c:\windows\syswow64\drivers\svchost.exe

so this is popping up none stop on malwarebytes i thought it was a mistake so i closed malwarebytes took a shower and came back to about 22 different programs that installed while i was in the shower.

 

so i uninstalled all the programes rand malbytes super antivirues kaspersky tdsskiller and mwb antirootkit.

 

been hunting around on these forums trying to find a solutions but everything i do turns up empty handed and this malwarebytes warning keeps showing up could anyone help me out?

Hi & to Bleeping Computer Forums!
My name is Jürgen and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully:

• My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
• Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
• If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now!
• Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
• Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
• If I don't hear from you within 5 days from this initial or any subsequent post, then this thread will be closed.
• If I don't reply within 24 hours please PM me!
• Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.

Step 1

Please run a FRST scan. This will help us diagnose your problem.


Please download Farbar Recovery Scan Tool and save it to your Desktop.
(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)

• Start FRST with administator privileges.
• Make sure the option Addition.txt is checked and press the Scan button.
• When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
• Please copy and paste these logs in your next reply.

FRST.txt is missing.

kept saying error post to long

Hi there,

Step 1

• Please download and install Revo Uninstaller Free
  note: there is no need to click anything on that page, the download will start automatically
• Double click Revo Uninstaller to run it
• From the list of programs double click on the listed program(s) to remove it:
  

  globalupdate Helper

• When prompted if you want to uninstall click Yes
• Be sure the Moderate option is selected then click Next
• The program will run, If prompted again click Yes
• When the built-in uninstaller is finished click on Next
• Once the program has searched for leftovers click Next
• Check the items in bold only on the list then click Delete
  note: you may have to expand some folders by clicking the "+" mark
• When prompted click on Yes and then on Next
• Put a check on any folders that are found and select Delete
• When prompted select Yes then Next
• Once done click Finish

Step 2

Please download AdwCleaner (by Xplode) and save it to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select "Run As Administrator"
• Click on the Scan button.
• After the scan has finished, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• After rebooting, a log file (that is saved in C:\AdwCleaner[S#].txt) will open automatically.
  Copy and paste the contents of that logfile in your next reply.

Step 3



Scan with Malwarebytes Anti-Malware.

• Please open Malwarebytes Anti-Malware and update the database.
• Click "Settings" [1] and go to "Detection and Protection" [2]
• Make sure "Scan for Rootkits" is checked.
• Click on Dashboard [3], then click on Scan Now [4] to start the scan.
  If Malware or Potentially Unwanted Programs [PUPs] are found, you will receive a prompt:
  
• Click on "Remove Selected" [5].
• Then click "Save Results" [6] and select
  

• Return to our forum. Paste your log into your next reply and then click Finish [7].

Step 4



Start FRST with administator privileges.

• Make sure the following option is checked:
• Press the Scan button.
• When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
  Please copy and paste these logs in your next reply.

Step Three:

Step 1



Press the + R on your keyboard at the same time. Type notepad and click OK.

• Copy the entire content of the codebox below and paste into the notepad document:
  

