Kinesisk malware

[svewik]

Klickade på något som jag inte skulle tyvärr. KMSpico

 

Nu pratar edge kinesiska (eller japanska, eller vad det nu är för konstiga tecken). Dessutom dyker det upp fönster som bara dyker upp på annat ställe om man försöker stänga. Det kommer förfrågningar om tillåtelse att ändra i datorn. conhost.exe och lightgate.exe. Det går att neka bort dom.

 

Fick lite panik och körde ADWCleaner som fick bort en del. Men jag vill gärna ha bort conhost och lightgate. Fins på flera ställen i datorn. Dessutom vet jag inte om det ligger kvar i registret.

 

Här kommer FRST

 

 

FRST.txt

Addition.txt

[Cecilia]

1. Starta programmet Anteckningar.
Kopiera alla rader i rutan:

CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [conhost.exe -start] => C:\Users\HP\AppData\Roaming\UPUpdata\conhost.exe [2363392 2016-04-17] ()
HKLM-x32\...\Run: [LightGate] => c:\programdata\lightgate.exe [1081344 2015-12-04] ()
HKLM-x32\...\Run: [ QQPCTray] => "C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\QQPCTray.exe"  /regrun
HKLM-x32\...\Run: [HomePageHelper] => c:\programdata\homepage.exe
HKU\S-1-5-21-2667258-1248907882-1807940605-1001\...\Run: [Yeaplayer] => C:\Program Files (x86)\Yeaplayer\Yeaplayermd.exe /autostart
HKU\S-1-5-21-2667258-1248907882-1807940605-1001\...\Run: [msiql] => C:\ProgramData\msiql.exe /RUNNING
HKU\S-1-5-21-2667258-1248907882-1807940605-1001\...\MountPoints2: F - "F:\SETUP.EXE" 
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\QMGCShellExt64.dll No File
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSWebMon64.dat => No File
S2 GoogleChromeUpService; C:\ProgramData\service.exe [1747456 2016-04-17] () [File not signed]
S2 Pwtcchsrv; C:\Program Files (x86)\Pwtyfemuk\Pwtcchsrv.exe [311280 2016-04-14] ()
S2 SstrprSrv; C:\Program Files (x86)\Sosition\SstrprSrv.exe [310360 2016-04-14] ()
S2 QQRepair5cf; "C:\Program Files (x86)\Tencent\QQPCMGR\Plugins\QQRepair5cf" [X]
R1 softaal; C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\softaal64.sys [35064 2016-04-17] (Tencent)
S1 TSDefenseBt; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSDefenseBT64.sys [X]
R2 zdwfp; C:\Windows\system32\Drivers\zdwfp64.sys [46352 2016-03-04] (zdengine)
2016-04-17 09:42 - 2016-04-17 09:42 - 00000000 ____D C:\ProgramData\TXQMPC
2016-04-17 09:35 - 2016-04-17 09:35 - 00014670 _____ C:\Windows\System32\Tasks\Pwtyfemuk Cache
2016-04-17 09:35 - 2016-04-17 09:35 - 00000000 ____D C:\Program Files (x86)\Pwtyfemuk
2016-04-17 09:35 - 2016-04-17 09:35 - 00000000 ____D C:\Program Files (x86)\hohobnd
2016-04-17 09:34 - 2016-04-17 09:34 - 00002163 _____ C:\ProgramData\msiql.exe.lnk
2016-04-17 09:21 - 2016-04-15 16:48 - 01265152 _____ C:\ProgramData\conhost.exe
2016-04-17 09:21 - 2016-04-14 18:08 - 01274368 _____ C:\ProgramData\MiniFriv01.exe
2016-04-17 09:20 - 2016-04-17 09:42 - 00000000 ____D C:\Users\HP\AppData\Roaming\Tencent
2016-04-17 09:20 - 2016-04-17 09:42 - 00000000 ____D C:\ProgramData\Tencent
2016-04-17 09:20 - 2016-04-17 09:20 - 00132344 _____ (Tencent Technology(Shenzhen) Company Limited) C:\Windows\system32\Drivers\TAOKernelEx64.sys
2016-04-17 09:20 - 2016-04-17 09:20 - 00087800 ____N (电脑管家) C:\Windows\system32\Drivers\TFsFltX64.sys
2016-04-17 09:20 - 2016-04-17 09:20 - 00005120 _____ C:\Users\HP\AppData\Roaming\GiftBag.db
2016-04-17 09:20 - 2016-04-17 09:20 - 00000000 ____D C:\Program Files (x86)\Tencent
2016-04-17 09:19 - 2016-04-17 09:19 - 00001314 _____ C:\ProgramData\webad.xml
2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 ____D C:\Users\Public\Thunder Network
2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 ____D C:\Users\HP\AppData\Roaming\LightGate
2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 ____D C:\ProgramData\Thunder Network
2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 _____ C:\Users\HP\AppData\Roaming\svrupg.exe
2016-04-17 09:19 - 2015-12-04 16:14 - 01081344 _____ C:\ProgramData\LightGate.exe
2016-04-17 09:18 - 2016-04-17 09:18 - 01747456 _____ C:\ProgramData\service.exe
