This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Multiple SCVhost

4 min read

Looking for the outcome? Ask AI

This thread's last reply is from December 12, 2014, 10:03 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

mantgar
December 8, 2014, 8:00 PM UTC
I did step 1, I have been trying to delete white smoke but I keep getting a prompt that I need to restart the PC I tried restarting many times and I always get the same prompt as soon as the pc comes back on. It says I need to restart to uninstall white smoke. I tried that many times but it would not uninstall it. :(
mantgar
December 8, 2014, 8:10 PM UTC
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-12-2014 02
Ran by [redacted] at 2014-12-08 12:06:04 Run:1
Running from C:\Users\[redacted]\Desktop
[redacted]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-1592174307-3943232130-657400462-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Extension: No Name - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha944\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta946\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha264\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1671\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5453\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha2473\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home1000\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode8086\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release426\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha1267\ff [Not Found]
Task: {301E4433-C40F-49F0-A992-8E9306515A66} - System32\Tasks\Test TimeTrigger => C:\Users\Mark\AppData\Local\Temp\Runner.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:58A5270D
AlternateDataStreams: C:\ProgramData\Temp:A5C00DEE
C:\Users\Mark\jagex_cl_oldschool_LIVE.dat
C:\Users\Mark\random.dat
EmptyTemp:

*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\S-1-5-21-1592174307-3943232130-657400462-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.
"HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => Key not found.
C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff not found.
C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha944\ff not found.
C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta946\ff not found.
C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha264\ff not found.
C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1671\ff not found.
C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5453\ff not found.
C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha2473\ff not found.
C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home1000\ff not found.
C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode8086\ff not found.
C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release426\ff not found.
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha1267\ff not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{301E4433-C40F-49F0-A992-8E9306515A66}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{301E4433-C40F-49F0-A992-8E9306515A66}" => Key deleted successfully.
C:\Windows\System32\Tasks\Test TimeTrigger => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Test TimeTrigger" => Key deleted successfully.
C:\ProgramData\Temp => ":58A5270D" ADS removed successfully.
C:\ProgramData\Temp => ":A5C00DEE" ADS removed successfully.
C:\Users\Mark\jagex_cl_oldschool_LIVE.dat => Moved successfully.
C:\Users\Mark\random.dat => Moved successfully.
EmptyTemp: => Removed 513.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====
wannabeageek MRU Master
December 8, 2014, 8:37 PM UTC
Don't worry about removing white smoke. We can do it manually. Go ahead with the scan for systemlook.
mantgar
December 8, 2014, 10:26 PM UTC
Okie dokie than about the whitesmoke i have now been running systemlook for quite a awhile now i would say about two hours now and it is still scanning and im curious about this. Is there something wrong should i be worried D: Yup it is still saying scanning...
wannabeageek MRU Master
December 9, 2014, 2:55 PM UTC
Hi mantgar,

Download both programs first.
Run Rkill, DO NOT REBOOT. and then immediately run TDSSKiller.


Step 1.
Download/run Rkill:

Please download Rkill from one of the following links and save to your Desktop:

One, Two, or Three

  • Right-click on Rkill And select " Run as administrator " to run it.
  • A command window will open then disappear upon completion, this is normal.
  • When finished, Notepad will open with a log called, "rkill.log".
  • Please copy and paste the contents of the rkill.log in your next reply.
  • The file is automatically saved... located at C:\rkill.log.
  • Please leave Rkill on the Desktop until otherwise advised.


Note: If your security software warns about Rkill, please ignore and allow the download to continue.



Step 2.
TDSSKiller

Please goto Bleepingcomputer TDSSKiller Download.
Click on the .exe version download button.
  • Move this file to your desktop from the folder that your browser saved it in. Most likely here: C:\Users\???????\Downloads
  • Once on your desktop, double click on TDSSKiller.exe to launch it.
  • Click on Start Scan, the scan will run.
  • When the scan has finished, if it finds anything please click on the drop down arrow next to Cure and select Skip
  • Now click on Report to open the log file created by TDSSKiller in your root directory C:\
  • To find the log go to Start > Computer > C:
  • A log file should be created on your C: drive named something like TDSSKiller.2.4.0.0 24.07.2010.
  • Post the contents of that log in your next reply please.
  • DO NOT TRY TO FIX ANYTHING AT THIS POINT
wannabeageek MRU Master
December 11, 2014, 1:23 PM UTC
Hi mantgar.

It has been two days since my last post.

  • Do you still need help?
  • Do you need more time?
  • Are you having problems following my instructions?
  • According to Malware Removal's latest policy, topics can be closed after 3 days without a response.
  • If you do not reply within the next 24 hours, this topic will be closed.
NonSuch Administrator
December 12, 2014, 10:03 PM UTC
a failure to respond for 72 hours or more,

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI