A strange program in my processes that is taking up performance

Solved

KaiwZe -

A strange program in my processes that takes up performance, is this program malicious (the QMEmulator thing)?
Thank you in advance

5 answers

Answer 1 / 5
fabul Moderator
Hello,

QMEmulatorService.exe

Tencent Program

1
Answer 2 / 5
billmaxime
Hello

I redirected your topic to the Virus/Security forum because your PC is infected with Tencent
```
Information file QMEmulatorService.exe The process known as belongs to the software by Tencent (www.tencent.com/i).
```
To move the topic forward, do this:

Download FRST from (Fabar) to your desktop --> click here

PS: take the version that corresponds to your PC (32 or 64 bits) -> click here

Run it as an administrator (right-click)

At the end of the scan, the FRST and ADDITION reports will appear on your desktop and in C:\FRST\LOG

Post the reports via cjoint --> click here

@+
1
Answer 3 / 5
KaiwZe Author
Here are the two links
https://www.cjoint.com/c/KEicxXZnLjs
https://www.cjoint.com/c/KEiczmAXWSs

0
Answer 4 / 5
MisteryBean Moderator
Hello,

QMEmulatorService is part of gameloop.
If you want to get rid of it, do the following

Re-enable system restore

/!\ You are starting to run out of space on C:
```
Drive c: (Acer) (Fixed) (Total:475.82 GB) (Free:14.58 GB) NTFS
```
-----------
-----------------------

Uninstall:

=> Avast Secure Browser
=> Gameloop
=> WebAdvisor by McAfee
=> Wondershare Helper Compact 2.6.0

-----------
-----------------------

--> Copy what is here: https://textup.fr/550646MF from start:: to end:: (without pasting it anywhere)

--> Open FRST (or FRST64) as administrator and click on Fix

--> A fixlog file is created in the same location as FRST, post it

--> Let me know if you still have the problem.

-----------
-----------------------

Upon restart, Uninstall:

=> Avast Update Helper

--
Security contributor.
0
1. KaiwZe Author
  
  Thank you a thousand times, it seems that the problem is resolved.
  
  Results of Farbar Recovery Scan Tool (x64) Version: 28-04-2021
  Executed by charl (08-05-2021 13:38:34) Run:1
  Executed from C:\Users\charl\Desktop
  Loaded profiles: charl
  Boot Mode: Normal
  ==============================================
  
  fixlist content:
  closeprocesses:
  createrestorepoint:
  Avast Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.8.1065.0 - AVAST Software) Hidden
  FirewallRules: [{94F0C04B-C297-44AE-986E-4BA3BB266C33}] => (Allow) c:\program files\txgameassistant\ui\TxGaDcc.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  FirewallRules: [{A53B2216-FC58-44FA-9475-FEF371CE12D6}] => (Allow) c:\program files\txgameassistant\ui\bugreport.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  FirewallRules: [{FE6A729B-23FA-49C6-B017-74AAC33B2805}] => (Allow) c:\program files\txgameassistant\ui\TInst.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{2E2D04D5-C710-420C-877F-779D5B5F845E}] => (Allow) c:\program files\txgameassistant\ui\adb.exe () [Unsigned file]
  FirewallRules: [{3D9ED150-7D26-42A3-8CD0-565121FB6701}] => (Allow) c:\program files\txgameassistant\ui\AndroidEmulator.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  FirewallRules: [{3A23EF58-33D9-4B8E-84FA-02107CB7169C}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{9F364463-6732-4E71-B875-3C4D645409D7}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{9FD21F67-5EF3-4ED0-9C0A-B304F2C5CBD4}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{36BF5A33-4906-4A0A-8548-8D826C93190A}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{70D0A20F-A92C-4E29-B7BF-AEEAFB95E640}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{8DD10F02-65B3-46FD-9BEE-ECF8816ECD94}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{4B524AAD-D80F-4463-B016-AC18F86BF94A}] => (Allow) c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  FirewallRules: [{1A5594FD-C40D-41B9-AE8A-6C1938750EB4}] => (Allow) c:\program files\txgameassistant\appmarket\GameDownload.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  FirewallRules: [{3516244E-186C-4637-AE0C-4CE2E2B41B3B}] => (Allow) c:\program files\txgameassistant\appmarket\QQExternal.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{2769127B-1F62-4D5F-B086-15C0F33E9383}] => (Allow) c:\program files\txgameassistant\appmarket\bugreport.exe (Tencent Technology(Shenzhen) Company Limited -> 微软帮助)
  FirewallRules: [{8F5078B6-B0A2-45B1-9AD9-B9D19432972A}] => (Allow) c:\program files\txgameassistant\appmarket\TInst.exe (Tencent Technology(Shenzhen) Company Limited -> )
  FirewallRules: [{A348CA40-68F4-438B-8779-46440108A282}] => (Allow) c:\program files\txgameassistant\appmarket\AppMarket.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  R2 QMEmulatorService; C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe [198736 2020-08-15] (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  R2 aow_drv; C:\Program Files\TxGameAssistant\UI\3.21.1282.100\aow_drv_x64_ev.sys [916544 2020-08-18] (Tencent Technology(Shenzhen) Company Limited -> Tencent)
  S3 tesrsdt; C:\WINDOWS\system32\drivers\tesrsdt.sys [812208 2020-10-18] (Tencent Technology(Shenzhen) Company Limited -> TENCENT)
  S3 UniSafe; C:\WINDOWS\system32\drivers\UniSafe.sys [581912 2021-02-03] (Tencent Technology(Shenzhen) Company Limited -> TENCENT)
  HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
  HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
  C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact
  C:\Users\charl\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho
  CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
  CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
  c:\program files\txgameassistant
  hosts:
  emptytemp:
  
