Solved dllhost.exe, trojan poweliks, com surrogate, syswow64, please help

[TwinHeadedEagle]

Download

Malwarebytes Anti-Rootkit to your desktop.

• Double-click the icon to start the tool.
• It will ask you where to extract it, then it will start.
• Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
• Click in the introduction screen "next" to continue.
• Click in the following screen "Update" to obtain the latest malware definitions.
• Once the update is complete select "Next" and click "Scan".
• When the scan is finished and no malware has been found select "Exit".
• If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
• Open the MBAR folder and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[dzyre]

Thank u! Will do.

 

[dzyre]

Hi! Here's the mbar log. For some reason frst is no longer in my pc. I tried clicking the link above to download it again and its not clickable. Any other way I can download this? Thank You !!!

 

[dzyre]

Also, I was looking at task manager and in processes theres 3 things I havent seen before:
atiedxx.exe ,csrss.exe , and rtvosd.exe.

Tried closing it and gives me and access denied message

 

[TwinHeadedEagle]

They are legitimate. Attach FRST reports please.

 

[dzyre]

I don't have FRST anymore. When I clicked the icon it said this has been moved or deleted. Don't know what happened. I tried to download using the same one but it's not clickable. Is there another link to download FRST again?

 

[TwinHeadedEagle]

Did you disable your antivirus?

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[dzyre]

Heres the frst reports finally. Thanks!

 

[dzyre]

Btw. Theres text regarding chrome on these reports. I dont have or even use chrome. Can you tell me more about this? Thank You!

 

[TwinHeadedEagle]

Indeed. Maybe it is just a bug.

How is your PC now?

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[dzyre]

Its better than before but I still keep getting high usage from svchost.exe. Norton keeps notifying me this when my laptop is on. I dont recall getting those notifications before. It also takes a long while for the pc to shut down and restart.

Also, I dont know what I'm doing wrong or whats going on but I cannot use the FIX on frst. I click it and it keeps giving me a message : No fixlist.txt found. Should be in the same folder/directory. I restarted my disabled norton. clicked run as admin and still giving me the same message.

The tool is saved on my desktop along with the frst scan reports and addition report. I'm so sorry. Seems like theres always a hiccup in my case.. I hope you can please help me get this fix done.

THANK YOU!!!

 

[TwinHeadedEagle]

Yes, tool and fixlist.txt should be in the same place (e.g. Desktop).

 

[dzyre]

All I see is the FRST64 icon (tool) the frst report and addition report on my desktop. Nothing else.
I don't know what else to do. Sorry.

 

[dzyre]

Should I Uninstall? And download it again?

 

[TwinHeadedEagle]

Yes, try downloading again. Move FRST and fixlist on the Desktop.

 

[dzyre]

Ok lets try again. Sorry. Thank You !

 

[dzyre]

Finally...... the fix log

 

[dzyre]

Thank You! PC seems a lot better than before. I have a couple concerns. Could you provide some insight please?

Norton is now notifying me about a medium alert regarding system32/conhost.exe. Saying unauthorized access blocked.
Is this legitimate???

And I have several IP address has disappeared from adapter teredo tunneling on my security history.
Is this suspicious at all???

 

[TwinHeadedEagle]

About norton, we will scan again.

About your second question, please explain.

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[dzyre]

Ok. I'll scan again. About the IP address has disappeared. When I look at the security history on norton it shows a variety of things like info alerts, low medium high alerts. This in one particular is considered under info in the firewall/network category. There are several of them on there through out the time the computer is on. several time stamps through out the day.
It says this exactly : IP address has disappeared from adapter teredo tunneling pseudo interface. Then some IP address.
I dont know I just figured I'd mention it to you just in case....

I'm also seeing some new process causing high cpu usage. I looked it up online to see what it is and several threads are saying its not a great thing usually causing errors on pc. Maybe you'll know more about it. Its called atibtmon.exe????

And I'm still getting multiple performance alert notifications from norton concerning host process for windows services causing high usage. Its that same c:\windows\sys32\svchost.exe

Any of these processes you can tell me more about or what to do with it???

Thanks a billion!! Seems like my case is never ending. Thank You so very much! You are due more than just beer or beers for that matter That's a promise!