What is QuickShare? Solved

Question

Hello everyone
I'm reaching out to someone who could help me

(QuickShare): I have this thing in "Add or Remove Programs." I've been told it's a virus, and I would like to know if that's true and how to remove it. I am on XP
Thank you very much in advance.

lilidurhone · Accepted Answer

Hello

You must have installed potentially unwanted software

To avoid this kind of problem:

- Do not download any programs offered in ads or on suspicious sites. Note that some well-known sites like O1net, Softronic, Tuto4PC, etc. sometimes modify the programs offered for download to add adware ==> Always prefer downloading directly from the publisher's website.

- During the installation of a free program, read carefully and uncheck all additional programs that are offered, especially toolbars.

For your information, read these documents about Potentially Unwanted Programs and Toolbars; they are not mandatory

* Download this easy-to-use tool

http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner (by Xplode) on your desktop.

* If there’s a problem with the first link, take it here https://www.commentcamarche.net/telecharger/securite/2759-adwcleaner/

* Run it (Under Vista/Seven/8, right-click on it, and select run as administrator); if you are on XP, double-click on it

* Click on search
* Post the search report C:\Adwcleaner[R]

* Note that the search report is also saved under C:\Adwcleaner[R1]

--
If there is a problem, there is always a solution
Don't forget to mark your subject as resolved :)

edelweiss2604 · Answer

Hello lilidurhone
Thank you for replying so quickly. As agreed, I am posting the report from "AdwCleaner"

# AdwCleaner v2.301 - Report created on 06/03/2013 at 13:01:48
# Updated on 05/16/2013 by Xplode
# Operating System: Microsoft Windows XP Service Pack 3 (32 bits)
# Username: Maria - VICENTA-17B950C
# Boot mode: Normal
# Run from: C:\Documents and Settings\Maria\Desktop\AdwCleaner-2.301.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Present: C:\DOCUME~1\Maria\LOCALS~1\Temp\Smartbar
Folder Present: C:\Documents and Settings\All Users\Application Data\Tarma Installer
Folder Present: C:\Documents and Settings\Maria\Application Data\Mozilla\Firefox\Profiles\ykwx72uy.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
Folder Present: C:\Documents and Settings\Maria\Application Data\SwvUpdater
Folder Present: C:\Documents and Settings\Maria\Local Settings\Application Data\Smartbar
File Present: C:\WINDOWS\Tasks\AmiUpdXp.job

***** [Registry] *****

Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Present: HKCU\Software\SmartBar
Key Present: HKCU\Software\SmartbarBackup
Key Present: HKCU\Software\SmartbarLog
Key Present: HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Present: HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Key Present: HKLM\SOFTWARE\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Key Present: HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Key Present: HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Present: HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Key Present: HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Key Present: HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Key Present: HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
Key Present: HKLM\SOFTWARE\Classes\IESmartBar.BHO
Key Present: HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
Key Present: HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar
Key Present: HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
Key Present: HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
Key Present: HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
Key Present: HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Key Present: HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Key Present: HKLM\SOFTWARE\Classes\Updater.AmiUpd
Key Present: HKLM\SOFTWARE\Classes\Updater.AmiUpd.1
Key Present: HKLM\Software\Iminent
Key Present: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}
Key Present: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Present: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Key Present: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}
Key Present: HKLM\SOFTWARE\Software
Key Present: HKLM\Software\Tarma Installer
Value Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Value Present: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] The registry does not contain any illegitimate entries.

-\\ Mozilla Firefox v [Unable to get version]

File: C:\Documents and Settings\Maria\Application Data\Mozilla\Firefox\Profiles\ykwx72uy.default\prefs.js

[OK] The file does not contain any illegitimate entries.

*************************

AdwCleaner[R14].txt - [4182 bytes] - [06/03/2013 13:01:48]

########## EOF - C:\AdwCleaner[R14].txt - [4243 bytes] ##########

lilidurhone · Answer

Ok  Proceed to deletion  -- If there's a problem, there is always a solution Don't forget to mark your subject as resolved :)

edelweiss2604 · Answer

I just did it. I went back to "add and remove." It's still there. I tried to uninstall it, but it won't uninstall.

lilidurhone · Answer

* Download ZHPDiag (by Nicolas Coolman)
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

* In case the first link doesn't work, click on the one below
ftp://zebulon.fr/ZHPDiag2.exe

* Follow the instructions during the installation, it will start automatically at the end.

