Solved Malware infection: COM surrogate, dllhost, Trojan Poweliks versions, Adclick(?) on multiple computer

[argus]

Download ESET Poweliks Cleaner
http://download.eset.com/special/ESETPoweliksCleaner.exe

When the download is complete, navigate to your Desktop, double-click ESETPoweliksCleaner.exe.
Read the terms of the End-user license agreement and click Agree if you agree to them.

The tool will run automatically. If the cleaner finds a Poweliks infection, press the Y key on your keyboard to remove it.

If Poweliks was detected "Win32/Poweliks was successfully removed from your system" will be displayed.
Press any key to exit the tool.

After removing an infection we highly recommend that you restart your computer. The infection should now be removed and you should be able to access the web content that was being blocked.

 

[CESbio]

Interesting, the link isn't going through. Instead I'm getting an HTTP 403 Forbidden screen. Same message on both IE and Chrome.

 

[argus]

Sorry
http://download.eset.com/special/ESETPoweliksCleaner.exe

 

[CESbio]

Ok, used the earlier link. Poweliks found and removed. Any new scans I should do?

 

[argus]

How's your computer behaving now?

 

[CESbio]

No new malwarebytes messages in the last few minutes since the Trojan was removed. I haven't downloaded the other software for the external drive yet but will momentarily. Any other suggestions you have to help secure the system in terms of software, etc.? Obviously NIS isn't cutting it. Any other Malwarebyte products that would be useful? I do a ton of research online for my job, and going down over the last week + has really messed up my workflow. I'd like to not be there again anytime soon if I can prevent it!

 

[argus]

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the
  
  icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Recommended additional software:
​

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

FiheHippo.com Update Checker - to keep your programs up-to-date.

Adblock - to surf the web without annoying ads!

 

[CESbio]

DelFix downloads ok, but when I go to run (as administrator or not), the program stops working. Reinitiated x 4. Deleted and redownloaded x 3 with same results. Any suggestions?

 

[argus]

Remove manually, right click delete.

 

[Randomtastic]

I used the Poweliks remover and it restarted and no "Virus detected" indications, but when I open task manager and I scroll down COM Surrogate pops up in background processes for a few seconds then it goes away is that normal?

 

[argus]

Download

Malwarebytes Anti-Rootkit to your desktop.

• Double-click the icon to start the tool.
• It will ask you where to extract it, then it will start.
• Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
• Click in the introduction screen "next" to continue.
• Click in the following screen "Update" to obtain the latest malware definitions.
• Once the update is complete select "Next" and click "Scan".
• When the scan is finished and no malware has been found select "Exit".
• If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
• Open the MBAR folder and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"

 

[Randomtastic]

After I scanned it I still have COM Surrogate in the background tasks when I opened up task manager and it still goes away after a few seconds later when I opened task manager.

 

[argus]

Scan with Malwarebytes' Anti-Malware
Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam and select update.
• Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

 

[Randomtastic]

Hmmm I don't see a settings tab?

 

[argus]

Attach here screenshot.

 

[Randomtastic]

http://prntscr.com/5vrizy

 

[argus]

Haha, not malwarebytes anti rootkit, malwarebytes anti malware, understand.

 

[Randomtastic]

Oh hahaha sorry

 

[argus]

 

[Randomtastic]

I want to delete this comment