Qv06.com
Solved
Hello,
I'm infected with a "Qv06.com" virus and I can't get rid of it (neither with Avast nor Spybot). This virus changes my browser settings. I'm using Chrome and I'm on Windows 7 Home Edition 64-bit.
Thank you to the users who are willing to help me.
I'm infected with a "Qv06.com" virus and I can't get rid of it (neither with Avast nor Spybot). This virus changes my browser settings. I'm using Chrome and I'm on Windows 7 Home Edition 64-bit.
Thank you to the users who are willing to help me.
18 answers
-
Hi, uninstall Spybot, it's useless.
==
Download and save ADWCleaner to your desktop:
do not click on Download, wait for the download window to appear for confirmation
Run it (For Vista/7/8 => right-click "Run as administrator")
click on deletion and post C:\Adwcleaner[Sx].txt
==
download and run this tool, then paste the content of the report that will open at the window's closure (if it doesn't open: C:\Rapport.txt
http://www.security-helpzone.com/Tools/g3n/Shortcut_Module.exe
==
close all windows and applications during the installation and scanning.
▶ Download here:
Malwarebytes
▶ Install it (make sure to choose "French"; do not modify the installation settings) and update it.
restart Malwarebytes by strictly following these instructions:
! Disconnect and close all running applications!
▶ Launch Malwarebyte's.
Do a "Complete" scan.
▶ Let the program work (and do nothing else with the PC during the scan).
▶ at the end, click on "results".
▶ Ensure all infected items are checked, then click "delete".
▶ Note: if your PC needs to restart to finish cleaning, do it!
▶ Post the saved report after deleting the infected items (in the "report/log" tab of Malwarebytes, the latest one)
==
Download here: OTL
▶ save it on your Desktop.
if you have XP => double-click
if you have Vista or Windows 7 / 8 => right-click "run as...."
on OTL.exe to launch it.
▶ => Click here to see the Configuration
▶ Copy and paste the content of the following in bold in the lower part of OTL "Customization"
HKCU\Software
HKLM\Software
HKCU\Software\Microsoft\Command Processor /s
%Homedrive%\*
%Homedrive%\*.
%Userprofile%\*
%Userprofile%\*.
%Allusersprofile%\*
%Allusersprofile%\*.
%LocalAppData%\*
%LocalAppData%\*.
%Userprofile%\Local Settings\Application Data\*
%Userprofile%\Local Settings\Application Data\*.
%programFiles%\*
%programFiles%\*.
%Systemroot%\Installer\*.
%Systemroot%\Temp\*.exe /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\system32\*.in*
%systemroot%\Tasks\*
%systemroot%\Tasks\*.
%systemroot%\system32\Tasks\*
%systemroot%\system32\Tasks\*.
%systemroot%\system32\drivers\*.sy* /lockedfiles
%systemroot%\system32\config\*.exe /s
%Systemroot%\ServiceProfiles\*.exe /s
%systemroot%\system32\*.sys
dir C:\ /S /A:L /C
msconfig
activex
/md5start
explorer.exe
winlogon.exe
wininit.exe
volsnap.sys
atapi.sys
ndisuio.sys
ndis.sys
cdrom.sys
i8042prt.sys
iastor.sys
tdx.sys
netbt.sys
afd.sys
/md5stop
netsvcs
safebootminimal
safebootnetwork
CREATERESTOREPOINT
▶ Click on Scan.
At the end of the scan, Notepad will open with the report (OTL.txt).
This file is on your Desktop (generally C:\Documents and settings\your_session_name\<Desktop>\OTL.txt)
▶▶▶ DO NOT POST IT ON THE FORUM (it's too long)
host OTL.txt and extra.txt on https://www.cjoint.com/ and give the links
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => same flop as Vista X 10 -
Thank you very much,
I will try to do all that this evening.