* Above all, don't forget to install its icon on the desktop; the icon looks like a parchment

* Click on the icon that represents a magnifying glass + (“Launch the diagnosis”)

* Save the report on your Desktop using the icon that looks like a floppy disk

* To host the report, click on the blue arrow which will direct you to Pjjoint
to host this report.

* Click on Browse to find the report on your PC.

* The report is saved in C:\ZHP\ZHPDiag.txt

* Once you find the report, select it, and click on Open

* Click on send the file, then post the blue link they will provide you.

* If there are issues hosting on Pjoint, use cjoint instead

* For help http://www.pc-infopratique.com/forum-informatique/tutoriel-heberger-rapport-vt-67934.html

--
If there is a problem, there is always a solution
Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

I hope I followed everything well and, above all, understood everything. Here it is:  https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130603_h15x13r13c10v6

lilidurhone · Answer

Hello edelweiss

Watch out for the cracks!

I'm going to be quite harsh, but they need to go!

We will do a comprehensive scan to see if there are any other infections lurking around

* Download MalwareBytes' anti-malware to the desktop
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

* Right-click on the Download_mbam-setup.exe icon to run it as admin to start the installation process

* If the firewall asks for permission for MalwareBytes to connect, accept

* Uncheck the trial version for MalwareBytes Pro

* It will update once done

* Go to the scan tab

* Select run a full scan

* Click on scan

* The scan starts

* At the end of the analysis, the message appears: The scan has completed normally.

* Click on view results to see the detected items

* Click OK to continue

* If any malware has been detected, click on view results

* Select all (or leave checked)

* Click on remove all

* MalwareBytes will destroy the files and registry keys and put a copy in quarantine

* MalwareBytes will open Notepad and copy the report there

* Restart the PC

* Once restarted, double-click on MalwareBytes

* Go to the report/log tab

* Click on it to display it, once displayed, click on edit
at the top of Notepad and then select all

* Go back to edit, then copy and return
to the forum in your reply

* Right-click in the reply box and paste

Good luck

--
If there is a problem, there is always a solution
Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

and there you go, I did just as you told me

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.06.03.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Maria :: VICENTA-17B950C [administrator]

03/06/2013 15:05:14
mbam-log-2013-06-03 (15-05-14).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
Scan options disabled: P2P
Item(s) scanned: 281530
Elapsed time: 1 hour(s), 42 minute(s), 52 second(s)

Memory processes detected: 0
(No harmful items detected)

Memory modules detected: 0
(No harmful items detected)

Registry key(s) detected: 0
(No harmful items detected)

Registry value(s) detected: 0
(No harmful items detected)

Registry data item(s) detected: 0
(No harmful items detected)

Folder(s) detected: 0
(No harmful items detected)

File(s) detected: 1
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\VQSE9CNO\upgrade[1].cab (PUP.Zwangi) -> Successfully quarantined and deleted.

(end)

lilidurhone · Answer

Super  Do a zhpdiag for me  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

I don't know if I sent two roooooooooooo oh my goodness If that's the case, I apologize.

edelweiss2604 · Answer

Hello
Did you find anything on my latest report?
The QuikShare is still in "add and remove." I tried to uninstall it and it's not working
In any case, I want to thank you for your help since yesterday

Best regards
edelweiss2604

edelweiss2604 · Answer

Sorry, I didn't do exactly like yesterday to send you the "zhpdiag" report  here is the link  https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130604_n129e5l11c5

lilidurhone · Answer

Hello  I'm going to warn you that your cr@cks are going to break!  -- If there's a problem, there’s always a solution Don't forget to put your subject in resolved :)

edelweiss2604 · Answer

I don't see where I could have any cracks because I paid for my creation software But if you say so, I believe you; in any case, I haven't cracked anything or I don't remember at all.

edelweiss2604 · Answer

I would like to have the knowledge in computer science that you have  tell me one thing that the family XP is worth at the current time?

lilidurhone · Answer

Hello edelweiss
Usage of zhpfix

Take your time and don't hesitate to let me know if you don't understand

Warning to those who pass by or read the custom script topic: do not reproduce on another computer!

