another svchost.exe virus

i read about svchost.exe viruses here on this forum but i dont know where to start im not very known with viruses

and i dont wanna do something wrong with my pc.

Im using windows 7. my pc is going slower and slower day by day. When i open task manager and see the active processes, and there are around 7 svchost.exe active taking pretty much physical memory and cpu usage. 

i think this is where the virus is located but i dont know how to locate it and delete it.

i know there are many svchost.exe viruses but i dont know if they are all related by eachother or not so that's why im writing a new topic

thanks in advance

Hello ChentoX and welcome to Bleeping Computer.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.

• shut down your protection software now to avoid potential conflicts.
• run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
• the tool will open and start scanning your system
• please be patient as this can take a while to complete depending on your system's specifications
• on completion, a log (JRT.txt) is saved to your desktop and will automatically open
• post the contents of JRT.txt into your next message.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
JRT.txt
Frst.txt
Addition.txt

Thanks

Satchfan

 

Thanks for those logs. I'll wait for the others.

Edited by satchfan, 25 March 2016 - 06:08 PM.

why does it say that i have Available physical RAM: 1936.93 MB 

but i have 3gb ram and even when i check system properties it says that i have 3gb ram 

There are signs of illegal software on your system. If this is the case, please get rid of anything that is not legitimate and then run these scans.

• Please download MGADiag by clicking here and save it to your desktop
• double click the icon on your desktop
• push
• push
• go to Start -> Run and type in "Notepad"
• go to Edit -> Paste in notepad
• Copy and paste that log here.

================================================

 Run CKScanner

Download CKScanner by askey127 from here & save it to your Desktop.

• double-click CKScanner.exe then click Search For Files
• when the cursor hourglass disappears, click Save List To File
• a message box will verify the file saved
• double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply.

Satchfan

 

You have illegal software on your system, which is probably how your computer became infected.

Besides being illegal, cracks/keygens are the most certain means of infecting your system, as ALL illegal software contains some form of malicious code.

This forum, as well as all the other malware removal forums, does not condone the use of illegal software and does not offer support unless it is for the removal of it.

Continuing to help you could be viewed as supporting/condoning this.

If you want to continue, I need you to uninstall all the illegal software that you have downloaded and installed.

When you have done this, run CKScanner again and post a new log.

If I don’t hear back from you in 24 hours I'll close this thread.

Satchfan

i just need my computer good 

 

 

i just need my computer good

You’re going a funny way about it. You have P2P software, (uTorrent), installed on your machine which is obviously where the illegal software came from.

We are not here to pass judgment on file-sharing as a concept but we will warn you that engaging in this activity will always make your computer very susceptible to infection and re-infection.

If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. Those who write malware use P2P file-sharing as a major vehicle to spread their wares.

Please see this topic for more information:

P2P File Sharing Risks.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

HKLM-x32\...\Run: [HDD Regenerator] => C:\Program Files (x86)\HDD Regenerator\HDD Regenerator.exe
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2341275536-3932704989-374695252-1001\...\MountPoints2: F - F:\autorun.exe setup.exe
HKU\S-1-5-21-2341275536-3932704989-374695252-1001\...\MountPoints2: {134d1e89-06b0-11e5-9c6e-00e0b10a2d64} - F:\LGAutoRun.exe
HKU\S-1-5-21-2341275536-3932704989-374695252-1001\...\MountPoints2: {9a691342-0f5a-11e5-81a6-00e0b10a2d64} - G:\setup.exe
HKU\S-1-5-21-2341275536-3932704989-374695252-1001\...\MountPoints2: {abb594b7-fe14-11e4-a469-00e0b10a2d64} - F:\setup.exe
HKU\S-1-5-21-2341275536-3932704989-374695252-1001\...\MountPoints2: {f56293dc-0f7d-11e5-8e04-00e0b10a2d64} - H:\setup.exe
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2016-02-29 18:33 - 2016-02-29 18:33 - 00033818 _____ C:\Users\viksa\Downloads\ADOBE.DREAMWEAVER.CC.V2015.MULTI.WIN64-XFORCE.torrent
2015-05-03 00:35 - 2015-05-03 00:35 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Task: {4067C626-3C17-43AC-8F59-0770BF025F6E} - System32\Tasks\{30B14454-5239-4CCD-9875-5C4BA3C42F3C} => C:\Users\viksa\Desktop\Photoshop.exe
Task: {F518C764-075E-402E-948D-189791E4B121} - System32\Tasks\{38E99B40-73DD-4EE7-8BC2-95BFED3739C7} => C:\Users\viksa\Desktop\Photoshop.exe
AlternateDataStreams: C:\ProgramData\TEMP:B755D674 [136]
FirewallRules: [{CAD7689F-EF4D-4960-AC37-D9A0350A3059}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{980064CE-E674-412C-8306-0932CB35E377}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
C:\Users\viksa\AppData\Local\Temp\AAMHelper.exe
C:\Users\viksa\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\viksa\AppData\Local\Temp\avgnt.exe
C:\Users\viksa\AppData\Local\Temp\kernel32.dll
C:\Users\viksa\AppData\Local\Temp\ose00000.exe
C:\Users\viksa\AppData\Local\Temp\sqlite3.dll
C:\Users\viksa\AppData\Local\Temp\_is8E16.exe
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

===================================================

Run AVG removal tool

There are remnants of AVG on your computer so please download AVG Removal Tool from here.

When you’ve done that, please run FRST again and send the new log.

Satchfan

 

when i start avg removal tool it just open shell and closes it instantly 

after it avgremover.txt file is created in the same place as avg removal with content :