Webhelper infection

Question

Hello,  My PC has Windows Defender and Malwarebytes Premium. In the processes, when I open uTorrent, two processes utorrentie.exe appear. Signature RemotelE.exe, description Webhelper, located in AppData/Roaming/utorrent/updates/3.4.5_41372. I can't seem to get rid of them; I have tried with Malwarebytes, Avira, then Defender, CCleaner, Roguekiller... I used OTL to create reports, if anyone can help me to kill this.  Thank you, Shunt

Malekal_morte- · Answer

Hello,    Start with this:  Follow the AdwCleaner tutorial (by Xplode) This program allows you to remove adware and PUPs:  Download it to your desktop or downloads folder.  Run AdwCleaner, click on [Scan].  The scan may take several minutes, please be patient.  Once the scan is complete, do not uncheck anything, click on [Clean].  Once the cleaning is done, a report will open. Copy/paste the content of the report in your next response using copy/paste.  If that doesn't work, use the site http://pjjoint.malekal.com to host the report, give the link to the report in a new message. Note: The report is also saved under C:\AdwCleaner[S1].txt  Then:  Follow the FRST tutorial. (and take the time to read in order to apply it correctly - everything is explained there). Download and run the FRST scan, it will generate three FRST reports:  FRST.txt  Shortcut.txt  Additional.txt  Send, as explained, these three reports to the site http://pjjoint.malekal.com and return with the three pjjoint links that lead to those reports here in a new response so that we can consult them.   -- Like the angel you are, you laugh creating a lightness in my chest, Your eyes they penetrate me, (Your answer's always 'maybe') That's when I got up and left

Malekal_morte- · Answer

No antivirus: install Avast!: https://www.malekal.com/tutoriel-antivirus-avast/ (Especially enable LPI detections to detect pesky and adware programs)   Here is the correction to perform with FRST. You can refer to this explanatory note with screenshots to help you: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix  Open Notepad: Windows Key + R, in the run field, type notepad and OK. Copy/paste the following into it:   HKU\S-1-5-18\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)  2016-01-20 01:27 - 2016-01-20 01:27 - 00000000 ____D C:\Program Files (x86)\SEARCH~1 ProxyServer: [S-1-5-21-753848071-1856887396-2643092716-1000] => localhost:8080  2016-01-20 01:39 - 2016-01-21 17:49 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2  2016-01-20 01:39 - 2016-01-21 17:47 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy  2016-01-20 01:39 - 2016-01-20 01:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking  Once the text is pasted in Notepad. File menu then Save As. On the left, navigate to the desktop. In the bottom field, for the file name, enter: fixlist.txt Click Save - this will create a fixlist.txt file on the desktop.  Restart FRST and click the Fix button Depending on how it goes, a restart may be necessary (not mandatory). A text file will appear, copy/paste its content here in a new message.  Restart your computer    then reset your browsers: ================================== Reset your browsers and/or manually reconfigure your WEB browsers (homepage, search engine, etc.) as well as removing/disabling unnecessary/rogue extensions:  Firefox: https://www.malekal.com/reparer-firefox/?t=36057&start=  Google Chrome: https://www.malekal.com/reparer-google-chrome/?t=35837&start=  Internet Explorer and add-ons/search engines: https://forum.malekal.com/viewtopic.php?t=41399&start=   -- Like the angel you are, you laugh creating a lightness in my chest, Your eyes they penetrate me, (Your answer's always 'maybe') That's when I got up and left

Shunt · Answer

Re-  Results of the Farbar Recovery Scan Tool (x64) Version:18-01-2016 Executed by DS (2016-01-21 22:41:50) Run:1 Executed from C:\Users\DS\Desktop Loaded Profiles: DS (Available Profiles: DS) Boot Mode: Normal ==============================================  fixlist contents:  HKU\S-1-5-18\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.) 2016-01-20 01:27 - 2016-01-20 01:27 - 00000000 ____D C:\Program Files (x86)\SEARCH~1 ProxyServer: [S-1-5-21-753848071-1856887396-2643092716-1000] => localhost:8080 2016-01-20 01:39 - 2016-01-21 17:49 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2016-01-20 01:39 - 2016-01-21 17:47 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2016-01-20 01:39 - 2016-01-20 01:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking   HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\SpybotPostWindows10UpgradeReInstall => value(s) deleted successfully C:\Program Files (x86)\SEARCH~1 => moved successfully HKU\S-1-5-21-753848071-1856887396-2643092716-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer => value(s) deleted successfully C:\Program Files (x86)\Spybot - Search & Destroy 2 => moved successfully C:\ProgramData\Spybot - Search & Destroy => moved successfully C:\Windows\System32\Tasks\Safer-Networking => moved successfully  End of Fixlog 22:41:50  I have Windows Defender as my antivirus! Isn't that good?

Shunt · Answer

Hello,  Actually, these are processes belonging to Bittorrent. I looked on another computer that has uTorrent, and these applications are also there. So I think it's fine. Thank you for your valuable help, have a nice day.

Malekal_morte- · Answer

you need to double-click on utorrentie.exe and you will see the PATH field.  -- Like the angel you are, you laugh creating a lightness in my chest, Your eyes they penetrate me, (Your answer's always 'maybe') That's when I got up and left

Webhelper infection

5 answers

End of Fixlog 22:41:50

Keyboard stuck on u2

Obsolete browser

Windows button not working anymore

Direct streaming problem from pc to tv via hdmi port

Bose 700 subwoofer not connecting anymore

Connecting a sony handycam video 8 ccd f555e to an hd tv

Latest versions of camera raw and photoshop

Looking for blonde singer, short hair, rock.

Archival hard drive no longer appears in file explorer

Using jbl xtreme 5 for djing