Jump to content

Malwarebytes

Issue with svchost.exe causing memory leak and random background music! Help!

- - - - -

26 replies to this topic

#21
TheDarkKnight

    Elite Member

  • Trusted Advisors
  • PipPipPipPipPip
  • 1,090 posts
  • Gender:Male
  • Location:Gotham City
  • Interests:Malware Hunting, sport and of course listening to music ^_^
Hello morrowc. :)

Please navigate to these files and delete them (if present):

C:\Users\Morrow\Downloads\blu-ray-creator-express.exe
C:\Users\Morrow\Downloads\Dump_DR0.mbr
C:\Users\Morrow\Downloads\Dump_Hdd0_DR0.mbr

Next, please download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Finally, please download ATF Cleaner.
Save it to your Desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Click Select All found at the bottom of the list.
  • Click the Empty Selected button.
If you use Firefox browser, do this also:
  • Click Firefox at the top and choose Select All from the list.
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser, do this also:
  • Click Opera at the top and choose Select All from the list.
  • Click the Empty Selected button.
  • NOTE: : If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
===========

Please provide checkup.txt and a description of any remaining computer issues. :)

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!


If I have helped you please consider donating to the Neuroscience Research Institute.


Posted Image
Posted Image


#22
morrowc

    New Member

  • Members
  • Pip
  • 15 posts
Here's the checkup.txt:

Results of screen317's Security Check version 0.99.49
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 8 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.62.0.1300
Java™ 6 Update 10
Java version out of Date!
Adobe Flash Player 11.3.300.271 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Google Chrome 21.0.1180.79
Google Chrome 21.0.1180.83
Google Chrome CommonDotNET.dll..
Google Chrome IdVaultCore.dll..
Google Chrome IdVaultCore.XmlSerializers.dll.
Google Chrome Microsoft.mshtml.dll.
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````


I am not noticing any remaining issues! But I do have two questions:
1) Did this last step remove the "25 threats" that the ESET online scanner found?
2) What software do you recommend I use after we get everything cleaned to best prevent getting these types of infections in the future? Right now I just have MAM, but I can install Norton Security Suite at any time as well. Is there anything else you'd recommend or are those two enough? Thanks so much for all your help - you totally saved me!

#23
TheDarkKnight

    Elite Member

  • Trusted Advisors
  • PipPipPipPipPip
  • 1,090 posts
  • Gender:Male
  • Location:Gotham City
  • Interests:Malware Hunting, sport and of course listening to music ^_^
Hello morrowc. :)

Quote

1) Did this last step remove the "25 threats" that the ESET online scanner found?
Some of those threats were in ComboFix's quarantine already so they are fine. The others were in your temporary internet files, which ATF Cleaner successfully emptied so those are gone as well.

Quote

2) What software do you recommend I use after we get everything cleaned to best prevent getting these types of infections in the future? Right now I just have MAM, but I can install Norton Security Suite at any time as well. Is there anything else you'd recommend or are those two enough? Thanks so much for all your help - you totally saved me!
After the updates come back successful I will answer this question. :)

I notice that you have the User Account Control turned off. This is a very important security feature on Windows Vista and 7, as it allows you to restrict access to your computer and control programs that try to run. Please see below on how to turn it on:

http://windows.micro...ntrol-on-or-off
===========

Please do the following updates. Your Windows and Internet Explorer are out of date and by updating to the latest Service Packs you will minimise the risk of future infections through these security patches and fixes.

Service Pack 1 (SP1) is an extremely important update for Vista and Windows 7 and will help reduce the chance of an infection through security patches. I strongly recommend you install this update.

Please open Internet Explorer and follow the instructions below to update Windows:
  • Go to this link: Windows Update
  • Download all the Critical updates, making sure you have selected SP1 and Internet Explorer 9.
  • Once they have been installed, please revisit Windows Update and select any further Critical updates.
Note:
It will be necessary for you to restart the computer during the updates, and return to the Windows Update site several times before all critical updates are installed.

IMPORTANT: Please enable Automatic Updates under Start > Control Panel > Automatic Updates to ensure your Windows updates regularly. This is extremely important in ensuring you remain protected against vulnerabilities and infections.
===========

Your version of Java is out of date. It's important to remove older versions of Java since it does not do so automatically and older versions can leave you vulnerable.

