A virus that drains the connection, is it possible?

Hello,
pass this on the PC that is causing issues to check:

• Download and save ZHPDiag on your desktop:

https://nicolascoolman.eu

or:

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

• Once downloaded to your desktop, run it

/!\ Users of Vista, Seven, W8, and W10:

• Right-click on the ZHPdiag logo, "run as Administrator"
• Click on "Scan"
• Let the tool work, even if it seems stuck!
• At the end of the scan, the report will display,

If no report appears, click on the "Report" button, it opens,

• Save the report on your Desktop
• Upload the ZHPDiag.txt report on:

https://www.cjoint.com/ to read => https://www.commentcamarche.net/faq/29493-utiliser-cjoint-pour-heberger-des-fichiers

, then copy/paste the link provided in your next response on the forum

--
O.o°* ??? Breathe deeply, write your message in proper French and clearly. It's going to be alright, you'll see, well, we’ll try!!! o°.Oø¤º°'°º¤ø

There are a few issues on your PC, but the cause is BitTorrent that starts up when the PC boots and takes your bandwidth!

--
O.o°* ??? Breathe deeply, write your message in proper French and clearly. It will be fine, you'll see, well, we try!!! o°.Oø¤º°'°º¤ø

Are you on WiFi?

You do not download, but the software launches!

Uninstall it, also uninstall Cacaoweb!

Uninstall or update QuickTime, it has an unpatched security vulnerability!

Download and save Zhpfix to your desktop:

https://nicolascoolman.eu

Run it, it will install on your PC,

/!\ Windows Vista, Seven, and W8 users:

• Right-click on the ZHPfix logo, "Run as Administrator"
• /!\ Warning /!\,
• this script is only valid for this PC, during the cleanup, do not use it on another PC, risk of crashing!
• Launch ZHPFix via the shortcut on your Desktop, the icon looks like a syringe.

Click on "import"

You will see a warning message, click OK.

• * Copy ( Ctrl + C ) and paste ( Ctrl + V ) the following lines in bold into the Zhpfix window:

---------------------------------------------------------

Zhpfix Script
[MD5.00000000000000000000000000000000] [APT] [EASLHVBRV1] (...) -- C:\ProgramData\TomorrowGames\TomorrowGames.exe (.not file.) [0] (.Activate.)
[MD5.00000000000000000000000000000000] [APT] [HRWCOIALQYVOTUMH] (...) -- C:\ProgramData\Service1104\Service1104.exe (.not file.) [0] (.Activate.)
[MD5.00000000000000000000000000000000] [APT] [Iinyom] (...) -- C:\PROGRA~1\SHOPPE~2\Apowbul.bat (.not file.) [0] (.Activate.)
[MD5.00000000000000000000000000000000] [APT] [Umyjf] (...) -- C:\PROGRA~1\SHOPPE~1\Uycuss.bat (.not file.) [0] (.Activate.)
opt:O39 - APT: EASLHVBRV1 - (...) -- C:\WINDOWS\Tasks\EASLHVBRV1.job [374] (.Orphan.)
opt:O39 - APT: HRWCOIALQYVOTUMH - (...) -- C:\WINDOWS\Tasks\HRWCOIALQYVOTUMH.job [362] (.Orphan.)
opt:O39 - APT: EASLHVBRV1 - (...) -- C:\WINDOWS\System32\Tasks\EASLHVBRV1 [2406] (.Orphan.)
opt:O39 - APT: HRWCOIALQYVOTUMH - (...) -- C:\WINDOWS\System32\Tasks\HRWCOIALQYVOTUMH [3038] (.Orphan.)
opt:O39 - APT: Iinyom - (...) -- C:\WINDOWS\System32\Tasks\Iinyom [2286] (.Orphan.)
opt:O39 - APT: Umyjf - (...) -- C:\WINDOWS\System32\Tasks\Umyjf [2282] (.Orphan.)
HKCU\SOFTWARE\DailyPcClean
HKCU\SOFTWARE\Store
HKCU\SOFTWARE\tstamptoken
HKCU\SOFTWARE\Tutorials
O43 - CFD: 21/12/2015 - [] D -- C:\ProgramData\19a87fa1ec024bbcbb41931263354405
O43 - CFD: 21/12/2015 - [] D -- C:\Users\Clément\AppData\Local\Image Logo
C:\WINDOWS\Tasks\EASLHVBRV1.job
C:\WINDOWS\Tasks\HRWCOIALQYVOTUMH.job
C:\WINDOWS\System32\Tasks\EASLHVBRV1
C:\WINDOWS\System32\Tasks\HRWCOIALQYVOTUMH
C:\WINDOWS\System32\Tasks\Iinyom
C:\WINDOWS\System32\Tasks\Umyjf
HKCU\SOFTWARE\DailyPcClean
HKCU\SOFTWARE\Store
HKCU\SOFTWARE\tstamptoken
HKCU\SOFTWARE\Tutorials
C:\ProgramData\19a87fa1ec024bbcbb41931263354405
C:\Users\Clément\AppData\Local\Image Logo
[MD5.00000000000000000000000000000000] [APT] [Image Experience] (...) -- C:\Users\Clément\AppData\Local\Image Experience\{D5C067AA-F715-453C-536B-486F695DAC8A}\ImageExperience.dll (.not file.) [0] (.Activate.)
[MD5.00000000000000000000000000000000] [APT] [Image Experience2] (...) -- C:\Users\Clément\AppData\Local\Image Experience\{D5C067AA-F715-453C-536B-486F695DAC8A}\dywr.dll (.not file.) [0] (.Activate.)
[MD5.00000000000000000000000000000000] [APT] [ASUS] (...) -- C:\Program Files (x86)\ASUS\ASUS Manager\Application Update\ASUSFourceUpdater.exe (.not file.) [0] (.Activate.)
opt:O39 - APT: Image Experience - (...) -- C:\WINDOWS\System32\Tasks\Image Experience [2516] (.Orphan.)
opt:O39 - APT: Image Experience2 - (...) -- C:\WINDOWS\System32\Tasks\Image Experience2 [2496] (.Orphan.)
opt:O4 - HKLM\..\Wow6432Node\Run: [TrayServer] D:\Program Files (x86)\MAGIX\Video_deluxe_17_Premium_Version_a_telecharger\TrayServer_fr.exe (.not file.)
FirewallRaz
EmptyPrefetch
ShortcutFix
Emptytemp
EmptyClsid

