AVira stops at csvhost.exe on virus scan [Solved]

Hi

I've recently noticed that when running a root kit scan or full scan Avira seems to hang and get stuck at svchost.exe and I have to cancel the scan.

I have run a full system scan in Safe Mode and it completes scan and nothing was detected.  I have also run a full scan with Malwarebytes and nothing was detected.

I've updated Avira and no change to this issue.

Ive not had any infections on this computer and have had no detections from new.

Can anyone shed light on why it is not completing scans?

Many thanks

Matt

Hello nipstyler and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

RKreport.txt
Frst.txt
Addition.txt

Thanks

Satchfan

Hi 

Just to confirm my system is a 64bit system and that version of rogue killer is 32.  Shall I continue with the 32bit version you linked to or use a 64bit?  Many thanks

Matt

That was fine.

I'll wait for the other logs.

There is no sign of malware on your computer which is surprising considering you have qBitTorrent on your computer and there are signs that you also use Usenet.

We are not here to pass judgment on file-sharing as a concept but we will warn you that engaging in this activity will always make your computer very susceptible to infection and re-infection.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. Those who write malware use P2P file-sharing as a major vehicle to spread their wares.

Please see this topic for more information:

P2P File Sharing Risks.

Please don’t use either until we have finished up here.

===================================================

Spybot Search & Destroy

We no longer recommend this product because of its poor results in testing, therefore I suggest that you uninstall it.

If you don't want to uninstall it then please at least disable Tea Timer while you carry out the rest of my instructions: you can re-enable it when we are finished. Instructions for disabling TeaTimer are here.

If you do decide to uninstall the program, first “Undo” your immunization before uninstalling. You can do that under “Immunization”, by clicking the Undo Immunization button.

===================================================

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to C:\Users\user\Documents folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

===================================================

Run Farbar Recovery Scan Tool

Although there is no malware, there is a bit of tidying up to do.

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM-x32\…\Run: [] => [X]
Winlogon\Notify\igfxcui: igfxdev.dll [X]
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1868455640-258180280-3540040698-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Shortcut: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GWX Control Panel\GWX Control Panel User Guide.lnk -> hxxp://blog.ultimateoutsider.com/2015/08/using-gwx-stopper-to-permanently-remove.html (No File)
Shortcut: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GWX Control Panel\Ultimate Outsider Downloads.lnk -> hxxp://ultimateoutsider.com/downloads/ (No File)
C:\Users\Guest\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\dllnt_dump.dll
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Please let me know the current situation.

Satchfan

Thanks for your support

I'm a fairly competent user and have learnt what not to do when it comes to downloads etc.  Ive only had 3 infections in 20 years. The reasoning for my paranoia regarding my AV is to do with lending my laptop the other day to a mate who wanted to watch the rugby from streaming sites.  This issue seems to have started since then so was thinking one of the sites he went on may well be infected. Or is purely a coincidence.

Just out of interest can you give me the top line of what the script will be doing to my comp?  I've disabled GWX as I don't wish to install windows 10 as many don't.  I like my privacy

Thanks again

I have taken your advice to uninstall spybot, 

The "fix" is restoring registry entries to their default settings.

In the case of the SearchScopes, there are no fedault settings in Windows 7 but they have been included as they do not point to any URL.
 

I've disabled GWX as I don't wish to install windows 10 as many don't.  I like my privacy

Fair point but then why is your default search engine Chrome?

Google is more invasive, nosey and untrustworthy than Microsoft could ever hope to be. I wouldn't put it on my worst enemy's computer, let alone as default, (don't get me dtarted on Google as I don't know when to stop). Rant over.

Nina

Thanks for clarifying

Fair point about chrome however they think i'm a 116 year old male from the moon called Peter Issflaps.  I use chrome because of the ad blocking extensions.  I'm happy to receive some advice on a secure and fast browser.  What would you suggest? 

Microsoft have gone that bit too far with the whole windows 10 thing.  Forcing it on people in a viral/adware way. 3 pages of settings you have to turn off unless you like Microsoft sending list of files etc and what you do on your computer. Unlike windows 7 you can't completely opt out of the windows error reporting experience.

I won't be moving to Windows 10 as I also don't the format.  I've got 4 years to learn Linux….

Thanks

Fair point about chrome however they think i'm a 116 year old male from the moon called Peter Issflaps.

Browsers are a personal choice and I have no intention of influencing anyone, just stating the facts as I see them. I've used IE since I started using computers and didn't change to Firefox as many did. Now the "in" thing is to change from FF to Chrome. IE has become much more secure and Firefox less so. Since the "sheep" followed the rest of the herd with the latest craze, Chrome is now one of the worst issues we have to deal with here, (BTW, Adblock Plus is available in IE so that's not an issue). Now that Windows 10 is so secure.I'll continue with IE, (aka Microsoft Edge). Also, speed is not an issue for me - why the obsession people have for something to be split seconds faster?

Another thing: all browsers have their pluses and minuses. In this forum I have to use Firefox as IE doesn't format the BBCode correctly.

The main problem with any software is that the more popular it is, the more it will be targeted by malware writers. Much the same with Macs vs PCs: as only about 3% of the world use Macs, why would malware-writers bother? It isn't that Macs a're safer, they are just not targetted.

If you're happy with Chrome then stick with it, (and we'll see you again soon ).

Off out now but will check back later to see if there are any more questions remaining.

Nina

Sorry, our paths seem to have crossed and I answered before seeing the log.