Another dllhost.exe victim

[Fishmom]

Thank you so much! It is doing better. Is is normal for there to still be 50 plus processes going in the Task Manager? The Malwarebytes keeps saying that it is blocking malicious sites from explorer.exe. Normal?

 

[TwinHeadedEagle]

Processes are normal, but malwarebytes not. Let's take one more scan:

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[Fishmom]

Here they are. Thanks.

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Fishmom]

hmm, I saved the fixlist.txt to my desktop and followed your directions, but it says "No fixlist.txt found." When I open the fixlist.txt this is all that is on there:
closeprocesses:
emptytemp:
2014-10-16 17:43 - 2014-10-30 07:53 - 00000000 ___HD () C:\ProgramData\{D9E629DC-CB1C-4A97-9900-81922B4EFFD4}

 

[TwinHeadedEagle]

This is because you didn't save fixlist on the same location as FRST.

 

[Fishmom]

I'm not sure what you mean as they are both saved to my desktop. The fixlist.txt that you attached above is 140 bytes. What should my next step be? Thank you.

 

[TwinHeadedEagle]

If they are both, open FRST and click Fix.

 

[Fishmom]

Ok, thanks, I ran the fix, but it did not generate a fixlog.txt on my desktop as it did before. :headscratch:

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[Fishmom]

Here they are. Thanks so much.

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Fishmom]

I am having the same issue as before; it says no fixlist.txt found, but I see it right there on my desktop. I will attach another scan report.

 

[TwinHeadedEagle]

There is no fixlist, because you run FRST from Download folder. Please correct it.

 

[Fishmom]

I ran it from the icon on the desktop. What should I do differently?

 

[TwinHeadedEagle]

I saw this:

Running from C:\Users\WelhamKids\Downloads

Please delete all FRST icons, then download fresh one and put it on the Desktop. Then download fixlist on the Desktop too.