[ti]SOLVED[/ti]Possible virus infection?

tofu
New Helpee

Posts: 7

[ti]SOLVED[/ti]Possible virus infection? Aug 27, 2015 12:17:51 GMT -8

Post by tofu on Aug 27, 2015 12:17:51 GMT -8

Hi

I'm running Windows 10 on a HP Pavilion g6 notebook, with an intel core i5-3210 CPU, 6GB RAM and a 64-bit operating system/x-64-based processor.

Recently the cooling fan has been making a lot of noise so I checked out task manager to find a heavy CPU and memory usage. There are a number of dllhost processes running and some rundll32 ones as well. I also got a Norton performance alert saying that COM surrogate had a high CPU usage.

After looking on the internet is sounds like I might possibly have an infection and wondered if you could possible check it out for me and advise me on how to proceed. I've scanned with Norton a number of times and used Power Eraser but nothing is ever detected and the problem keeps occurring.

If it means anything, I have also noticed that the Runtime Broker also uses a lot of memory and CPU and once I end task things seems to get better, but the process starts up again and needs to be stopped several times before it finally stops having an impact on performance.

Thanking you in advance.

Last Edit: Sept 23, 2015 20:10:57 GMT -8 by dbrisen

Krusty Logging Assistant In Oz Posts: 2,330	[ti]SOLVED[/ti]Possible virus infection? Aug 27, 2015 13:56:23 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Krusty on Aug 27, 2015 13:56:23 GMT -8 Please read the post at the following link and attach or upload the requested logs. qmalwareremoval.freeforums.net/thread/1665/2nd-infected Thanks.
	I do NOT do support by PM. Thank you.

tofu
New Helpee

Posts: 7

[ti]SOLVED[/ti]Possible virus infection? Sept 2, 2015 11:27:14 GMT -8

Post by tofu on Sept 2, 2015 11:27:14 GMT -8

Hi

Thank you for the link. I've been having some trouble trying to download the tool. Norton keeps deleting it from my hard drive before I get a chance to run it. Any advice on how I can stop this but keep my computer safe if I need to disable Norton? I've tried finding an option in Norton to add the file and/or website to a safe list but haven't been able to find one; apologies as I'm not terribly computer literate when it comes to these sort of things.

Krusty
Logging Assistant

In Oz

Posts: 2,330

[ti]SOLVED[/ti]Possible virus infection? Sept 2, 2015 19:52:41 GMT -8

Post by Krusty on Sept 2, 2015 19:52:41 GMT -8

What you will probably have to do is to right click the Norton Systray icon and choose Disable Auto-Protect for say half an hour until you have created the logs, then you can re-enable Auto-Protect and attach or upload the logs.

I do NOT do support by PM.

Thank you.

tofu
New Helpee

Posts: 7

[ti]SOLVED[/ti]Possible virus infection? Sept 12, 2015 7:44:53 GMT -8

Post by tofu on Sept 12, 2015 7:44:53 GMT -8

Hi

Sorry for not replying sooner. I've finally managed to download the files you asked me to and run the scan. I've attached the FRST log as directed. Thank you for your time and patience with this.

I've also added the link to pastebin (I think). Please let me know if it can't be read.

pastebin.com/s3sJ9jun

Many thanks

Attachments:

FRST.txt (52.81 KB)

Last Edit: Sept 12, 2015 7:56:12 GMT -8 by tofu

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Possible virus infection? Sept 14, 2015 22:28:47 GMT -8

Post by dbrisen on Sept 14, 2015 22:28:47 GMT -8

I have reviewed the logs and there is no malware apparent on your system. What there is, however, is a lot of background processes that will use a bit of the power of the system; syncing to online cloud (SkyDrive), MS info updating and adjustments (tweaking Win10), Norton monitoring Backup status, etc.

There are some bits that can be removed (just for tiding up) but they will not affect the system performance. Your call on this ....

