Help! com surrogate virus :(

[blythepotter]

workstation has been displaying pop-ups saying "Your current security settings do not allow this file to be downloaded". Hundreds and hundreds of times an hour. com surrogate and multiple Dllhosts.exe processes running in the task manager. FRST.txt and Additional.txt have been attached, any help is appreciated

 

[TwinHeadedEagle]

Hello,


I am not sure I can help you, because this is not home edition windows, but let's try. Currently I do not see signs of infection here.

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

Scan with RogueKiller

Please download RogueKiller and save the file to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the pre-scan will be done. It shouldn't take more than 2-3 minutes.
• Accept the Terms of use.
• When the Scan button becomes available, please click it. RogueKiller will start a full scan.
• Let this process run uninterrupted!.
• When finished, a Report button will become available. Click it. You will be presented with a logfile.

Please include the content of this logfile in your next reply.

 

[blythepotter]

Thank you for getting back to me so quickly! Sorry I didn't get back yesterday I was out of town getting my car fixed in Redmond. I am currently running the scan tools and will report back asap

 

[blythepotter]

Well, this workstation is still infected after hours of trying to clear this malware/virus I re-ran the FARBAR scan under the infected user's profile this time. I'm thinking they will have different results. I will have to come in this weekend and work some overtime to get this resolved. I would just reformat the c:\ drive but we dont have access to some important Certs installed. Please take a look at these NEW scan results and let me know what the next step is. Thanks TwinHeadedEagle

 

[TwinHeadedEagle]

You did not follow my instructions.