Solved dllhost*32 COM Surrogate, fff5ee.com, possibly powelik intrusion?

jyoung927

New Member
Thread author
Nov 10, 2014
11
As the title states, i'm getting messages involving these issues, seems to be initiating from c:\\windows\SysWOW64\dllhost.exe . I also see "malicious website blocked" that points to fff5ee.com and searchnet.blinkxcore.com.

The dllhost*32 COM Surrogate keeps replicating and bogging the system down. I've seen it in here countless times, but all the threads say the fixes are specific to individual machines, so here I am. Thanks for your help.

Here are the requested attached text files.

Jyoung927
 

Attachments

  • Addition.txt
    30.2 KB · Views: 75
  • FRST.txt
    50.8 KB · Views: 92

argus

Former MalwareTips Staff
Verified
Apr 24, 2014
3,395
Helllo,

Before we begin, please note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.


===========================================




Download
51a5f31352b88-icon_MBAR.png
Malwarebytes Anti-Rootkit to your desktop.
  • Double-click the icon to start the tool.
  • It will ask you where to extract it, then it will start.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Click in the introduction screen "next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder and paste the content of the following files in your next reply:
    • "mbar-log-{date} (xx-xx-xx).txt"
    • "system-log.txt"





FRST.gif
Scan with Farbar Recovery Scan Tool
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please include their content into your next reply.
 

jyoung927

New Member
Thread author
Nov 10, 2014
11
OK, I ran the MBAR scan, it produced zero results. (I forgot that earlier this morning, I also ran an anti-rootkit search called kapersky tdsskiller, which also produced nothing.)

Regardless, here are the results of the FRST64 scan the second time around.


Thanks
 

Attachments

  • Addition.txt
    30.4 KB · Views: 43
  • FRST.txt
    50.4 KB · Views: 119

argus

Former MalwareTips Staff
Verified
Apr 24, 2014
3,395
FRST.gif
Fix with Farbar Recovery Scan Tool

icon_exclaim.gif
This fix was created for this user for use on that particular machine.
icon_exclaim.gif

icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
icon_exclaim.gif
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 

Attachments

  • fixlist.txt
    611 bytes · Views: 56

jyoung927

New Member
Thread author
Nov 10, 2014
11
Ok, ran FRST with fixlist.txt in the same folder. It went through the process and restarted. Here's the fixlog.txt:


Also, just checked task manager, none of the rogue "dllhost*32 COM Surrogate" processes are running currently.
 

Attachments

  • Fixlog.txt
    1.8 KB · Views: 51

argus

Former MalwareTips Staff
Verified
Apr 24, 2014
3,395
Very good


Download DelFix by Xplode and save it to your desktop.
  • Run the tool by right click on the
    51a5ce45263de-delfix.png
    icon and Run as administrator option.
  • Make sure that these ones are checked:
    • Remove disinfection tools
    • Purge system restore
    • Reset system settings
  • Push Run and wait until the tool completes his work.
  • All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
 

jyoung927

New Member
Thread author
Nov 10, 2014
11
Done, done, and done. Do you want to see the txt file? And are we assuming the machine is clean now? That seems way too easy!
 

jyoung927

New Member
Thread author
Nov 10, 2014
11
Everything seems to be good. I also seemed to be having an issue where I'd navigate to a folder that included jpgs, and the preview pictures wouldn't populate properly. That seems to be fixed as well. Thanks a ton! Sending you beer money in 5, 4, 3....
 

jyoung927

New Member
Thread author
Nov 10, 2014
11
So, after a month, it seems like now my computer is acting a bit sluggish. There are no signs of this mal-ware here, but videos aren't playing smoothly, graphics aren't animating as smoothly as they should. I've got an i-7 2.9ghz processor, intel HD graphics 4600 graphics card, and an AMD Radeon 8690 video card. It used to be lightning fast, now, not so much. Any thoughts?
 

jyoung927

New Member
Thread author
Nov 10, 2014
11
Ok, my security settings wouldn't let me download the most current version of FRST for some reason, but the one I ran generated the attached reports.
 

