Malware detected on my machine.

[Nemesis]

Hello, I am having some trouble with this Malware because I am unable to find, and remove it. I usually keep a pretty clean system, however, I have no idea how I got this, or why it keeps popping up on my antivirus software. The most curious thing I have noticed is that it pops up even when I am doing nothing at times, although it seems like something is triggering it.

Any help would be greatly appreciated. I have not installed any of the recommended scanners because I am using an SSD and would like to be certain it's needed before I do it.

Thanks.

 

[Nemesis]

Object: (an incomplete url is here)
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

^-- This is the initial warning that sometimes pops up 15-30 times in rapid succession.

When I click "see more information" I get this:

Infection Blocked
URL:h_www_freeresultsguide_com__?dn
Infection:URL:Mal

 

[TwinHeadedEagle]

Hi,



Please download zoek.zip or zoek.rar by smeenk (

) from here or here and save it to your Desktop.
Unpack the archive...

• Close any open browsers
• Temporarily disable your AntiVirus program. (If necessary)
  If you are unsure how to do this please read this or this Instruction.
  
• Double click on zoek.exe to run the tool .
  Please wait while the tool does not start...
  
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
  
  

  createsrpoint;
  gpt.ini;z 
  C:\Windows\System32\GroupPolicy;v
  C:\Windows\SysWOW64\GroupPolicy;v 
  StandardSearch; 
  emptyfolderscheck; 
  installer-list; 
  installedprogs; 
  uninstall-list;

• Click on
  
  button.
  Please wait until a logreport will open (this can be after reboot)
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"

 

[Nemesis]

Wow! Thank you for the quick reply. I actually found a post on here similar to the one I've made and I tried to download this same file. After I extract the files I try to run them and it will not open, it does nothing.

 

[TwinHeadedEagle]

Try to disable Antivirus and try again. Avast is known to block Zoek.

 

[Nemesis]

Yes, I also tried to disable the antivirus software. It just doesn't seem to want to run, I'm at a loss.

I've also tried to run it in XP Service pack 2 compatibility mode and I'm getting nothing.

 

[TwinHeadedEagle]

Let's try different method:


Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

***** NEXT *****​

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[Nemesis]

Everything seemed to work very smoothly. I have attached the requested logs.

 

[TwinHeadedEagle]

Let's make another scan:



Please download Malwarebytes AntiRootkit (MBAR) and save it to your desktop.
For full instructions how MBAR works, read this article

> Doubleclick on the MBAR file

and allow it to run.
• Click OK on the next screen, to allow the package to extract the contents of the file to its own folder named mbar.
• mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.
• After reading the Introduction, click Next if you agree.

• On the Update Database screen, click on the Update button. Once you see 'Success: Database was successfully updated' click on Next
• Under Scan Targets ensure all boxes are ticked. Then click the Scan button.

Notice: with some infections, you may see two messages boxes:
- 'Could not load protection driver'. Click 'OK'.
- 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

>> If malware is not detected, click the Exit button to close the program and post the mbar-log-year-month-day.txt and system-log.txt reports.

>> If an infection/s are found ensure Create Restore Point are ticked. Then select the "Cleanup! button to remove threats.
• The clean up procedure will be scheduled for process, pop-up will be shown.
Select the Yes button and the system should re-boot to complete the cleaning process.

>> Notice: only if an RootKit are detected, ensure to run fixdamage.exe tool located in mbar folder, \Plugins\fixdamage.exe
- Run fixdamage.exe, at the black window to continue type Y (alias for Yes). Wait few seconds for execution ...
- When you see "press any key to exit" fix is completed, press any key to close the window. Reboot the system.


> The following reports will be created in mbar folder:
1. mbar-log-year-month-day (hour-minute-second).txt
2. system-log.txt

Please post both logs in your next reply.

 

[Nemesis]

The scan ran smoothly with no malware found. My antivirus has yet to detect the malware that has been plaguing my system all day and yesterday. I have attached the requested log files.

 

[TwinHeadedEagle]

PC seems clean, how is the sitation now?

 

[Nemesis]

Situation seems fine. Thanks a ton for your help. Responses were incredibly fast. Ty sir.

 

[TwinHeadedEagle]

Let me know if it gets back

 

[Nemesis]

The problem actually returned last night. I'm not quite sure how... but I actually managed to get rid of it using a program called Rogue Killer that scanned my registry. Figured I'd share my fix in case someone else was searching for a fix.

 

[TwinHeadedEagle]

Share reports please

 

[Nemesis]

It actually did not fix the issue that I had. I am still getting the popup, I am still trying to figure it out because I believe its been about 5 malware removal programs I have tried :/

 

[Nemesis]

I ran a scan from my anti-virus software forums and these are the results of the scan. I believe these may be the problem due to the fact that they are labeled as an "Optional search project" which sort of goes with the "free results" part of the malware warning I recieve. I have yet to get a popup yet although I will keep posted so that there are as many answers out there for people with the same issue as possible. The program name is malwarebyes anti-malware which has a free edition with a premium trial upon download. The log is posted below.



Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/10/2014
Scan Time: 11:02:54 PM
Logfile:
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.04.11.03
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: SSD-Sinafey

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 264275
Time Elapsed: 3 min, 14 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 6
PUP.Optional.SearchProtect.A, C:\Users\SSD-Sinafey\AppData\Local\Temp\nsh334D.exe, Quarantined, [e52a4fdad2a962d48f7c998af50c728e],
PUP.Optional.SearchProtect.A, C:\Users\SSD-Sinafey\AppData\Local\Temp\nsh5218.exe, Quarantined, [2ae536f3cfacc571917ade45728f8b75],
PUP.Optional.SearchProtect.A, C:\Users\SSD-Sinafey\AppData\Local\Temp\nsp9EE9.exe, Quarantined, [d936dc4db9c29c9a25e6b76c7b867b85],
PUP.Optional.SearchProtect.A, C:\Users\SSD-Sinafey\AppData\Local\Temp\nsr35FC.exe, Quarantined, [30df042598e360d656b5a182cf329d63],
PUP.Optional.SearchProtect.A, C:\Users\SSD-Sinafey\AppData\Local\Temp\nsr4F49.exe, Quarantined, [4cc34ddca7d444f23fcc1e0539c8a759],
PUP.Optional.Conduit.A, C:\Users\SSD-Sinafey\AppData\Local\Temp\nsm1D2D\SpSetup.exe, Quarantined, [3dd21118c4b7d75f2dce95822ed3817f],

Physical Sectors: 0
(No malicious items detected)


(end)

 

[Nemesis]

And it's still happening, no idea what to do at this point lol.

 

[TwinHeadedEagle]

Can you reset your router?

 

[Nemesis]

Yes, I actually do this multiple times... although due to problems with my ISP.