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

tofu
New Helpee

Posts: 7

[ti]SOLVED[/ti]Possible virus infection? Sept 17, 2015 10:03:32 GMT -8

Post by tofu on Sept 17, 2015 10:03:32 GMT -8

Thank you so much for this and for putting my mind at rest, knowing there is no malware or viruses on my laptop.

I have noticed that my memory usage and disk usage are sometimes incredibly high and I'm guessing it's due to these background processes that are running you have mentioned. if you have any advice on which ones to tidy up I'd really appreciate it - as you've probably guessed I'm not terribly computer savvy.

One thing as a quick question; earlier I was browsing the internet and I site I navigated to had a second tab pop up that was for a gambling site. I got an audio message saying "to continue click add now". I think it was trying to get me install a component or add it to my favourites/make it my homepage. I wasn't able to close the browser (Chrome) but it shut once I did end task in task manager and hasn't appeared again when using Chrome. Nothing has come back on a Norton scan.

Is it worth running FRST again or is it just one of those annoying pop-ups that has gone and isn't a malware concern?

Many thanks for your time with this.

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Possible virus infection? Sept 17, 2015 19:13:53 GMT -8

Post by dbrisen on Sept 17, 2015 19:13:53 GMT -8

This is a excellent second opinion scanner that we use in cleaning systems. Scan your system and see what it finds.

Malwarebytes' Anti-Malware
Please download the latest version of Malwarebytes' Anti-Malware from Here. The version you have installed needs to be updated.

Double Click on the mbam-setup.exe file to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

When the main screen opens, if the database is out of date, you can click on the Fix Now banner or the Update Now link

Once the program has loaded and updated, select "Scan Now >>" to start the scan.

The scan may take some time to finish, so please be patient.

If any malware is found, you will be presented with a screen like the one below.

If any malware is found, make sure that everything is checked, and click Remove Selected.
When the scan is complete, click View detailed log >> to view the results.
The report screen will open.
At the bottom click on Export and select as txt file, save the file to your desktop and click OK. When the export is complete, select OPEN.
The log file will be opened in your default text file viewer (usually Notepad); select the whole text (Ctrl + A) and copy (Ctrl + c) it to paste here in a reply.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

tofu
New Helpee

Posts: 7

[ti]SOLVED[/ti]Possible virus infection? Sept 19, 2015 7:04:07 GMT -8

Post by tofu on Sept 19, 2015 7:04:07 GMT -8

Thanks for the advice. I've installed and run the Malwarebytes scan as you asked. Will it be a problem if the Premium free-trial wasn't used?

23 items were found and I let the programme remove them (required a restart in order to completely remove as instructed by the scanner).

I couldn't see "View detailed log" so I pressed "Save results" and have attached the .txt file below. If I've messed up and need to run again please let me know and I'll gte onto it.

Kind regards and many thanks.

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 19/09/2015

Scan Time: 15:29

Logfile: scan results.txt

Administrator: Yes

Version: 2.1.8.1057

Malware Database: v2015.09.19.03

Rootkit Database: v2015.09.18.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 10

CPU: x64

File System: NTFS

User: Kev

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 374740

Time Elapsed: 25 min, 46 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 1

PUP.Optional.Wajam, C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe, 4372, Delete-on-Reboot, [7a459c95aedd5fd73bad975207fbeb15]

Modules: 0

(No malicious items detected)

Registry Keys: 5

PUP.Optional.Wajam, HKLM\SOFTWARE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, Quarantined, [7a459c95aedd5fd73bad975207fbeb15],

PUP.Optional.Wajam, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\GamesAppIntegrationService, Quarantined, [7a459c95aedd5fd73bad975207fbeb15],

PUP.Optional.Wajam, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, Quarantined, [7a459c95aedd5fd73bad975207fbeb15],

PUP.Optional.Wajam, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, Quarantined, [7a459c95aedd5fd73bad975207fbeb15],

PUP.Optional.Wajam, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\jpmbfleldcgkldadpdinhjjopdfpjfjp, Quarantined, [fac52110eba01c1a5dee22a1838148b8],

