save & backup/copy your personal data to your external hard drive first , programs etc can be reinstalled from disk or downloaded again from the internet. Any paid for software requiring activation, make sure you have a note of the license/activation key.

There's a sticky on backing up your pc here: https://forums.moneysavingexpert.com/discussion/597170

what is the best way to back up - use tech guys option again?

If you are referring to the "TechGuys Recovery Backup" this is just to make a backup of the recovery software.


Alternatively we can try to clean the pc up. The aswMBR log is clear so we'd need to take another look with something else to see if we can see what is causing the problems. Unfortunately there's no "one click fix" with some malware now.

If you want to take that route, then follow the instructions below - it's similar to hijackthis but shows a lot more information as to where malware may be hiding.


Download DDS from the link below and save it to your desktop:

Link




After you've downloaded it and saved it to your desktop:

• Double click DDS to run it.
• When it's finished, DDS will open two logs:

1. DDS.txt
2. Attach.txt

Save both reports to your desktop.


Copy & paste the contents of just DDS.txt for now and post it here (you may need to split the log over separate posts)

Mrs_Chip

Thanks Waddler

I have removed AVG and installed Avast, which has found several different infections:

Ramnit-G and H,
PrefPoly [Cryp],
Sirefef-CL, Dropper-IYB [Drp],
Corkow [Wrm],
ScriptIP-inf [Trj]
and IFrame-Inf

Most of the infected files seem to be AVG files (would these be quarentine files?) and I could not complet a boot scan as the PC tied up.

Since sorting out the IP issue the Svchost thing seems to have stopped, as has the hijacking. Confusing to say the least.

Re Avast - what happens to the files in the vault, it ran out of space afer the first scan, can I just delete them?

Mrs_Chip

I ran this in the Avast sandbox - does this matter?

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Penny at 15:58:24 on 2011-11-04
.
============== Running Processes ===============
.
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.co.uk/
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - No File
TB: {E97B5F2E-CA8E-4D34-BDA3-44EEC4ED2B12} - No File
TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No File
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
EB: {E97B5F2E-CA8E-4D34-BDA3-44EEC4ED2B12} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Google Update] "c:\documents and settings\penny\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Facebook Update] "c:\documents and settings\penny\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver
mRun: [MGSysCtrl] c:\program files\system control manager\MGSysCtrl.exe
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" update "software\cyberlink\youcam\1.0"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [EPSON Stylus Photo RX620 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB003" /M "Stylus Photo RX620"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [ContentTransferWMDetector.exe] c:\program files\sony\content transfer\ContentTransferWMDetector.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVXV1UtV0JEWEMtVllGTjMtUURKTUgtNDJBT0EtSzZIVTk"&"inst=NzctOTQxNjExNjEyLVNUMTJGT0krMS1ERFQrMC1FVUxBKzEtU1QxMkZBUFArMQ"&"prod=90"&"ver=2012.0.1834"&"mid=8e6f636c35e847d1aa4bd154d4290bf4-0
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: mswsock.dll
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} - hxxp://kitchenplanner.ikea.com/gb/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8C922C73-FFFA-45A3-B2C2-BC1E30074267} - hxxp://www.sony.co.uk/bravia/RegistrationAgent.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{B39B491E-699B-4580-A854-FC0B264408E6} : NameServer = 192.168.1.1
TCP: Interfaces\{B39B491E-699B-4580-A854-FC0B264408E6} : DhcpNameServer = 192.168.1.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R? AMService;AMService
R? AntiVirSchedulerService;Avira AntiVir Scheduler
R? AntiVirService;Avira AntiVir Guard
R? GT72NDISIPXP;GT 72 IP NDIS
R? GT72UBUS;GT 72 U BUS
R? gupdate;Google Update Service (gupdate)
R? gupdatem;Google Update Service (gupdatem)
R? ResultDns Service;ResultDns Service
R? RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter
S? aswFsBlk;aswFsBlk
S? aswSnx;aswSnx
S? aswSP;aswSP
S? avast! Antivirus;avast! Antivirus
S? avgio;avgio
S? avgntflt;avgntflt
S? GtDetectSc;GtDetectSc
S? Micro Star SCM;Micro Star SCM
S? RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader
.
=============== Created Last 30 ================
.
2011-11-03 22:39:35 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-03 22:39:02 41184 ----a-w- c:\windows\avastSS.scr
2011-11-03 22:38:40

---

d

---

w- c:\program files\AVAST Software
2011-11-03 22:38:40

---

d

---

w- c:\documents and settings\all users\application data\AVAST Software
2011-11-03 04:25:41

---

d

---

w- c:\program files\MALWAREBYTES ANTI-MALWARE
2011-11-02 07:08:59

---

d

---

w- c:\windows\pss
2011-11-01 22:47:01 388096 ----a-r- c:\documents and settings\penny\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-11-01 22:46:59

