svchost detected by Sonar

What is this:
C:\Users\Us\Desktop\20472.exe

Continue by downloading a tool we will need - Pocket KillBox

Save it to its own folder somewhere that you will be able to locate it later.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

* Delete on Reboot
* then Click on the All Files button.*(or on the folders option)*
* Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\Temp\FPVG.TMP
C:\Temp\FXOT.TMP
C:\Temp\IFGR.TMP
C:\Temp\lvcomsx.log
C:\Temp\OERN.TMP
C:\Temp\PNNR.TMP
C:\Temp\PVCH.TMP
C:\Temp\scan0.sca
C:\Temp\THGU.TMP
C:\Temp\tidjk.exe
C:\Temp\VVSX.TMP
C:\Temp\WAID.TMP
C:\Temp\BKCT.TMP
C:\Temp\callingapps.xml
C:\Temp\CDTE.TMP
C:\Temp\CNQX.TMP
C:\Temp\CVTI.TMP
C:\Temp\EKUV.TMP
C:\Temp\FNSACAHQUJBJ.exe
* Return to Killbox, go to the File menu, and choose Paste from Clipboard.
* Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Now go to start / run / and type:
services.msc

Srolll down to these two:
TIDJK
FNSACAHQUJBJ

Right click, choose properties and set them to disabled.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

All of these temp files need removing:

C:\Temp\callingapps.xml
C:\Temp\CPFQ.TMP
C:\Temp\CQMM.TMP
C:\Temp\ERDL.TMP
C:\Temp\GYLI.TMP
C:\Temp\HCBW.TMP
C:\Temp\IQKH.TMP
C:\Temp\NVVF.TMP
C:\Temp\OBST.TMP
C:\Temp\PCMQ.TMP
C:\Temp\PUMQ.TMP
C:\Temp\QIIQ.TMP
C:\Temp\SMCN.TMP
C:\Temp\SOUB.TMP
C:\Temp\TBVE.TMP
C:\Temp\WYYE.TMP
C:\Temp\XCWQ.TMP

Questions:
What is this --> C:\Users\Us\AppData\Roaming\Tific
C:\Users\Us\AppData\Local\Tific

If you don't know, delete them.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

 

Some more were created, but I am not seeing anything as the cause. Let's have you go here:

Jotti Scanner

And paste in each of these files. ( Tell me the results please).
C:\Temp\BMSV.TMP
C:\Temp\JSUR.TMP
C:\Temp\TBWI.TMP
C:\Temp\YQCD.TMP

 

I would say some program is creating them ( and since they are empty, then not a threat), but you would need to post in the software forum to try to run down which program is doing it. You may have to do a diagnostic startup in msconfig to track it down.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we used Pocket Killbox during your cleanup, do the below
   
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Vista, Windows XP or Windows ME, do the below:
   
   • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore ato create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    
    • How to Protect yourself from malware!

 

You are most welcome. You may wish to read this:

How to Protect yourself from malware!