DLLHOST.EXE eating through all my memory please help me

plz help · Oct 17, 2015

After chugging for a long time my PC decided to reboot, and when i looked into the task manager one of the processes was using waaaaaaaaaaaaaay too much memory. I did a little digging and found out this was a pretty infamous virus, not sure wut to do, im not very adept with computers. Just barely enough to get by with basic things.

TwinHeadedEagle · Oct 17, 2015

Hello,

They call me TwinHeadedEagle around here, and I'll be working with you.

Before we start please read and note the following:

At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
Please attach all report using

button below. Doing this, you make it easier for me to analyze and fix your problem.
Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay for the repair.

Rules and policies

We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Scan with Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

Install the progam and select update.
Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.
Click the Scan tab, choose Threat Scan is checked and click Scan Now.
If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs and double-click the Scan Log.
At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on

icon and select

Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

Code:

createsrpoint;
autoclean;
emptyclsid;
emptyalltemp;
ipconfig /flushdns >>"%temp%\log.txt";b

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

plz help · Oct 17, 2015

Thank you for the quick response.

Scan Log from MalwareBytes
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/17/2015
Scan Time: 5:38 PM
Logfile: Scan Log.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.10.17.05
Rootkit Database: v2015.10.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: KuroHANA

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 360129
Time Elapsed: 1 hr, 36 min, 15 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 23
PUP.Optional.Spigot, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}, Quarantined, [3dcc3a1e3e4d64d22e203acd5fa3ef11],
PUP.Optional.Spigot, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}, Quarantined, [3dcc3a1e3e4d64d22e203acd5fa3ef11],
PUP.Optional.Spigot, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}, Quarantined, [3dcc3a1e3e4d64d22e203acd5fa3ef11],
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}, Quarantined, [3dcc3a1e3e4d64d22e203acd5fa3ef11],
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}, Quarantined, [3dcc3a1e3e4d64d22e203acd5fa3ef11],
PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}, Quarantined, [0dfcf068c7c42e0886c76b9cb34f27d9],
PUP.Optional.SearchQu, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, Quarantined, [0dfcf068c7c42e0886c76b9cb34f27d9],
PUP.Optional.SearchQu, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, Quarantined, [0dfcf068c7c42e0886c76b9cb34f27d9],
PUP.Optional.SearchQu, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, Quarantined, [0dfcf068c7c42e0886c76b9cb34f27d9],
PUP.Optional.VuzeTB, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{05478A66-EDB6-4A22-A870-A5987F80A7DA}, Quarantined, [749569ef8ffcff37907ac96ba55d837d],
PUP.Optional.VuzeTB, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{05478A66-EDB6-4A22-A870-A5987F80A7DA}, Quarantined, [749569ef8ffcff37907ac96ba55d837d],
PUP.Optional.Spigot, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{3A787631-66A2-4634-B928-A37E73B58FB6}, Quarantined, [0ffae3759eed4aec45d6af88936d966a],
PUP.Optional.SearchQu, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, Quarantined, [65a40355840742f4b337bad7f50e50b0],
PUP.Optional.SlickSavings, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\mhkaekfpcppmmioggniknbnbdbcigpkk, Quarantined, [a7620157d9b2c274ac13d6be699a08f8],
PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, Quarantined, [67a24d0b0388b6802ebcbed355ae53ad],
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\APPDATALOW\SOFTWARE\Search Settings, Quarantined, [34d52f29ee9d7fb7fed83a5cf11212ee],
PUP.Optional.SerachQU, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\APPDATALOW\SOFTWARE\searchqutoolbar, Quarantined, [f9105cfc434892a40c479ef51be811ef],
PUP.Optional.SlickSavings, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\APPDATALOW\SOFTWARE\Slick Savings, Quarantined, [c5447ddbd7b472c4c2fc8014f013da26],
PUP.Optional.Conduit, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [8b7e60f8aae1a78fb7601a4fc142649c],
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{21E15933-AA34-466E-A6EA-4CA64A5AA051}, Quarantined, [c94091c71378a88e95437f1711f29868],
PUP.Optional.SearchQu, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, Quarantined, [74954612d1ba57df8b5c1f727f84867a],
PUP.Optional.YahooVNM, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C0C3A6C6-03BC-4195-8FCB-AEA091301353}, Quarantined, [1aefbf994b408da9fb42b5ed20e3817f],
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EE44DE45-A46E-447E-A245-3DD0C7F3F07F}, Quarantined, [34d50c4c3d4e6acc5583e2b4dc27b54b],