Have a good day. -
ok to read your message :)
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => same flop as Vista X 10 -
Good evening,
I'm sorry, but how should I post the Txt file? -
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => same flop as Vista X 10-
# AdwCleaner v2.303 - Report created on 06/20/2013 at 18:54:15
# Updated on 06/08/2013 by Xplode
# Operating system: Windows 7 Home Premium Service Pack 1 (64 bit)
# Username: Yannick LapTop - YANNICKLAPTOP
# Boot mode: Normal
# Executed from: C:\Users\Yannick LapTop\Desktop\AdwCleaner.exe
# Option [Removal]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted: C:\Program Files (x86)\Conduit
Folder Deleted: C:\Program Files (x86)\Software
Folder Deleted: C:\ProgramData\Tarma Installer
Folder Deleted: C:\ProgramData\Trymedia
Folder Deleted: C:\Users\Yannick LapTop\AppData\Local\PutLockerDownloader
Folder Deleted: C:\Users\Yannick LapTop\AppData\LocalLow\Conduit
Folder Deleted: C:\Users\Yannick LapTop\AppData\LocalLow\mipony-plugin
Folder Deleted: C:\Users\Yannick LapTop\AppData\Roaming\eIntaller
File Disinfected: C:\Users\Yannick LapTop\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
File Disinfected: C:\Users\Yannick LapTop\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
File Disinfected: C:\Users\Yannick LapTop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
File Disinfected: C:\Users\Yannick LapTop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
File Disinfected: C:\Users\Yannick LapTop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
***** [Registry] *****
Key Deleted: HKCU\Software\1ClickDownload
Key Deleted: HKCU\Software\APN PIP
Key Deleted: HKCU\Software\AppDataLow\HavingFunOnline
Key Deleted: HKCU\Software\AppDataLow\Software\Conduit
Key Deleted: HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted: HKCU\Software\AppDataLow\Software\mipony-plugin
Key Deleted: HKCU\Software\AppDataLow\Toolbar
Key Deleted: HKCU\Software\PIP
Key Deleted: HKCU\Software\Softonic
Key Deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key Deleted: HKLM\Software\Boxore
Key Deleted: HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted: HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Deleted: HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted: HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted: HKLM\Software\Conduit
Key Deleted: HKLM\Software\Desksvc
Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Key Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{960AAEAC-7028-4F49-8EE9-BF0FE6E1BCF6}
Key Deleted: HKLM\Software\mipony-plugin
Key Deleted: HKLM\Software\PIP
Key Deleted: HKLM\Software\qvo6Software
Key Deleted: HKLM\Software\V9
Key Deleted: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted: HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key Deleted: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90D46C30-9F25-4104-AEA9-35C3F84477FF}
Key Deleted: HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted: HKLM\SOFTWARE\Tarma Installer
Value Deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{90D46C30-9F25-4104-AEA9-35C3F84477FF}]
Value Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{90D46C30-9F25-4104-AEA9-35C3F84477FF}]
Value Deleted: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{90D46C30-9F25-4104-AEA9-35C3F84477FF}]
***** [Browsers] *****
-\\ Internet Explorer v10.0.9200.16611
Replaced: [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=ild&from=ild&uid=HitachiXHTS545032B9A300_091226PBPC00QDEXTLWLX&ts=1371486491 --> hxxp://www.google.com
Replaced: [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=ild&from=ild&uid=HitachiXHTS545032B9A300_091226PBPC00QDEXTLWLX&ts=1371486491 --> hxxp://www.google.com
Replaced: [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=ild&from=ild&uid=HitachiXHTS545032B9A300_091226PBPC00QDEXTLWLX&ts=1371486491 --> hxxp://www.google.com
Replaced: [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=ild&from=ild&uid=HitachiXHTS545032B9A300_091226PBPC00QDEXTLWLX&ts=1371486491 --> hxxp://www.google.com
Replaced: [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=ild&from=ild&uid=HitachiXHTS545032B9A300_091226PBPC00QDEXTLWLX&ts=1371486491 --> hxxp://www.google.com
-\\ Google Chrome v27.0.1453.110
File: C:\Users\Yannick LapTop\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] The file contains no illegitimate entries.
*************************
AdwCleaner[S1].txt - [6385 bytes] - [06/20/2013 18:54:15]
########## EOF - C:\AdwCleaner[S1].txt - [6445 bytes] ########## -
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.06.20.08
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Yannick LapTop :: YANNICKLAPTOP [administrator]
20/06/2013 19:19:33
mbam-log-2013-06-20 (19-19-33).txt
Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
Scan options disabled: P2P
Item(s) scanned: 485575
Elapsed time: 2 hour(s), 2 minute(s), 19 second(s)
Detected memory processes: 0
(No harmful items detected)
Detected memory modules: 0
(No harmful items detected)
Detected Registry key(s): 0
(No harmful items detected)
Detected Registry value(s): 0
(No harmful items detected)
Detected Registry data item(s): 0
(No harmful items detected)
Detected folder(s): 0
(No harmful items detected)
Detected file(s): 1
C:\Program Files (x86)\WinRAR\Patch.exe (PUP.RiskwareTool.CK) -> Successfully quarantined and deleted.
(end) -
-
-
re
missing Extras.txt
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => the same flop as Vista X 10 -
-
In Chrome, you need to have an extension marked qv06.com, delete it.
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => the same flop as Vista X 10 -
There are no extensions installed in Chrome.
-
bizarre dans chrome je vois ceci :
CHR - homepage: http://www.qvo6.com/?utm_source=b&utm_medium=ild&from=ild&uid=HitachiXHTS545032B9A300_091226PBPC00QDEXTLWLX&ts=1371486491
https://www.cjoint.com/?CFwhnjxWOBx
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => same flop as Vista X 10 -
-
change your startup page
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => the same flop as Vista X 10 -
At startup, I have "open the new tab page."
-
hello look here
http://www.clubic.com/navigateur-internet/google-chrome/aide-astuce-tuto/google-chrome-comment-changer-la-page-d-accueil-2460.html
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => same flop as Vista X 10 -
Hello,
I have changed my homepage and everything is working fine,
Thank you for your support. -
bah if it's not done => the cleaning :
https://forums-fec.be/entraide/viewtopic.php?f=11&t=229
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => same flop as Vista X 10 -
There you go, it's done.
A big thank you to you. -
a big nothing to you ^^
--
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => same flop as Vista X 10