* Disable the clean-up time of Avast (right-click on the orange ball > agent management > disable for 10 minutes)

* Copy only the lines indicated in bold below to the clipboard (highlight with the mouse then right-click to copy)

OPT:O4 - HKCU\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
OPT:O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
OPT:O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
OPT:O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
OPT:O4 - HKUS\S-1-5-21-1482476501-1844237615-1801674531-1004\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Software updater] . (...) -- C:\Documents and Settings\Maria\Application Data\FreeSoftwareUpdater\updater.exe =>PUP.Eorezo
O4 - HKUS\S-1-5-21-1482476501-1844237615-1801674531-1004\..\Run: [Software updater] . (...) -- C:\Documents and Settings\Maria\Application Data\FreeSoftwareUpdater\updater.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) . (...) - C:\Program Files\Avira\AntiVir Desktop\sched.exe (.not file.)
O23 - Service: Avira Real-time Protection (AntiVirService) . (...) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (.not file.)
O42 - Software: QuickShare - (.Linkury Inc..) [HKLM] -- {C7310710-42E5-4B6B-A838-795D7BD13542} =>PUP.QuickShare
[HKLM\Software\IncrediMail]
O43 - CFD: 29/07/2012 - 12:22:50 - [0,067] ----D C:\Documents and Settings\Maria\Local Settings\Application Data\Ares
O43 - CFD: 08/11/2012 - 20:04:00 - [0,000] ----D C:\Documents and Settings\Maria\Local Settings\Application Data\tuto4pc_fr_15 =>PUP.Eorezo
O47 - AAKE:Key Export SP - "C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe" [Enabled] .(...) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
O47 - AAKE:Key Export SP - "C:\Program Files\AIM\aim.exe" [Enabled] .(...) -- C:\Program Files\AIM\aim.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Documents and Settings\Maria\My Documents\Ares\Ares.exe" [Enabled] .(...) -- C:\Documents and Settings\Maria\My Documents\Ares\Ares.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\Ares\Ares.exe" [Enabled] .(...) -- C:\Program Files\Ares\Ares.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\dmwu.exe" [Enabled] .(...) -- C:\WINDOWS\system32\dmwu.exe (.not file.)
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}] =>PUP.SpecialSavings
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160}] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}] =>PUP.CrossRider
SS - | Auto 0 | (AntiVirSchedulerService) . (...) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
SS - | Auto 0 | (AntiVirService) . (...) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\Alien Skin Eye Candy 5.1 Nature\AlienSkin_Eye_Candy_5_NATURE_Incl_KeyGen-PARADOX\keygen.exe
C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\AlienSkin Eye Candy 5 Textures\keygen.exe
C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\keygen.exe
C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\Alien Skin Eye Candy 5.1 Nature\AlienSkin_Eye_Candy_5_NATURE_Incl_KeyGen-PARADOX\keygen.exe
C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\AlienSkin Eye Candy 5 Textures\keygen.exe
C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\keygen.exe
O41 - Driver: (avipbb) . (. - .) - C:\WINDOWS\system32\DRIVERS\avipbb.sys (.not file.)
O41 - Driver: (avkmgr) . (. - .) - C:\WINDOWS\system32\DRIVERS\avkmgr.sys (.not file.)
Sysrestore
EmptyTemp

* Launch ZHPFix (syringe icon) by double-clicking and then click OK

* You should see the lines above in the white box of ZHPFix, ensure that these are the correct lines.

* If the lines are not present, right-click in the box and click paste

* Click on the GO button to start the cleaning, and let the tool work.