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 6

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\html, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\js, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Wajam, Quarantined, [437cdf52a2e94ee87f9d280247bc19e7],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Wajam\Chrome, Quarantined, [437cdf52a2e94ee87f9d280247bc19e7],

Files: 11

PUP.Optional.Wajam, C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe, Delete-on-Reboot, [7a459c95aedd5fd73bad975207fbeb15],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\manifest.json, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\priam_icon_128x128.png, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\priam_icon_48x48.png, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\html\background.html, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\js\background.js, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\js\browserLoad.js, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\js\priam.js, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\js\priam_background.js, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.32_0\js\priam_chrome.js, Quarantined, [615e7cb59deed165e932f03aae552fd1],

PUP.Optional.Wajam, C:\Users\Kev\AppData\Local\Wajam\Chrome\wajam.crx, Quarantined, [437cdf52a2e94ee87f9d280247bc19e7],

Physical Sectors: 0

(No malicious items detected)

(end)

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Possible virus infection? Sept 19, 2015 22:55:18 GMT -8

Post by dbrisen on Sept 19, 2015 22:55:18 GMT -8

I apologize to you; I completely missed the Wajam infection. And it is right there in the FRST logs. Please do the following scan.

This next step may take a while (just to warn you) .....

ESET Online does not work with IE 11 (Internet Explorer) at the moment (a few weeks ago anyway) so if you have IE 11, Chrome or Firefox has to be used instead. ESET Online does work with IE 10 and earlier.

You can leave Norton Enabled even though ESET may warn about it. just makes the scan take longer. The pictures below showing what to click may be blue instead of green on the ESET website now, but the procedure is still the same

Please read carefully and Slowly, Notice all the settings listed below to check before starting the scan. Stop and ask if you have any questions.

Take note of the NO tick in the Remove found threats setting below at it needs to have the tick removed.

Hold down Control key and click on the following link to open ESET OnlineScan in a new window.

Link =>> ESET Online Scanner <<

Click the Run ESET Online Scanner located on the left side of the page (not the free trial).

For browsers other than Internet Explorer only: (Microsoft Internet Explorer users can skip this step)
Click on the esetsmartinstaller link in the popup window that opens. Save it to your desktop.

Double click on the icon on your desktop.

Check (accept) the Terms of Use.

Click the START button.
Accept any security warnings from your browser.

Now in the Computer scan settings window that appears:-
Make sure that the option Enable detection of potentially unwanted applications is selected.
Now click on Advanced Settings and configure the options as follows:

Remove found threats is Not checked
Scan archives is checked
Scan for potentially unsafe applications is checked
Enable Anti-Stealth Technology is checked

Now click on: Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan is finished, if any threats are found you will see the screen below. Click to view the found threats.

At the bottom of the listed threats, there is an option to save the results to a text file. Please do this so you can attach the results here for review and removal of the items that are not false positives (these will be scripted out so do not worry).

Once the log text file is saved, return to the Scan Finished screen by clicking "<<Back", then click on the uninstall button and click Finish.

Attach the saved log file in your next reply please. Thanks.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

[ti]SOLVED[/ti]Possible virus infection?

Post by tofu on Aug 27, 2015 12:17:51 GMT -8

Post by Krusty on Aug 27, 2015 13:56:23 GMT -8

Post by tofu on Sept 2, 2015 11:27:14 GMT -8

Post by Krusty on Sept 2, 2015 19:52:41 GMT -8

Post by tofu on Sept 12, 2015 7:44:53 GMT -8

Post by dbrisen on Sept 14, 2015 22:28:47 GMT -8

Post by tofu on Sept 17, 2015 10:03:32 GMT -8

Post by dbrisen on Sept 17, 2015 19:13:53 GMT -8

Post by tofu on Sept 19, 2015 7:04:07 GMT -8

Post by dbrisen on Sept 19, 2015 22:55:18 GMT -8