View original (French)

Malicious Software (blue logo written in Chinese)

Closed
Dinethan Posted messages 1 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello
my husband downloaded a trial software to convert video files and as usual, he installed it without unchecking all the crap apps that come with it! Anyway, so far I’m used to it, usually it just limits to some unwanted search bars, but not this time!!
So I had OurSurfing on all my web pages, and I think I managed to get rid of it by changing the settings in Chrome and Mozilla and by deleting all the shortcuts to replace them with clean ones.
But I ended up with a Chinese software, I suppose (I can't read it), it has a blue triangle logo that runs in the background and opens a window at startup in the bottom right, like a weather app!
I can't use AdwCleaner, it stops before the end, and Malwarebytes and Spybot don't remove it! I ran JRT which worked for nearly 3 hours, but I can't read the report.
Thanks for your help.

6 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hi,

    Start with this:

    Follow the AdwCleaner tutorial https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/?t=33839&start= (by Xplode)
    Download it to your desktop or downloads folder.
    Run AdwCleaner, click on [Scan].
    The scan may take several minutes, be patient.
    Once the scan is complete, do not uncheck anything, click on [Clean]

    Once the cleaning is finished, a report will open. Copy/paste the content of the report into your next response by copying/pasting.
    If that doesn't work, use the site http://pjjoint.malekal.com to host the report, provide the link to the report in a new message.

    Note: The report is also saved under C:\AdwCleaner[S1].txt

    then:

    Follow this FRST tutorial: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/
    (and take the time to read in order to apply it correctly - everything is explained there).
    Download and run the FRST scan, it will generate three FRST reports:
    • FRST.txt
    • Shortcut.txt
    • Additional.txt


    Send, as explained, these three reports to the site http://pjjoint.malekal.com and return the three pjjoint links that lead to these reports here in a new response so that we can review them.

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left.
    0
    1. Dinethan Posted messages 1 Status Member
       
      Thank you for your response, but as I mentioned, I can't even run AdwCleaner; when I launch it, a window opens saying "incorrect function"!
      I will go directly to the second step.
      0
    3. Boludo_vert
       
      Hello, I have the same problem...
      here are my FRST reports:
      http://pjjoint.malekal.com/files.php?id=20160610_p7o7i14e12p15
      http://pjjoint.malekal.com/files.php?id=FRST_20160610_z5c9t14v7d13
      http://pjjoint.malekal.com/files.php?id=20160610_o10u5c6q8k10
      Thank you for your responses.
      0
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    It's Tencent the antivirus he installed.
    Plus there's already Rising with Avast!.

    AV: ???????? (Enabled - Up to date) {6F9C3F92-B625-0E47-F0B1-447602EC65F5}
    AV: Rising Antivirus (Enabled - Up to date) {DBC966C2-BD90-87CD-5A01-4DFB1D2EC867}
    AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

    with Spybot on top.

    I think the best thing is to do a system restore to a date prior to the installation of all this.
    => https://www.malekal.com/restauration-systeme-windows/

    Then uninstall Rising if it's still there.
    The same goes for Spybot, not super effective.

    Basically keep only Avast!.

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left.
    0
  3. Dinethan Posted messages 1 Status Member
     
    Thank you for your help, but the restoration isn't working; I can't get rid of Tencent, and everything is in Chinese characters, so even when it opens, I don't know what to click to
    close it!
    0
  4. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    I hope we will have a stable computer after all this.
    Rising antivirus, you should be able to uninstall it, it should be listed in the programs.
    Also uninstall Spybot.