---

d

---

w- c:\program files\Trend Micro
2011-11-01 09:51:47

---

d

---

w- c:\documents and settings\penny\application data\AVG
2011-10-31 17:31:41

---

d--h--w- C:\$AVG
2011-10-31 16:23:17

---

d

---

w- c:\documents and settings\all users\application data\AVG2012
2011-10-31 16:16:40

---

d

---

w- c:\program files\AVG
2011-10-31 15:59:45

---

d--h--w- c:\documents and settings\all users\application data\Common Files
2011-10-31 15:59:06

---

d

---

w- c:\documents and settings\all users\application data\MFAData
2011-10-31 14:49:35 4554 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-10-31 14:22:01

---

d

---

w- c:\windows\system32\wbem\repository\FS
2011-10-31 14:22:01

---

d

---

w- c:\windows\system32\wbem\Repository
2011-10-31 14:20:27

---

d

---

w- c:\program files\Avira
2011-10-31 14:20:27

---

d

---

w- c:\documents and settings\all users\application data\Avira
2011-10-31 10:38:28

---

d

---

w- c:\program files\Avira(2)
2011-10-31 10:38:28

---

d

---

w- c:\documents and settings\all users\application data\Avira(2)
.
==================== Find3M ====================
.
2011-10-31 16:36:44 14336 ----a-w- c:\windows\system32\svchost.exe
2011-09-26 10:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 10:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20:51 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-08-31 17:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-22 23:48:55 916480 ----a-w- c:\windows\system32\wininet.dll
2011-08-22 23:48:54 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-08-22 23:48:54 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-08-22 11:56:39 385024 ----a-w- c:\windows\system32\html.iec
2011-08-17 13:49:54 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-15 09:50:26 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-11 16:41:06 360448

---

w- c:\windows\Setup1.exe
2011-08-11 16:40:58 73216 ----a-w- c:\windows\ST6UNST.EXE
.
============= FINISH: 16:04:58.03 ===============

Dave_C_2

closed wrote: »

output from
cmd
tasklist /svc

A little off topic but if I type tasklist /svc in a command window I get 'tasklist' is not recognised... Windows XP SP3 up to date.

Any ideas?

waddler_8

Mrs_Chip wrote: »

I have removed AVG and installed Avast, which has found several different infections:

Ramnit-G and H,
PrefPoly [Cryp],
Sirefef-CL, Dropper-IYB [Drp],
Corkow [Wrm],
ScriptIP-inf [Trj]
and IFrame-Inf

That's one heavily infected machine. You have (amongst others) signs of file infector(s) & a rootkit.

My advice would be to backup & reinstall.

You would have to be carefull what file types you backed up.

Read this for information about Ramnit.

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fRamnit

Mrs_Chip

And the second file ...

.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 8.2.0
Amazon MP3 Downloader 1.0.9
Ancestry.com World Archives Project Keying Tool Uninstaller
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft ShowBiz
avast! Free Antivirus
AVG PC Tuneup 2011
Avira AntiVir Personal - Free Antivirus
BBC iPlayer Desktop
Belltech Business Card Designer Pro 5.2.1
BigOven
Bluetooth Stack for Windows by Toshiba
calibre
Canon i80
CCleaner
Compatibility Pack for the 2007 Office system
Content Transfer
CyberLink YouCam
EPSON Printer Software
Facebook Video Calling 1.0.0.8714
Family Historian 3.0
FreeStar Free Video Converter 8.0.7
GIMP 2.6.11
Google Chrome
Google Earth
Google Update Helper
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP USB Disk Storage Format Tool
Huawei modem
ICON 225 USB Connect
Image Resizer Powertoy for Windows XP
Inkscape 0.48.2
Intel(R) Graphics Media Accelerator Driver
iTunes
Java(TM) 6 Update 17
Java(TM) 6 Update 7
Junk Mail filter update
Lizardtech DjVu Control
Malwarebytes' Anti-Malware version 1.51.2.1300
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Microsoft WSE 3.0 Runtime
MSN
MSVCRT
MSXML 6 Service Pack 2 (KB973686)
NWZ-A840 WALKMAN Guide
OpenOffice.org 2.4
PrtScr 1.5
QuickTime
Quo v2
Realtek Card Reader
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
REALTEK RTL8187SE Wireless LAN Driver
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows XP (KB923789)
Segoe UI
Skype Toolbars
Skype™ 5.3
Synaptics Pointing Device Driver
System Control Manager
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
USB Video/Audio Device Driver
VT Transaction+
WebFldrs XP
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
X2X Free Video Capture 2.0
Yontoo Layers Runtime 1.10.01
.
==== End Of File ===========================