svchost.exe streaming audio feeds and taking all available CPU

[boweasel]

Besides the browser issues how's the PC acting

Fine. Speedy. No radio noises. No svchost chewing up RAM. Seems like ADWcleaner could've given me a msg about the scan that was running. Oh well. I restarted it, but that's about an hour wasted.

 

[VistaKing]

Lets see what MSE comes out with .

 

[VistaKing]

After you have completed the scan with MSE . Run TFC

TFC ( Temp File Cleaner )

TFC

Download TFC below

Download link :ar: http://oldtimer.geekstogo.com/TFC.exe

Drag the TFC.exe from your Downloads folder to the Desktop

Right click on TFC.exe and choose

Click on the Start button

When its finished it will ask you to restart your PC if it doesn't restart manually .

   Tip

Make sure all of the windows are closed

   Note

TFC will empty your Recycle Bin

 

[boweasel]

Lets see what MSE comes out with .

OMFG!!!! The Quick scan found squat, but the Full scan found what appears to be 17 viruses, 13 of which have the word Trojan in the item name. Is there a way to upload the MSE log? I have no idea where it's located. Here's the non-trojans
Exploit:Java/Blacole.ES (two of these)
VirTool:JS/Obfuscator.BS
Adware:Win32/Adkubru

The others all start out with Trojan:followed by Win64, Win32, DOS or Spy, then a forward slash and words that make no sense to me (Alureon shows up several times). Be more than happy to upload a log if you give me instructions.

How could everything we've done to this point have missed this stuff?

 

[boweasel]

And most maddeningly, the IE10 problem has not changed one iota. Even Chrom is no giving me fits - it took several tries with Chrom just to get into the forum.

The Temp File Cleaner is running.

 

[boweasel]

TFC finished but did not ask me to restart my PC, and it seems to have created no log. Will restart anyway.

Restarting made no difference. IE10 now gives page error on attempting to go to home page. Chrome now seems okay.

 

[VistaKing]

Rerun RogueKiller . Click on Scan and upload the new log

 

[VistaKing]

See if the log is in one of these

C:\ProgramData\Microsoft\Microsoft Antimalware\Support

C:\ProgramData\Microsoft\Microsoft Security Essentials\Support

   Note

ProgramData is a hidden folder

How to Show Hidden Folders

Click on the Start rb: button and select Computer
Press the Alt key on your keyboard and click on Tools or click on Organize
Select Folder Options
Click the View tab and make sure that Show hidden files and folders is selected under Hidden files and folders
Click Apply then click OK

 

[boweasel]

I think this is the MSE log, along with the latest RogueKiller log. Curious that RK seems not to find anything anymore - including those 17 nasties that MSE caught.

 

[VistaKing]

Infections were found on these folders

C:\Qoobox\Quarantine
C:\TDSSKiller_Quarantine



Remove combo fix

Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
In the Run box, type in ComboFix /Uninstall
Click OK

Once done delete these folders manually
C:\ComboFix
C:\Qoobox

Tdsskiller just delete the app.

 

[boweasel]

Infections were found on these folders

C:\Qoobox\Quarantine
C:\TDSSKiller_Quarantine



Remove combo fix

Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
In the Run box, type in ComboFix /Uninstall
Click OK

Once done delete these folders manually
C:\ComboFix
C:\Qoobox

Tdsskiller just delete the app.

ComboFix has been uninstalled.
There are no folders for Qoobox or ComboFix to delete manually
TDSSkiller has been deleted

 

[VistaKing]

Perfect . I know you did this already but rerun a Full Scan with in Malwarebytes then MSE

 

[boweasel]

Will do, but just to give you a current update.
I changed the IE10 home page to Google, but I get This page cannot be displayed every time I click on the icon
Running IE without add-ons makes no difference. Same page not found.
I went to C:\Program Files\Internet Explorer and created a desktop icon for the .exe file. No difference
Chrome continues to be problematic. I usually have to click Reload Page once or twice to get this forum to display after a reboot

Running a full scan in MBAM right now

 

[VistaKing]

Lets see what MBAM locates

 

[boweasel]

When I look at Event View I see 2 red errors from just about the time I was rechecking IE10
***
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 8/24/2013 12:36:22 PM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: Vickie-PC\Vickie
Computer: Vickie-PC
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}
and APPID
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}
to the user Vickie-PC\Vickie SID (S-1-5-21-4098678458-196416962-756994795-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10016</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-08-24T16:36:22.000000000Z" />
<EventRecordID>184446</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Vickie-PC</Computer>
<Security UserID="S-1-5-21-4098678458-196416962-756994795-1001" />
</System>
<EventData>
<Data Name="param1">machine-default</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{9BA05972-F6A8-11CF-A442-00A0C90A8F39}</Data>
<Data Name="param5">{9BA05972-F6A8-11CF-A442-00A0C90A8F39}</Data>
<Data Name="param6">Vickie-PC</Data>
<Data Name="param7">Vickie</Data>
<Data Name="param8">S-1-5-21-4098678458-196416962-756994795-1001</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
</EventData>
</Event>
***
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 8/24/2013 12:39:17 PM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: Vickie-PC\Vickie
Computer: Vickie-PC
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}
and APPID
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}
to the user Vickie-PC\Vickie SID (S-1-5-21-4098678458-196416962-756994795-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10016</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-08-24T16:39:17.000000000Z" />
<EventRecordID>184447</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Vickie-PC</Computer>
<Security UserID="S-1-5-21-4098678458-196416962-756994795-1001" />
</System>
<EventData>
<Data Name="param1">machine-default</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{9BA05972-F6A8-11CF-A442-00A0C90A8F39}</Data>
<Data Name="param5">{9BA05972-F6A8-11CF-A442-00A0C90A8F39}</Data>
<Data Name="param6">Vickie-PC</Data>
<Data Name="param7">Vickie</Data>
<Data Name="param8">S-1-5-21-4098678458-196416962-756994795-1001</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
</EventData>
</Event>

 

[VistaKing]

Lets see if we need to update some software

SecurityCheck

Click here :ar: SecurityCheck to Download

Place the file onto your desktop

Right-click the SecurityCheck choose

Press any key to continue

Once the scan is done . It will open up a text file copy and paste the text

Press Ctrl and A to select All of the text
Press Ctrl and C to copy the selected text
In your reply click on the message box and press Ctrl and V to Paste

 

[boweasel]

Results of screen317's Security Check version 0.99.72
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java(TM) 6 Update 31
Java version out of Date!
Adobe Reader 10.1.4 Adobe Reader out of Date!
Google Chrome 28.0.1500.72
Google Chrome 28.0.1500.95
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Malwarebytes Anti-Malware mbam.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

 

[VistaKing]

Java 7 Update 25

32-bit OS : Java 7 Update 25

64-bit OS : Java 7 Update 25

Adobe Reader

Click here :ar: Adobe Reader 11.0.0.3

Chrome Installer

Click here :ar: Chrome 29.0.1547.57

 

[boweasel]

This is a 64 bit system, but he uses 32 bit IE. Which Java? Or both?

 

[VistaKing]

You could use 64-bit of the Java