    Do a ZHPCleaner cleanup: https://forum.malekal.com/viewtopic.php?t=48954&start=

    Here is the correction to be made with FRST.
    You can refer to this explanatory note with screenshots to help you: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

    Open Notepad: Windows key + R, in the run field, type notepad and OK.
    Copy/paste the following into it:

    HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\QQPCTray.exe [355296 2015-06-09] (Tencent)
    HKLM-x32\...\Run: [RavTRAY] => C:\Program Files (x86)\Rising\RAV\RSTRAY.EXE [111000 2015-06-10] (Beijing Rising Information Technology Co., Ltd.)
    ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\QMGCShellExt64.dll [2015-06-09] (Tencent)
    HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
    AppInit_DLLs: C:\PROGRA~2\Optimizer Pro\OptProCrash_x64.dll => C:\PROGRA~2\Optimizer Pro\OptProCrash_x64.dll File not found
    BHO: ????????? -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\TSWebMon64.dat [2015-06-09] (Tencent)
    FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [2014-05-30] (????)
    FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\npQMExtensionsMozilla.dll [2015-06-09] (Tencent Technology (Shenzhen) Company Limited)
    FF Plugin-x32: @rising.com.cn/nprising -> C:\Program Files (x86)\Rising\RAV\nprising.dll [2015-06-09] (Beijing Rising Information Technology Co., Ltd.)
    S3 TAOFrame; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\TAOFrame.exe [293728 2015-06-09] (Tencent)
    R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\QQPCRtp.exe [297608 2015-06-09] (Tencent)
    R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\QMUdisk64.sys [62264 2015-04-17] (Tencent)
    R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\QQSysMonX64.sys [129336 2015-06-09] (????)
    R1 rsutils; C:\Windows\System32\DRIVERS\rsutils.sys [71760 2015-06-10] (Beijing Rising Information Technology Co., Ltd.)
    R3 rt61x64; C:\Windows\System32\DRIVERS\WMP54Gv41x64.sys [446304 2010-04-07] (Ralink Technology, Corp.)
    R3 spz5000; C:\Windows\System32\DRIVERS\spz5000.sys [3225344 2009-11-05] ()
    R0 sysmon; C:\Windows\System32\DRIVERS\sysmon.sys [119256 2015-06-10] (Beijing Rising Information Technology Co., Ltd.)
    R2 TAOAccelerator; C:\Windows\system32\Drivers\TAOAccelerator64.sys [99640 2015-06-09] (Tencent)
    R1 TAOKernelDriver; C:\Windows\System32\Drivers\TAOKernel64.sys [174392 2015-06-09] (Tencent Technology(Shenzhen) Company Limited)
    R3 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [87864 2015-06-09] (????)
    R3 TS888x64; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\TS888x64.sys [28984 2015-06-10] (Tencent)
    R1 TSCPM; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\tscpm64.sys [42296 2015-06-09] (????)
    R1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\TsDefenseBT64.sys [28472 2015-06-09] (Tencent)
    S3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [38200 2015-06-09] (????)
    R1 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\TSSysKit64.sys [87352 2015-06-09] (????)
    2015-06-09 20:02 - 2015-06-10 09:36 - 00028984 _____ (Tencent) C:\Windows\SysWOW64\Drivers\TS888x64.sys
    2015-06-09 17:18 - 2015-06-09 17:18 - 00000000 ____D C:\ProgramData\TXQMPC
    2015-06-09 17:03 - 2015-06-09 17:03 - 00000000 ____D C:\Program Files\Common Files\Tencent
    2015-06-09 17:03 - 2015-06-09 17:02 - 00099640 _____ (Tencent) C:\Windows\system32\Drivers\TAOAccelerator64.sys
    2015-06-09 17:03 - 2015-06-09 17:02 - 00038200 _____ (????) C:\Windows\system32\Drivers\TSSKX64.sys
    2015-06-09 17:02 - 2015-06-10 06:24 - 00000000 ____D C:\Users\La Case\AppData\Roaming\Tencent
    2015-06-10 06:59 - 2015-06-10 06:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rising Antivirus
    2015-06-10 06:59 - 2015-06-10 06:57 - 00091928 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\SysWOW64\vpatch.dll
    2015-06-10 06:58 - 2015-06-10 06:58 - 00000134 _____ C:\Windows\SysWOW64\BsMain.ini
    2015-06-10 06:58 - 2015-06-09 21:41 - 00325400 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\ravext64.dll
    2015-06-10 06:58 - 2015-06-09 21:41 - 00256280 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\SysWOW64\ravext.dll
    2015-06-10 06:58 - 2015-06-09 21:38 - 00041784 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\hvm.sys
    2015-06-10 06:58 - 2015-06-09 21:37 - 00240472 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\SysWOW64\bsmain.exe
    2015-06-10 09:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At34.job
    2015-06-10 08:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At33.job
    2015-06-10 07:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At32.job
    2015-06-10 06:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At31.job
    2015-06-10 05:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At30.job
    2015-06-10 04:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At29.job
    2015-06-10 03:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At28.job
    2015-06-10 02:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At27.job
    2015-06-10 01:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At26.job
    2015-06-10 00:25 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At25.job
    2015-06-09 23:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At48.job
    2015-06-09 22:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At47.job
    2015-06-09 21:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At46.job
    2015-06-09 19:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At44.job
    2015-06-09 18:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At43.job
    2015-06-09 17:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At42.job
    2015-06-09 16:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At41.job
    2015-06-09 15:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At40.job
    2015-06-09 14:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At39.job
    2015-06-09 13:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At38.job
    2015-06-09 12:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At37.job
    2015-06-09 11:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At36.job
    2015-06-09 10:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At35.job
    2015-06-08 20:00 - 2012-11-25 04:26 - 00000340 _____ C:\Windows\Tasks\At45.job
    2012-11-25 04:26 - 2012-11-25 04:26 - 0000001 _____ () C:\ProgramData\0D42NMM5.exe.b
    2012-11-25 04:26 - 2012-11-25 04:26 - 0000001 _____ () C:\ProgramData\0D42NMM5.exe_.b