Please follow the instructions below to update Java:
  • Please go to the below link and download the latest Windows 7 version:
http://www.java.com/...load/manual.jsp

  • Save it to your Desktop.
  • Please go to Start>Control Panel>Programs and Features>Programs.
  • Navigate to any versions of Java (J2SE Runtime Environment) you have installed. They will have this icon next to them: Posted Image
  • Select Remove.
  • Please double-click the installer and follow the prompts to install the latest version once all the previous versions have been successfully removed.
Next, your version of Adobe Reader is out of date. It could have security vulnerabilities, so please follow these instructions to update it:
  • Please go to Start>All Programs>Adobe Reader.
  • Open Adobe Reader and navigate to Help>Check for Updates.
  • Please follow the prompts to install the latest version.
Finally, your version of Adobe Flash Player is out of date. Please follow these instructions to update to the latest version:

Go to the Adobe Global Notifications Update website here:

http://www.macromedi...r05.html#118377

A small box to the right within the window should load. Please select how often you would like Adobe to check for a new update for its Flash Player.
[indent]Note: This has to be done separately for Firefox and IE.[/indent]

If a new version is found:
  • Please tick the License Agreement.
  • Click Install.
    [indent]Note: If you are running Mozilla Firefox all of its windows will need to be closed.[/indent]
  • Click Done.
Note: In future if an update is available Adobe will notify you on your Desktop via the Adobe Download Manager.
==========

In your reply please let me know how the updates go. :)

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!


If I have helped you please consider donating to the Neuroscience Research Institute.


Posted Image
Posted Image


#24
morrowc

    New Member

  • Members
  • Pip
  • 15 posts
I applied all the updates - everything seems to be running fine!

#25
TheDarkKnight

    Elite Member

  • Trusted Advisors
  • PipPipPipPipPip
  • 1,090 posts
  • Gender:Male
  • Location:Gotham City
  • Interests:Malware Hunting, sport and of course listening to music ^_^
Hello morrowc. :)

Quote

I applied all the updates - everything seems to be running fine!
That's great!

A little housekeeping to uninstall ComboFix:

Please click Start>Run and copy/paste the following text, including the space between "ComboFix and "/uninstall", into the Run box and click OK:

ComboFix /uninstall

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Right-click the Recycle Bin and please select Empty Recycle Bin.
==========

Please consider using these ideas to help secure your computer. While there is no way to guarantee safety when you use a computer, these steps will make it much less likely that you will need to endure another infection. While we really like to help people, we would rather help you protect yourself so that you won't need that help in the future. :thumbup:


IMPORTANT: Please enable Automatic Updates under Start > Control Panel > Automatic Updates to ensure your Windows updates regularly. This is extremely important in ensuring you remain protected against vulnerabilities and infections. This is a crucial security measure.


As a minimum, you need at least an antivirus, firewall and some type of anti-spyware program.

Please consider installing and running the following program (there is a free version available):

SpywareBlaster
A tutorial on using SpywareBlaster to prevent malware from ever installing on your computer may be found here.


Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster, can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you may be able to find out if it is a rogue here:

http://www.spywarewa...nti-spyware.htm

A similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.


Please consider using an alternate browser. Mozilla's Firefox browser is a very good alternative. In addition to being generally more secure than Internet Explorer, it has a very good built-in popup blocker and Add-ons, like Adblock Plus and NoScript, can make it even more secure. To avoid dangerous sites Web of Trust or McAfee SiteAdvisor can be installed. Google Chrome or Opera are other good options.

Two useful programs for keeping your programs up-to-date are FileHippo or Secunia PSI. Running one of these regularly will help you obtain the latest program updates.

Please also read Tony Klein's excellent article: How did I get infected in the first place.

Hopefully these steps will help to keep you error free. If you run into more difficulty, we will certainly do what we can to help. :)

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!


If I have helped you please consider donating to the Neuroscience Research Institute.


Posted Image
Posted Image


#26
morrowc

    New Member

  • Members
  • Pip
  • 15 posts
Just wanted to say thanks, you totally saved me! Took all your advice. MAM scans continue to come back clean!

#27
screen317

    MBAM Sentinel

  • Moderators
  • PipPipPipPipPipPip
  • 19,465 posts
  • Gender:Male
  • Location:New Haven, CT
Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!
Chris Fistonich
Research Team

Posted Image

Follow us: Twitter, Become a fan: Facebook





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

Follow Us