  CloseProcesses:
  C:\ProgramData\4bf6f2c49d004f2aba9c312f14be371c
  C:\WINDOWS\SysWOW64\drivers\syscomplus80.exe
  C:\ProgramData\Kikblaster
  C:\WINDOWS\SysWOW64\drivers\NVACYU~1.EXE 
  C:\ProgramData\5ac8bbe84ef54973a48db1c2e820ec2b
  C:\WINDOWS\SysWOW64\drivers\KVN398~1.EXE 
  C:\Program Files\KMSpico
  C:\ProgramData\FlashBeat
  Task: {1A6CD6FE-FB0F-419D-B601-87BB11D12D49} - \avabvbxvh No Task File 
  Task: {1D1FB722-D354-4EC7-8C89-DDA32A015342} - System32\Tasks\AlaMaintenance => C:\WINDOWS\SysWOW64\drivers\NVACYU~1.EXE [2015-05-15] ()
  Task: {37B648E8-9792-4535-B096-376323DB3F64} - System32\Tasks\IJTKKZ => C:\ProgramData\5ac8bbe84ef54973a48db1c2e820ec2b\5ac8bbe84ef54973a48db1c2e820ec2b.exe
  Task: {4C61156C-8B12-4EBF-A1B8-77049645993E} - System32\Tasks\Media_System_Platform => C:\WINDOWS\SysWOW64\drivers\KVN398~1.EXE [2015-05-15] ()
  Task: {4DBCD115-BBCB-4875-A94D-BA0CE2DFA2C4} - System32\Tasks\PKFWGHDRL1 => C:\ProgramData\FlashBeat\FlashBeat.exe 
  Task: {7779881F-BBDA-4CB8-A174-92B9C806B94D} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2014-10-22] (@ByELDI)
  Task: {7C93D5DA-1C88-43D5-8852-6085A24E1A3E} - System32\Tasks\OTZRX1 => C:\ProgramData\Kikblaster\Kikblaster.exe
  Task: {8E7A06AA-E422-4199-9863-3D9336EE410E} - System32\Tasks\propagation utility manager => C:\WINDOWS\SysWOW64\drivers\syscomplus80.exe
  Task: {A430AC5D-C0A5-4F3C-9436-978FBC3EC3F3} - System32\Tasks\ICRNZUSHUQ => C:\ProgramData\4bf6f2c49d004f2aba9c312f14be371c\4bf6f2c49d004f2aba9c312f14be371c.exe
  Task: C:\WINDOWS\Tasks\OTZRX1.job => C:\ProgramData\Kikblaster\Kikblaster.exe
  Task: C:\WINDOWS\Tasks\PKFWGHDRL1.job => C:\ProgramData\FlashBeat\FlashBeat.exe 
  HKU\S-1-5-21-1980555204-4143441623-2282392220-1001\...\Run: [GoogleChromeAutoLaunch_36D1BC24B0BF8F597389900CC2C421B1] => 
  C:\Program Files (x86)\Crossbrowse
  HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
  SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  SearchScopes: HKU\S-1-5-21-1980555204-4143441623-2282392220-1001 -> {25DF0331-57E8-4F0D-8711-A1220FA79E1A} URL = 
  R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [966288 2014-10-22] (@ByELDI) [File not signed]
  S2 AlaPerformance; C:\WINDOWS\SysWOW64\drivers\svchost.exe run [X]
  2015-05-20 20:32 - 2015-05-20 20:44 - 00000112 _____ () C:\ProgramData\kwKR316Cd.dat
  2015-05-20 20:21 - 2015-05-20 21:07 - 00000000 ____D () C:\Program Files (x86)\bb11f101-c797-45eb-a909-19cc926b3749
  2015-05-20 20:21 - 2015-05-20 20:49 - 00000000 ____D () C:\ProgramData\abc
  2015-05-20 20:16 - 2015-05-20 20:16 - 00000064 _____ () C:\Users\Brandon\AppData\Local\0b0903fc5c820e56e6828fcfa43bc4a0
  2015-05-20 20:16 - 2015-05-20 20:16 - 00000000 ____D () C:\Users\Brandon\Downloads\YTDL
  2015-05-20 20:11 - 2015-05-20 20:11 - 00000000 ____D () C:\ProgramData\12db864551ae4c578eb17db1a9f5d3cf
  2015-05-20 20:08 - 2013-08-22 06:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hp.bak
  2015-05-20 20:06 - 2015-05-20 21:07 - 00000000 ____D () C:\Program Files (x86)\5be4c51c-ec94-46a8-ba6b-b31f5f494342
  2015-05-20 20:06 - 2015-05-20 20:20 - 00000004 _____ () C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
  2015-05-20 20:03 - 2015-05-20 20:03 - 00000156 _____ () C:\WINDOWS\SysWOW64\Drivers\adip58209xxc.sys
  

• Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

Step 2

Please downloadOnline Scanner and save it to your Desktop.

• Disable the realtime-protection of your antivirus and anti-malware programs because they might interfere with the scan.
• Start with administartor privileges.
• Select the option Yes, I accept the Terms of Use and click on Start.
• Choose the following settings:

• Click on Start. The virus signature database will begin to download. This may take some time.
• When completed the Online Scan will begin automatically.
  Note: This scan might take a long time! Please be patient.
• When completed, click on Finish.
• A log fileis created at
  Copy and paste the content of this log file in your next reply.

Note: Do not forget to re-enable your antivirus application after running the above scan!

Edited by Brandon85c, 22 May 2015 - 10:05 AM.

Please post the log as instructed.

hehe i edited it right after you posted that sorry about that

Step 1



Press the + R on your keyboard at the same time. Type notepad and click OK.

• Copy the entire content of the codebox below and paste into the notepad document:
  

  CloseProcesses:
  C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\syscomplus80.exe
  C:\Windows\SECOH-QAD.dll
  C:\Windows\SECOH-QAD.exe
  C:\Windows\System32\drivers\msconfigvm.exe
  C:\Windows\System32\drivers\sysdriver32l.exe
  C:\Windows\System32\drivers\UMDF\en-US\eventlogman32.exe
  C:\Windows\SysWOW64\drivers\msconfigvm.exe
  C:\Windows\SysWOW64\drivers\sysdriver32l.exe
  C:\Windows\SysWOW64\drivers\UMDF\en-US\eventlogman32.exe
  CreateRestorePoint:
  EmptyTemp:
  

• Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.




Can you please tell me which problems still persist now?