----------------------------------------------------------
- Click the "GO" button to start the cleanup,
- confirm the cleanup
- Host the ZHPFIX.txt report on
https://www.cjoint.com/

then copy/paste the provided link in your next response on the forum.

--
O.o°* ??? Take a deep breath, write your message in proper French and clearly. It's going to be okay, you'll see, at least we try!!! o°.Oø¤º°'°º¤ø

Normal, there's a detection problem! We are aware of it :-)

Restart the PC to see if everything works normally

--
O.o°* ??? Breathe deeply, write your message in proper French and clearly. Everything will be fine, you'll see, well we're trying!!! o°.Oø¤º°'°º¤ø

You haven't confirmed the uninstallation of BitTorrent and Cacaoweb, nor for QuickTime!

There are only 2 small things left to finish everything up.

--
O.o°* ??? Breathe deeply, write your message in proper French and clearly. It's going to be alright, you'll see, well, we're trying anyway!!! o°.Oø¤º°'°º¤ø

ok, but Cacaoweb also starts up!

Download Malwarebytes' Anti-Malware and save it to your desktop:

https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

or:

https://fr.malwarebytes.com/mwb-download/
or:

https://fr.malwarebytes.com/mwb-download/?gclid=CPqbs6_Trb0CFcfKtAodJFoANw

If you already have it on your PC, there’s no need to redownload it!

/!\Users of Vista, Windows 7, W8, and W10: Right-click on the Malwarebytes' Anti-Malware logo, "run as Administrator"

. Double-click on the downloaded file to start the installation process.

In the settings tab, choose the desired language

. In the "dashboard" tab, make sure your version is up to date

. If the firewall asks for permission to connect for Malwarebytes, accept
. Once the update is complete

In the "scan" tab, check the "custom scan" box and select the drive where Windows is installed,

In the settings tab, select "rootkit search," then the partition or drive where Windows is installed (C: for example)

then click on "start the scan"

. The scan starts.

It will take some time, so let it run.

. At the end of the scan, a message appears: The scan completed successfully.

Normally, the infections found are automatically moved to quarantine.

Click on view detailed log,
Then export, save its report in .txt format on your desktop,

Host it on Cjoint and copy and paste its link in your next message.

--
O.o°* ??? Breathe deeply, write your message clearly in good French. It will be fine, you will see, at least we’ll try!!! o°.Oø¤º°'°º¤ø

ok,

restart the PC and give me updates on its functioning before continuing

--
O.o°* ??? Breathe deeply, write your message in proper French and clearly. It will be fine, you’ll see, well we’ll try!!! o°.Oø¤º°'°º¤ø

Okay,

Download Delfix to your desktop:

https://toolslib.net/downloads/viewdownload/2-delfix/

or

Check the following boxes:
=> Remove disinfecting tools (checked by default)
=> Purge system restore

• Then click on Run and wait during the deletion process.
• When the procedures are completed, the tool will close and disappear from the desktop
• A report is saved in the clipboard: you just need to right-click and "paste" in your next response to send me the report
  • the report is stored at this location: C:\DelFix.txt

Warning: The report is unique and is deleted each time we re-run one or more options of DelFix.

Note:
Delfix does not uninstall MBAM, it's up to you whether you want to keep it or uninstall it.

Update your antivirus, run a full scan of your PC, and keep me posted on the results

--
O.o°* ???Breathe deeply, write your message in good French and clearly. It will be fine, you'll see, after all we're trying !!! o°.Oø¤º°'°º¤ø

Update your antivirus, run a full scan of your PC, and keep me informed of the results.

--
O.o°* ??? Breathe deeply, write your message in good French and clearly. It will be fine, you will see, we will try!!! o°.Oø¤º°'°º¤ø

ok, update Windows Defender and run a full scan to see what it finds!

--
O.o°* ???Breathe deeply, write your message in good French and clearly. It will be fine, you'll see, well, we'll give it a try!!! o°.Oø¤º°'°º¤ø

Great,

with that, happy surfing ;-)

--
O.o°* ??? Breathe deeply, write your message in good French and clearly. It will go well, you’ll see, well we’ll try!!! o°.Oø¤º°'°º¤ø

I told you what was draining your connection,
we cleaned the PC,

I don't know what more we can do!

What were you expecting?

--
O.o°* ??? Breathe deeply, write your message in proper French and clearly. It's going to be fine, you'll see, well we’ll try!!! o°.Oø¤º°'°º¤ø

I can disinfect the PC, improve the performance of a PC, but I can't fix your bandwidth issue!

How many PCs are connected to your box?

--
O.o°* ??? Take a deep breath, write your message in proper French and clearly. It's going to be fine, you'll see, well, we’ll try!!! o°.Oø¤º°'°º¤ø

So this is not specific to your PC, but to your bandwidth!

Know that the bandwidth is shared for your connection (the more devices connected, the slower it will be), the most recent and high-performance equipment takes priority over the others!

--
O.o°* ??? Breathe deeply, write your message clearly in good French. It will go well, you'll see, well we're trying!!! o°.Oø¤º°'°º¤ø