2016-04-17 09:18 - 2016-04-17 09:18 - 00002044 _____ C:\Windows\System32\Tasks\one3025
2016-04-17 09:18 - 2016-04-17 09:18 - 00000000 ____D C:\Users\HP\AppData\Local\Yeaplayer
2016-04-17 09:17 - 2016-04-17 09:39 - 00000620 _____ C:\Windows\Tasks\PPTAssistantUpdateTask_HP.job
2016-04-17 09:17 - 2016-04-17 09:39 - 00000350 _____ C:\Windows\Tasks\PPTAssistantNotifyTask_HP.job
2016-04-17 09:17 - 2016-04-17 09:19 - 00000000 ____D C:\Users\HP\AppData\Roaming\UPUpdata
2016-04-17 09:17 - 2016-04-17 09:17 - 00003648 _____ C:\Windows\System32\Tasks\PPTAssistantUpdateTask_HP
2016-04-17 09:17 - 2016-04-17 09:17 - 00003378 _____ C:\Windows\System32\Tasks\PPTAssistantNotifyTask_HP
2016-04-17 09:17 - 2016-04-17 09:17 - 00000000 ____D C:\Users\HP\AppData\Roaming\gplyra
2016-04-17 09:17 - 2016-04-17 09:17 - 00000000 ____D C:\ProgramData\kingsoft
2016-04-17 09:17 - 2016-04-17 09:17 - 00000000 ____D C:\Program Files (x86)\badu
2016-04-17 09:17 - 2016-03-04 16:13 - 00046352 _____ (zdengine) C:\Windows\system32\Drivers\zdwfp64.sys
2016-04-17 09:13 - 2016-04-17 09:13 - 00014600 _____ C:\Windows\System32\Tasks\Sosition Reports
2016-04-17 09:13 - 2016-04-17 09:13 - 00000000 ____D C:\Program Files (x86)\Sosition
2016-04-17 09:20 - 2016-04-17 09:20 - 0005120 _____ () C:\Users\HP\AppData\Roaming\GiftBag.db
2016-04-17 09:19 - 2016-04-17 09:19 - 0000000 _____ () C:\Users\HP\AppData\Roaming\svrupg.exe
2016-04-17 09:21 - 2016-04-15 16:48 - 1265152 _____ () C:\ProgramData\conhost.exe
2016-04-12 19:53 - 2016-04-12 19:53 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2016-04-17 09:19 - 2015-12-04 16:14 - 1081344 _____ () C:\ProgramData\LightGate.exe
2016-04-17 09:21 - 2016-04-14 18:08 - 1274368 _____ () C:\ProgramData\MiniFriv01.exe
2016-04-17 09:34 - 2016-04-17 09:34 - 0002163 _____ () C:\ProgramData\msiql.exe.lnk
2016-04-17 09:18 - 2016-04-17 09:18 - 1747456 _____ () C:\ProgramData\service.exe
2016-04-17 09:19 - 2016-04-17 09:19 - 0001314 _____ () C:\ProgramData\webad.xml
CustomCLSID: HKU\S-1-5-21-2667258-1248907882-1807940605-1001_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 -> C:\Users\HP\AppData\Local\PPTAssist\pptassist64.dll => No File
CustomCLSID: HKU\S-1-5-21-2667258-1248907882-1807940605-1001_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32 -> C:\Users\HP\AppData\Local\PPTAssist\pptassist64.dll => No File
Task: {3EB46EEF-BA5D-4289-B518-897E3D3EA80F} - System32\Tasks\one3025 => C:\Program Files (x86)\QuickSearch\one3025.exe <==== ATTENTION
Task: {611EE060-BD1D-4FD3-B983-24882B91FD00} - System32\Tasks\PPTAssistantUpdateTask_HP => C:\Users\HP\AppData\Local\PPTAssist\assistupdate.exe
Task: {7147C8FD-9CC0-4E3A-A06B-1036BB955496} - System32\Tasks\Pwtyfemuk Cache => C:\Program Files (x86)\Pwtyfemuk\Pwtcchtsk.exe [2016-04-14] ()
Task: {7D8C859A-DD4D-44E8-85BE-B08D624A137C} - System32\Tasks\Sosition Reports => C:\Program Files (x86)\Sosition\SstrprTsk.exe [2016-04-14] ()
Task: {B78DCB88-7DEB-4B4C-90AF-961BD5C611C6} - System32\Tasks\Driver Booster SkipUAC (HP) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: {B9377E02-0FB1-409C-906B-9D471C095DE4} - System32\Tasks\PPTAssistantNotifyTask_HP => C:\Users\HP\AppData\Local\PPTAssist\notify.exe
Task: C:\Windows\Tasks\PPTAssistantNotifyTask_HP.job => C:\Users\HP\AppData\Local\PPTAssist\notify.exe
Task: C:\Windows\Tasks\PPTAssistantUpdateTask_HP.job => C:\Users\HP\AppData\Local\PPTAssist\assistupdate.exe
2016-04-17 09:34 - 2016-04-17 09:34 - 00100864 _____ () C:\Windows\TEMP\SppExtComObjHook.dll
FirewallRules: [{3CCAF9C1-A70F-4F6F-AEF5-33BC6EAB19C3}] => (Allow) C:\Users\HP\AppData\Roaming\UPUpdata\download\MiniThunderPlatform.exe
FirewallRules: [{7ACD7BC3-8735-4F66-B0CC-5596B3FC3F5C}] => (Allow) C:\Users\HP\AppData\Roaming\UPUpdata\download\MiniThunderPlatform.exe
FirewallRules: [{FFEB5E77-95EC-4064-B38E-C49044B657EE}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{370B06E5-787F-4437-BA29-FB92D9C5BF84}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
Reboot:

och klistra in i Anteckningar. Kontrollera att inga filer har delats upp på två rader.
Spara filen på skrivbordet med namnet fixlist.txt.

Stäng av alla program.
Starta FRST som finns på skrivbordet.
Klicka på knappen Fix.
Vänta tills programmet är klart.
Om datorn inte startas om automatiskt så gör det själv.

Programmet skapar en logg Fixlog.txt på skrivbordet.
Klistra in innehållet i den i ditt svar.

 

 

2. Installera ett antivirusprogram, sök igenom datorn noga med det och sätt allt som den hittar i karantän.

 

 

3. Installera gratis Malwarebytes Anti-Malware, sök igenom datorn noga med det och sätt allt som den hittar i karantän.

 

 

4. Skanna datorn online på http://www.eset.com/onlinescan/ och använd helst Internet Explorer till det.
För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

Välj alternativet Enable detection of potentially unwanted applications.

Klicka på Advanced Settings.
Ta bort bocken framför Remove found threats.
Bocka för:
Scan Archives
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Klicka på Start

När skanningen är klar klicka på List of found threats, följt av Export to a text file. Spara till en fil på skrivbordet, öppna filen, kopiera resultatet och klistra sedan in det i ditt svar.

 

 

5. Starta FRST-programmet.

Bocka för Addition.txt.

Skanna med programmet och bifoga de två nya loggfilerna.

[svewik]

Japp. Din fixlist tog bort conhost och lightgate.

 

Windows defender installerad 

 

Gratis Malwarebytes Anti-Malware har du säkert en länk till?