    Once you've pasted the text into Notepad.
    File menu then Save As.
    On the left, go to the desktop.
    In the field below, file name put: fixlist.txt
    Click Save - this will create a fixlist.txt file on the desktop.

    Restart FRST and click on the Fix button
    Depending on how it goes, a restart may be necessary (not mandatory).
    A text file will appear, copy/paste its content here in a new message.

    Restart the computer

    then reset your browsers:
    ==================================
    Reset your browsers and/or manually reconfigure your web browsers (home page, search engine, etc.) but also remove/disable unnecessary/parasite extensions:

    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0
  6. Dinethan Posted messages 1 Status Member
     
    Back on the tablet because since the last manipulations I have lost Wi-Fi connection on my desktop PC! Yet in the system the card is not disabled
    And I still have that damn Tencent antivirus
    I just did a restore without success!
    0
    1. Dinethan Posted messages 1 Status Member
       
      In fact, if the Wi-Fi card is disabled, well, not exactly, the error code is as follows: "Windows cannot start this device..... Configuration information in the registry is incomplete or damaged."
      0
    2. Dinethan Posted messages 1 Status Member
       
      I'll be back later; I'm going to move my PC closer to the router to disable the Wi-Fi card and reinstall it! My tablet will stay connected in case of any changes.
      0
    3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      I’m not surprised about the internet connection.
      Antivirus programs are loading slowly, so manually removing them causes issues.

      Try this: https://forum.malekal.com/viewtopic.php?t=29460&start=
      hopefully it helps.
      0
    4. Dinethan Posted messages 1 Status Member > Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention  
       
      Thank you for all your help, but I'm off for an afternoon of formatting/reinstalling!
      0
    5. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      I think this is unfortunately the best solution.

      When you install applications, read carefully and decline all additional programs.
      Otherwise, you'll be bothered afterward.

      A few tips:


      To prevent malicious sites, you can install Blockulicious: https://forum.malekal.com/viewtopic.php?t=46656&start=


      To avoid getting tricked again.
      Read - PUPs / Adware: https://www.malekal.com/adwares-pup-protection/
      (Make sure to enable LPI detections to identify adware and potentially unwanted programs)


      The rest of the security: http://forum.malekal.com/comment-securiser-son-ordinateur.html
      0
  7. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    If you need help, please create your own topic by going to the Virus forum and clicking on the Ask a question button.
    Fill in the fields and submit your request.



    --
    Please press any key to continue the disinfection...
    0