Help me please: COM SURROGATE DLLHOST.EXE *32 virus
- Thread starter Aeroguy
- Start date
Windows Malware Removal Help & Support
4 Replies
2,387 Views
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Code:
Start
CloseProcesses:
CustomCLSID: HKU\S-1-5-21-700757172-2191707310-3469854750-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-700757172-2191707310-3469854750-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
HKU\S-1-5-21-700757172-2191707310-3469854750-1001\...\MountPoints2: {2775b662-d7ab-11e2-9b61-0019dbb5fa27} - H:\MotorolaDeviceManagerSetup.exe -a
HKU\S-1-5-21-700757172-2191707310-3469854750-1001\...\MountPoints2: {2fa3d91e-3c61-11e4-8e55-0019dbb5fa27} - H:\MotoCastSetup.exe -a
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - No File
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
C:\ProgramData\TempComcastSecureBackupShare-update-94576f825cbee21cffeff81117efd21f.exe
EmptyTemp:
CMD: bitsadmin /reset /allusers
EndNOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
I did as you said and ran FRST64 with the new fixlist.txt made from the above code in the same folder. The program ran for several minutes and then a windows dialogue popped up saying FRST64 has stopped working. So I don't know if the full fix was completely implemented or not. I uploaded the fixlog.txt file here. When I call up Task Manager, I still see a couple of dlhost.exe COM Surrogate processes running. Is that normal? I reset the IE browser security setting to default Med-High (I assumed the virus changed them to custom settings). Still seem to have some problems downloading files, but definitely the system is running better than the last few days. I will observe the system for more abnormal behavior. Anything else I should do? Did the full fix get implemented before the FRST64 stopped running? I do appreciate you help.
It's been over 24 hours since I applied your fix, and it appears your fix was very successful. My system seems to be running normal now. The multiple Com Surrogate processes that were burning 100% of my CPU usage are gone and I can access the internet and download files again. I assume nothing else needs to be done to close this out? Thank you very much for you help!
• The following will implement some post-cleanup procedures:
=> Please download DelFix by Xplode to your Desktop.
Run the tool and check the following boxes below;
Remove disinfection tools
Create registry backup
Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
=> Please download DelFix by Xplode to your Desktop.
Run the tool and check the following boxes below;
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
Recently browsing
Members who viewed this thread in the last 5 minutes