* Restart the PC and post the report C:\ZHP\ZHPFixReport.txt

--
If there is a problem, there is always a solution
Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

I don't see the "GO" button.

edelweiss2604 · Answer

here

ZHPFix Report 2013.5.24.2 by Nicolas Coolman, Update of 24/05/2013
Registry export file:
Run by Maria at 04/06/2013 15:55:35
High Elevated Privileges: OK
Windows XP Home Edition Service Pack 3 (Build 2600)

Empty Recycle Bin

========== Software(s) ==========
DELETE QuickShare

========== Memory Processes ==========
DELETE Memory Process: C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\Alien Skin Eye Candy 5.1 Nature\AlienSkin_Eye_Candy_5_NATURE_Incl_KeyGen-PARADOX\keygen.exe
DELETE Memory Process: C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\keygen.exe

========== Registry Key(s) ==========
DELETE [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7310710-42E5-4B6B-A838-795D7BD13542}]
DELETE Key: Service: AntiVirSchedulerService
DELETE Key: Service: AntiVirService
DELETE Key: HKLM\Software\IncrediMail
DELETE Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}
DELETE Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}
DELETE Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160}
DELETE Key: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}
ABSENT Key: Service: AntiVirSchedulerService
ABSENT Key: Service: AntiVirService
DELETE Driver Key: avipbb
DELETE Driver Key: avkmgr

========== Registry Value(s) ==========
DELETE RunValue: CTFMON.EXE
ABSENT RunValue: CTFMON.EXE
DELETE RunValue: Software updater
ABSENT RunValue: Software updater
DELETE AAKE KeyValue: C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe
DELETE AAKE KeyValue: C:\Program Files\AIM\aim.exe
DELETE AAKE KeyValue: C:\Documents and Settings\Maria\My Documents\Ares\Ares.exe
DELETE AAKE KeyValue: C:\Program Files\Ares\Ares.exe
DELETE AAKE KeyValue: C:\WINDOWS\system32\dmwu.exe

========== Folder(s) ==========
DELETE Folder: C:\Documents and Settings\Maria\Local Settings\Application Data\Ares
DELETE Folder: C:\Documents and Settings\Maria\Local Settings\Application Data\tuto4pc_fr_15
DELETE Windows Temporary

========== File(s) ==========
DELETE File: c:\documents and settings\maria\application data\freesoftwareupdater\updater.exe
ABSENT File: c:\documents and settings\maria\application data\freesoftwareupdater\updater.exe
ABSENT File: c:\program files\avira\antivir desktop\sched.exe
ABSENT File: c:\program files\avira\antivir desktop\avguard.exe
ABSENT File: c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe
ABSENT File: c:\program files\aim\aim.exe
ABSENT File: c:\documents and settings\maria\my documents\ares\ares.exe
ABSENT File: c:\program files\ares\ares.exe
ABSENT File: c:\windows\system32\dmwu.exe
DELETE File: c:\program files\photofiltre studio x\plugins\eyecandy5000\alien skin eye candy 5.1 nature\alienskin_eye_candy_5_nature_incl_keygen-paradox\keygen.exe
ABSENT Folder/File: c:\program files\photofiltre studio x\plugins\eyecandy5000\alienskin eye candy 5 textures\keygen.exe
DELETE File: c:\program files\photofiltre studio x\plugins\eyecandy5000\keygen.exe
DELETE Windows Temporary

========== System Restore ==========
System restore point created successfully

========== Summary ==========
2: Memory Processes
12: Key(s) of the Registry
9: Value(s) of the Registry
3: Folder(s)
13: File(s)
1: Software(s)
1: System Restore

End of clean in 00mn 51s

========== File path report ==========
C:\ZHP\ZHPFix[R1].txt - 04/06/2013 15:55:36 [3715]

edelweiss2604 · Answer

Did you get it?

lilidurhone · Answer

Yes yes

Alright, one last little effort

I need a zhpdiag report to see if the fix worked

After that, we will still have updates to do

--
If there’s a problem, there’s always a solution
Don't forget to mark your topic as resolved :)

What is QuickShare?

34 answers

Gotek information

Texture issues in enshrouded

Self-invoking js function

My pc won’t charge anymore and runs super slowly

Download software against mcafee pop-ups

My computer stays connected for very little time

Unable to open xsl and xslx files

Archival hard drive no longer appears in file explorer

Samsung wallet

How to pair a receiver with an external speaker without fi