Attachments

  • Addition.txt
    30.8 KB · Views: 85
  • FRST.txt
    55.1 KB · Views: 128

argus

Former MalwareTips Staff
Verified
Apr 24, 2014
3,395
51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on
    51a612a8b27e2-Zoek.png
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    Code:
    createsrpoint;
    autoclean;
    emptyalltemp;
    ipconfig /flushdns;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.
 

jyoung927

New Member
Thread author
Nov 10, 2014
11
Ok, scan completed, computer rebooted, here's what we've got:

Zoek.exe v5.0.0.0 Updated 12-December-2014
Tool run by Jeremy on Fri 12/12/2014 at 13:39:49.96.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Jeremy.CECOFRICTION\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

12/12/2014 1:41:32 PM Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\PROGRA~2\Invincea deleted successfully
C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully
C:\Users\Jeremy\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1012268522-3862409761-1773176339-1120\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F4E39681-15F8-4fda-B8A3-B5C98378F2F3} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Batch Command(s) Run By Tool======================


==== Deleting Files \ Folders ======================

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found
C:\Windows\sysWoW64\config\systemprofile\.android deleted
C:\MININT deleted
C:\Users\Jeremy.CECOFRICTION\AppData\Roaming\GetRightToGo deleted
C:\PROGRA~3\Package Cache deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
C:\Users\Jeremy.CECOFRICTION\Documents\Updater deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.5.0.19\IPSFF" [11/17/2014 08:26 AM]

==== Chromium Look ======================

Google Chrome Version: 39.0.2171.95 (Up to date, latest Stable version: 39.0.2171.95)

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
iikflkcanblccfahdhdonehdalibjnif - No path found[]
mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\21.5.0.19\Exts\Chrome.crx[07/31/2014 12:47 AM]

Angry Birds - Jeremy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj
Google Cast - Jeremy\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd
Poppit - Jeremy\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi
Angry Birds - Jeremy.CECOFRICTION\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj
Google Voice Search Hotword (Beta) - Jeremy.CECOFRICTION\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
Google Cast - Jeremy.CECOFRICTION\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd
Poppit - Jeremy.CECOFRICTION\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\abjcfabbhafbcdfjoecdgepllmpfceif
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnomihfieiccainjcjblhegjgglakjdd
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckgahadagoaajjgafhacjanaoiihapd
undetermined - Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp

==== Chromium Startpages ======================

C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.google.com/ig",
"startup_urls": [ "http://www.google.com/ig", "https://www.google.com/voice#inbox" ],

C:\Users\Jeremy.CECOFRICTION\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.google.com/ig",
"startup_urls": [ "http://espn.go.com/", "http://www.reddit.com/" ],


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
{1508D300-D0B8-4300-A4FD-B5525C4E84EA} Google Url="https://www.google.com/search?q={searchTerms}"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1012268522-3862409761-1773176339-1120\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully
HKEY_USERS\S-1-5-21-1012268522-3862409761-1773176339-1120\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{22C7F6C6-8D67-4534-92B5-529A0EC09405} deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Jeremy.CECOFRICTION\AppData\Local\Invincea\Enterprise\U1_1\user\current\AppData\Local\Invincea\Enterprise\IE\Cache\Content.IE5 emptied successfully
C:\Users\Jeremy.CECOFRICTION\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Jeremy.CECOFRICTION\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\Jeremy.CECOFRICTION\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=40 folders=48 64619402 bytes)

==== Empty Temp Folders ======================

C:\Users\administrator\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Jeremy\AppData\Local\Temp emptied successfully
C:\Users\Jeremy.CECOFRICTION\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\JEREMY~1.CEC\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Fri 12/12/2014 at 14:10:28.72 ======================
 

argus

Former MalwareTips Staff
Verified
Apr 24, 2014
3,395
System is clean, just removed the temp files and crap.
How's your computer behaving now?
 

jyoung927

New Member
Thread author
Nov 10, 2014
11
It still seems like it's lagging/jiddery when playing a game or watching a youtoube video (specifically, one in 720p 60fps), and running programs like photoshop and illustrator. I assumed i had plenty of hardware to do these things smoothly, and i feel like when i bought the computer, it ran more smoothly. Any other thoughts about settings or anything I could look at?
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top