Registry Values: 12
PUP.Optional.SearchQu, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|URL, http://www.searchqu.com/web?src=ieb&appid=146&systemid=406&sr=0&q={searchTerms}, Quarantined, [65a40355840742f4b337bad7f50e50b0]
PUP.Optional.SearchQu, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SuggestionsURL_JSON, http://www.searchqu.com/suggest.php?src=ieb&appid=146&systemid=406&qu={searchTerms}&ft=json, Quarantined, [030616422368171fc9218d04768d25db]
PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|URL, Ask.com, Quarantined, [67a24d0b0388b6802ebcbed355ae53ad]
PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SuggestionsURL_JSON, http://www.searchqu.com/suggest.php?src=ieb&appid=146&systemid=406&qu={searchTerms}&ft=json, Quarantined, [8d7c75e322690b2b09e1bad729da6a96]
PUP.Optional.Conduit, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, http://www.bing.com/search?pc=COSP&...form=CONBDF&conlogo=CT3334470&q={searchTerms}, Quarantined, [8b7e60f8aae1a78fb7601a4fc142649c]
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{21E15933-AA34-466E-A6EA-4CA64A5AA051}|URL, http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}, Quarantined, [c94091c71378a88e95437f1711f29868]
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{21E15933-AA34-466E-A6EA-4CA64A5AA051}|OSDFileURL, file:///C:/Program%20Files%20(x86)/Common%20Files/Spigot/Search%20Settings/yahoo_ie.xml, Quarantined, [59b079df6724ac8a35a4c0d681826f91]
PUP.Optional.SearchQu, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|URL, http://www.searchqu.com/web?src=ieb&appid=146&systemid=406&sr=0&q={searchTerms}, Quarantined, [74954612d1ba57df8b5c1f727f84867a]
PUP.Optional.SearchQu, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SuggestionsURL_JSON, http://www.searchqu.com/suggest.php?src=ieb&appid=146&systemid=406&qu={searchTerms}&ft=json, Quarantined, [44c53f19b8d385b1697e6f224bb8b24e]
PUP.Optional.YahooVNM, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C0C3A6C6-03BC-4195-8FCB-AEA091301353}|URL, https://search.yahoo.com/search?fr=...54_swoc_campaign_150601__yaie&p={searchTerms}, Quarantined, [1aefbf994b408da9fb42b5ed20e3817f]
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EE44DE45-A46E-447E-A245-3DD0C7F3F07F}|URL, http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}, Quarantined, [34d50c4c3d4e6acc5583e2b4dc27b54b]
PUP.Optional.Spigot, HKU\S-1-5-21-1624520076-3274274859-1713139034-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EE44DE45-A46E-447E-A245-3DD0C7F3F07F}|OSDFileURL, file:///C:/Program%20Files%20(x86)/Common%20Files/Spigot/Search%20Settings/yahoo_ie.xml, Quarantined, [d831a2b63b50f2446c6d1086e41ffb05]

Registry Data: 0
(No malicious items detected)

Folders: 24
PUP.Optional.SearchQu, C:\Users\KuroHANA\AppData\LocalLow\searchquband, Quarantined, [da2f77e1543782b4127dfd708a78d42c],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\icons, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\scripts, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome\content, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Local\Slick Savings, Quarantined, [a366a4b4018ad1653b12403602006799],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Slick Savings, Quarantined, [d930ef698efd999d282794e2f70b946c],
PUP.Optional.DataMngr, C:\Program Files (x86)\SearchCore for Browsers, Quarantined, [81889abe3754da5c0d47730454ae3fc1],
PUP.Optional.DataMngr, C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers, Quarantined, [81889abe3754da5c0d47730454ae3fc1],
PUP.Optional.DataMngr, C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\x64, Quarantined, [81889abe3754da5c0d47730454ae3fc1],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\api, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\popupResource, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\userCode, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\icons, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\icons\actions, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\_metadata, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],