  Processes closed successfully.
  The restore point has been created successfully.
  "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}\SystemComponent" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{94F0C04B-C297-44AE-986E-4BA3BB266C33}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{A53B2216-FC58-44FA-9475-FEF371CE12D6}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{FE6A729B-23FA-49C6-B017-74AAC33B2805}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{2E2D04D5-C710-420C-877F-779D5B5F845E}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{3D9ED150-7D26-42A3-8CD0-565121FB6701}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{3A23EF58-33D9-4B8E-84FA-02107CB7169C}" => successfully deleted
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{9F364463-6732-4E71-B875-3C4D645409D7}" => successfully deleted
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{9FD21F67-5EF3-4ED0-9C0A-B304F2C5CBD4}" => successfully deleted
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{36BF5A33-4906-4A0A-8548-8D826C93190A}" => successfully deleted
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{70D0A20F-A92C-4E29-B7BF-AEEAFB95E640}" => successfully deleted
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{8DD10F02-65B3-46FD-9BEE-ECF8816ECD94}" => successfully deleted
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4B524AAD-D80F-4463-B016-AC18F86BF94A}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{1A5594FD-C40D-41B9-AE8A-6C1938750EB4}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{3516244E-186C-4637-AE0C-4CE2E2B41B3B}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{2769127B-1F62-4D5F-B086-15C0F33E9383}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{8F5078B6-B0A2-45B1-9AD9-B9D19432972A}" => not found
  "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{A348CA40-68F4-438B-8779-46440108A282}" => not found
  QMEmulatorService => service not found.
  aow_drv => service not found.
  HKLM\System\CurrentControlSet\Services\tesrsdt => successfully deleted
  tesrsdt => service successfully deleted
  HKLM\System\CurrentControlSet\Services\UniSafe => successfully deleted
  UniSafe => service successfully deleted
  "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Wondershare Helper Compact.exe" => successfully deleted
  "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wondershare Helper Compact.exe" => successfully deleted
  "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact" => not found
  "C:\Users\charl\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho" => not found
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\fheoggkfdfchfphceeifdbepaooicaho => not found
  HKLM\SOFTWARE\Google\Chrome\Extensions\fheoggkfdfchfphceeifdbepaooicaho => not found
  "c:\program files\txgameassistant" => not found
  C:\Windows\System32\Drivers\etc\hosts => successfully moved
  Hosts restored successfully.
  
  =========== EmptyTemp: ==========
  
  BITS transfer queue => 8937472 B
  DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 21422439 B
  Java, Flash, Steam htmlcache => 327859208 B
  Windows/system/drivers => 9713212 B
  Edge => 0 B
  Chrome => 332040458 B
  Firefox => 0 B
  Opera => 0 B
  
  Temp, IE cache, history, cookies, recent:
  Default => 0 B
  ProgramData => 0 B
  Public => 0 B
  systemprofile => 0 B
  systemprofile32 => 0 B
  LocalService => 14978 B
  NetworkService => 20016 B
  charl => 80771221 B
  
  RecycleBin => 10425612346 B
  EmptyTemp: => 10.4 GB temporary data deleted.
  
  ================================
  
  The system had to restart.
  End of Fixlog 13:41:09
  
  0
Answer 5 / 5
MisteryBean Moderator
RE_

OK

To automatically delete all files/folders created by FRST and the tool itself, rename FRST/FRST64.exe to uninstall.exe and run it.

The procedure requires a restart.

Good luck ;-)

--
Security Contributor.

0

A strange program in my processes that is taking up performance

5 answers

End of Fixlog 13:41:09

Creating a secondary email address on my free account

Possible word error

Messaging

Caught in beauty

My computer shows "missing os" on startup, what should i do?

Epson scan2

Asus vivobook s16

Improved performance with windows 11 26h2 update

Larousse french app update apk

File locked by another user