Resolved System32\svchost.exe Object: orygecpizdat.info/crypted.exe 3 Logs

[Walle87]

Hey everybody,

my Antivirus Program (Avast latest version) keeps on popping up every 15 minutes sayin: "a possible threat has been found and blocked". So something is trying to open malware websites and avast keeps on blocking it.
Details are: System32\svchost.exe Objectrygecpizdat.info/crypted.exe

I have followed the UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions [https://www.techspot.com/community/...ware-removal-preliminary-instructions.58138/]
and will attach the Log files to this post.

Btw, is it really enough to just have the free (and by email registered) Version of Avast ?

I would really appreciate your help and effort!

Thx a lot

Walle

 

[crunchie]

Hi and welcome to TechSpot forums .

====

Avast free is fine, providing you keep it up-to-date .

Please update MBA-M and run it again, reboot and post the log please.

====

Please download ComboFix by sUBs from HERE or HERE

• You must download it to and run it from your Desktop
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When finished, it will produce a log. Please save that log to post in your next reply.
• Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

====

I may need some translation along the way too.

 

[Walle87]

Hey Crunchie,

thanks for you help! I just completely formated and rebooted my pc and now i killed this sneaky bastard on another way Luckily my knowledge was sufficient for this method and its all working again but this forum is realy great! Found a lot of helpful stuff!

Keep on doing so guys!

Thx

Wall-e

 

[crunchie]

No worries.