Files: 99
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Slick Savings\Coupons.dll, Quarantined, [3dcc3a1e3e4d64d22e203acd5fa3ef11],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Slick Savings\Coupons.dll{CC623B08-796A-47E5-AF90-35DB7C1C332F}.old, Quarantined, [cf3a95c36d1e7eb844f2b6b144c0e31d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Slick Savings\CouponsHelper.exe, Quarantined, [62a70f494942b5811b1b12556e96a25e],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Slick Savings\Uninstall.exe, Quarantined, [0ffae3759eed4aec45d6af88936d966a],
PUP.Optional.APNToolBar, C:\Users\KuroHANA\Downloads\aTubeCatcher(1).exe, Quarantined, [73961a3ef299d363d5cc0b4b43bed030],
PUP.Optional.APNToolBar, C:\Users\KuroHANA\Downloads\aTubeCatcher.exe, Quarantined, [cc3d3721f596df57ddc4dd79c43d3fc1],
PUP.Optional.APNToolBar, C:\Users\KuroHANA\Downloads\aTube_Catcher(1).exe, Quarantined, [9772bb9dc8c35adc0b966ee810f1dc24],
PUP.Optional.APNToolBar, C:\Users\KuroHANA\Downloads\aTube_Catcher(2).exe, Quarantined, [dc2dde7a95f67abcbee362f4778a4fb1],
PUP.Optional.APNToolBar, C:\Users\KuroHANA\Downloads\aTube_Catcher(3).exe, Quarantined, [bb4eadab0d7e82b4930ec393dc25a858],
PUP.Optional.OpenCandy, C:\Users\KuroHANA\Downloads\aTube_Catcher.exe, Quarantined, [000976e24249a78f7518fc60679d728e],
PUP.Optional.OpenCandy, C:\Users\KuroHANA\Downloads\aTube_Catcher_Setup(1).exe, Quarantined, [fe0b0c4c33587abc1b72e97314f07987],
PUP.Optional.OpenCandy, C:\Users\KuroHANA\Downloads\aTube_Catcher_Setup.exe, Quarantined, [ba4f0b4d3d4e5adc6a233f1d887c52ae],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\searchplugins\yahoo_ff.xml, Quarantined, [8287015753382115ffd5ebabf60d2dd3],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\background.html, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\config.json, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\manifest.json, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\icons\ss-128.png, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\icons\ss-48.png, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\scripts\background.js, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\scripts\loader_1036.js, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.SlickSavings, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.6_0\scripts\utils.js, Quarantined, [a56483d50388191d58a8e08fb25036ca],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome.manifest, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\icon.png, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\install.rdf, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome\content\config.json, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome\content\main.js, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome\content\savingsslider.js, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome\content\savingsslider.xul, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\extensions\savingsslider@mybrowserbar.com\chrome\content\spigot.js, Quarantined, [75945602e0abab8bb3b8135da260639d],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Local\Slick Savings\coupons.crx, Quarantined, [a366a4b4018ad1653b12403602006799],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Slick Savings\coupons_2.4.crx, Quarantined, [d930ef698efd999d282794e2f70b946c],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Slick Savings\coupons_2.7.xpi, Quarantined, [d930ef698efd999d282794e2f70b946c],
PUP.Optional.DataMngr, C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\x64\BrowserConnection.dll, Quarantined, [81889abe3754da5c0d47730454ae3fc1],
PUP.Optional.DataMngr, C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\x64\DnsBHO.dll, Quarantined, [81889abe3754da5c0d47730454ae3fc1],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\main.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\background.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\platformVersion.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\api\chrome.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\api\cookie.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\api\message.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\api\monitor.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\api\pageAction.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\api\pageActionBG.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\app_api.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\bg_app_api.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\consts.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\cookie_store.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\delegate.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\events.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\extensionDataStore.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\installer.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\logFile.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\logging.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\onBGDocumentLoad.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\reports.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\storageWrapper.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\updateManager.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\util.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\xhr.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\popupResource\newPopup.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\js\lib\popupResource\popup.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\background.html, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\chromeCoreFilesIndex.txt, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\manifest.json, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\popup.html, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\Settings.json, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\manifest.xml, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins.json, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\1.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\13.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\14.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\17.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\177.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\182.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\183.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\19.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\207.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\21.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\22.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\28.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\4.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\47.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\64.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\72.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\78.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\80.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\plugins\97.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\userCode\background.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\extensionData\userCode\extension.js, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\icons\icon128.png, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\icons\icon16.png, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\icons\icon48.png, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\icons\actions\1.png, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\_metadata\computed_hashes.json, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.CrossRider, C:\Users\KuroHANA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbdhgcmaickfigdopnlhfofimhikogid\1.26.8_0\_metadata\verified_contents.json, Quarantined, [cc3d63f5c9c25fd70b13b6b7c242b14f],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=994519&p=")

, Replaced,[6a9fafa92f5c95a12ba0e5865da7a35d]
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\prefs.js, Good: (browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Bad: (browser.startup.homepage", "http://search.yahoo.com?type=994519&fr=spigot-), Replaced,[e0293d1bb7d4ad89549a0a6711f3837d]
PUP.Optional.ASK.Gen, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\je2e67i9.default\searchplugins\askcom.xml, Quarantined, [957489cf95f67bbbb538a1ce28dcdf21],
PUP.Optional.Spigot, C:\Users\KuroHANA\AppData\Roaming\Mozilla\Firefox\Profiles\k5grvdxx.default-1354733456351\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=994519&p=")

, Replaced,[db2e1543fb90cb6bc6056605d62eb34d]

Physical Sectors: 0
(No malicious items detected)

(end)

TwinHeadedEagle · Oct 18, 2015

Very good. How is your PC behaving now?

plz help · Oct 19, 2015

ummm yesturday it was pretty okay but after waking up this morning the dllhost problem is back. i usually leave my PC on overnight somedays and today i woke up to it the dllhost problem eating resources again.

