Solved dllhost.exe COM SURROGATE problem

[GadgetMal]

I cannot keep the dllhost.exe processes from coming back up in the task manager. I'm running in safe mode currently and it won't go away after I end the process.

 

[GadgetMal]

I ran the FARBAR Scanner and here are the files it generated.

 

[argus]

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

HKU\S-1-5-21-73586283-1343024091-1801674531-1622\...\MountPoints2: F - F:\VZAccess_Manager.exe /z detect
HKU\S-1-5-21-73586283-1343024091-1801674531-1622\...\MountPoints2: {1e7d823e-2ca1-11e1-8a4e-70f3958460c6} - F:\HPLauncher.exe
HKU\S-1-5-21-73586283-1343024091-1801674531-1622\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=406&sr=0&q={searchTerms}
C:\Users\spayne\AppData\Local\iLivid
C:\Users\spayne\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\spayne\g2ax_expert_downloadhelper_win32_x86.exe
EmptyTemp:

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.


3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.













Scan with Combofix:

• Please download ComboFix by sUBs and save it to your Desktop.
  You may read how Combofix works here.
  
• Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
  If you are unsure how to do this please read this or this Instruction.
  
• Run ComboFix. Click on I Agree! & follow the prompts.
  Note: If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.
  
• When finished, it will produce a report for you. Please attach log reports (ComboFix.txt) back to topic.
  (typical log location: C:\ComboFix.txt )

 

[GadgetMal]

Fixlog attached..

 

[argus]

I need Combofix.txt

 

[GadgetMal]

I was unable to temporarily disable Webroot AV software... I'm working with my vendor on that..but here is the file it generated.

 

[argus]

How's your computer behaving now?

 

[GadgetMal]

the process is no longer running and the pc seems to be acting normal so far.. thanks!

 

[argus]

It is necessary to uninstall ComboFix :

• Click Start (or
  
  ) then Run.
  
  
  On Windows7 or Vista you may use Start Search field if Run is not available.
  
• In the line of text type in (Copy) the following:
  
  

  ComboFix /Uninstall

  Note that there is a space between " ComboFix " and " /Uninstall " .
  
• then click OK (or press Enter ).

Wait for the uninstall process is complete.









• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

 

[GadgetMal]

thanks!