TwinHeadedEagle · Oct 19, 2015

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

Right-click on

icon and select

Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

plz help · Oct 20, 2015

Sorry for the long wait. After i restarted the PC it ran smoothly but nonetheless i scanned for posterity.

TwinHeadedEagle · Oct 20, 2015

Your PC seems clean.

plz help · Oct 20, 2015

You're more than likely right, perhaps it was just a one-off thing. In any case thank you so much ^_^

plz help · Oct 20, 2015

Never mind its back and its doing the same thing it did before. It was fine this morning before i left the house but since i restarted it today its back to the same stuff from before the scans

TwinHeadedEagle · Oct 20, 2015

Check Disk

Press the

+ R on your keyboard at the same time. Type cmd and click OK.
Copy/Enter the command below and press Enter:
Code:
```
chkdsk C: /r
```
You should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.
All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.

Check Disk report:

Press the

+ R on your keyboard at the same time. Type eventvwr and click OK.
In the left panel, expand Windows Logs and then click on Application.
Now, on the right side, click on Filter Current Log.
Under Event Sources, check only Wininit and click OK.
Now you'll be presented with one or multiple Wininit logs.
Click on an entry corresponding to the date and time of the disk check.
On the top main menu, click Action > Copy > Copy Details as Text.
Paste the contents into your next reply.

plz help · Oct 20, 2015

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 10/20/2015 11:05:51 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: KuroHANA-PC
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is WIN7.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
508672 file records processed.

File verification completed.
5982 large file records processed.

0 bad file records processed.

0 EA records processed.

47 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
665310 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
508672 file SDs/SIDs processed.

Cleaning up 22287 unused index entries from index $SII of file 0x9.
Cleaning up 22287 unused index entries from index $SDH of file 0x9.
Cleaning up 22287 unused security descriptors.
CHKDSK is compacting the security descriptor stream
78320 data files processed.

CHKDSK is verifying Usn Journal...
37537080 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
508656 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
36389906 free clusters processed.

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

961887231 KB total disk space.
815412480 KB in 404496 files.
272844 KB in 78323 indexes.
0 KB in bad sectors.
642279 KB in use by the system.
65536 KB occupied by the log file.
145559628 KB available on disk.

4096 bytes in each allocation unit.
240471807 total allocation units on disk.
36389907 allocation units available on disk.

Internal Info:
00 c3 07 00 0c 5e 07 00 ef c4 0c 00 00 00 00 00 .....^..........
97 3c 01 00 2f 00 00 00 00 00 00 00 00 00 00 00 .<../...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-10-21T03:05:51.000000000Z" />
<EventRecordID>148704</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>KuroHANA-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is WIN7.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
508672 file records processed.

File verification completed.
5982 large file records processed.

0 bad file records processed.

0 EA records processed.

47 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
665310 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
508672 file SDs/SIDs processed.

Cleaning up 22287 unused index entries from index $SII of file 0x9.
Cleaning up 22287 unused index entries from index $SDH of file 0x9.
Cleaning up 22287 unused security descriptors.
CHKDSK is compacting the security descriptor stream
78320 data files processed.

CHKDSK is verifying Usn Journal...
37537080 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
508656 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
36389906 free clusters processed.

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

961887231 KB total disk space.
815412480 KB in 404496 files.
272844 KB in 78323 indexes.
0 KB in bad sectors.
642279 KB in use by the system.
65536 KB occupied by the log file.
145559628 KB available on disk.

4096 bytes in each allocation unit.
240471807 total allocation units on disk.
36389907 allocation units available on disk.

Internal Info:
00 c3 07 00 0c 5e 07 00 ef c4 0c 00 00 00 00 00 .....^..........
97 3c 01 00 2f 00 00 00 00 00 00 00 00 00 00 00 .<../...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

TwinHeadedEagle · Oct 21, 2015

How is the situation now?

plz help · Oct 21, 2015

It seemed fine for a bit, until i opened one of my folders. Once i opened the folder the COM Surrogate went back into full effect but before that it was fine.

TwinHeadedEagle · Oct 21, 2015

Which folder did you open?

plz help · Oct 21, 2015

I have a folder where i keep my sensitive hidden docs and i opened it to see if it was alright but then DLLHOST freaked out. After a while it went away ,not sure why, but then just now after my computer crashed and restarted DLLHOST ramped up again.

Search

DLLHOST.EXE eating through all my memory please help me

plz help

New Member

Attachments

TwinHeadedEagle

Level 41

plz help

New Member

Attachments

TwinHeadedEagle

Level 41

plz help

New Member

TwinHeadedEagle

Level 41

plz help

New Member

Attachments

TwinHeadedEagle

Level 41

plz help

New Member

plz help

New Member

TwinHeadedEagle

Level 41

plz help

New Member

TwinHeadedEagle

Level 41

plz help

New Member

TwinHeadedEagle

Level 41

plz help

New Member

Similar threads