 

En konstig sak inträffade: Jag kopierade din text till min texteditor EditPad. Den varnade för att den inte kunde tolka en del tecken och ersatte dem med frågetecken. ??

 

Fix result of Farbar Recovery Scan Tool (x64) Version:17-04-2016

Ran by HP (2016-04-17 13:44:18) Run:1

Running from C:\Users\HP\Desktop

Loaded Profiles: HP (Available Profiles: HP)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

CreateRestorePoint:

CloseProcesses:

HKLM-x32\...\Run: [conhost.exe -start] => C:\Users\HP\AppData\Roaming\UPUpdata\conhost.exe [2363392 2016-04-17] ()

HKLM-x32\...\Run: [LightGate] => c:\programdata\lightgate.exe [1081344 2015-12-04] ()

HKLM-x32\...\Run: [ QQPCTray] => "C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\QQPCTray.exe"  /regrun

HKLM-x32\...\Run: [HomePageHelper] => c:\programdata\homepage.exe

HKU\S-1-5-21-2667258-1248907882-1807940605-1001\...\Run: [Yeaplayer] => C:\Program Files (x86)\Yeaplayer\Yeaplayermd.exe /autostart

HKU\S-1-5-21-2667258-1248907882-1807940605-1001\...\Run: [msiql] => C:\ProgramData\msiql.exe /RUNNING

HKU\S-1-5-21-2667258-1248907882-1807940605-1001\...\MountPoints2: F - "F:\SETUP.EXE" 

ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\QMGCShellExt64.dll No File

BHO: ????????? -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSWebMon64.dat => No File

S2 GoogleChromeUpService; C:\ProgramData\service.exe [1747456 2016-04-17] () [File not signed]

S2 Pwtcchsrv; C:\Program Files (x86)\Pwtyfemuk\Pwtcchsrv.exe [311280 2016-04-14] ()

S2 SstrprSrv; C:\Program Files (x86)\Sosition\SstrprSrv.exe [310360 2016-04-14] ()

S2 QQRepair5cf; "C:\Program Files (x86)\Tencent\QQPCMGR\Plugins\QQRepair5cf" [X]

R1 softaal; C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\softaal64.sys [35064 2016-04-17] (Tencent)

S1 TSDefenseBt; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSDefenseBT64.sys [X]

R2 zdwfp; C:\Windows\system32\Drivers\zdwfp64.sys [46352 2016-03-04] (zdengine)

2016-04-17 09:42 - 2016-04-17 09:42 - 00000000 ____D C:\ProgramData\TXQMPC

2016-04-17 09:35 - 2016-04-17 09:35 - 00014670 _____ C:\Windows\System32\Tasks\Pwtyfemuk Cache

2016-04-17 09:35 - 2016-04-17 09:35 - 00000000 ____D C:\Program Files (x86)\Pwtyfemuk

2016-04-17 09:35 - 2016-04-17 09:35 - 00000000 ____D C:\Program Files (x86)\hohobnd

2016-04-17 09:34 - 2016-04-17 09:34 - 00002163 _____ C:\ProgramData\msiql.exe.lnk

2016-04-17 09:21 - 2016-04-15 16:48 - 01265152 _____ C:\ProgramData\conhost.exe

2016-04-17 09:21 - 2016-04-14 18:08 - 01274368 _____ C:\ProgramData\MiniFriv01.exe

2016-04-17 09:20 - 2016-04-17 09:42 - 00000000 ____D C:\Users\HP\AppData\Roaming\Tencent

2016-04-17 09:20 - 2016-04-17 09:42 - 00000000 ____D C:\ProgramData\Tencent

2016-04-17 09:20 - 2016-04-17 09:20 - 00132344 _____ (Tencent Technology(Shenzhen) Company Limited) C:\Windows\system32\Drivers\TAOKernelEx64.sys

2016-04-17 09:20 - 2016-04-17 09:20 - 00087800 ____N (????) C:\Windows\system32\Drivers\TFsFltX64.sys

2016-04-17 09:20 - 2016-04-17 09:20 - 00005120 _____ C:\Users\HP\AppData\Roaming\GiftBag.db

2016-04-17 09:20 - 2016-04-17 09:20 - 00000000 ____D C:\Program Files (x86)\Tencent

2016-04-17 09:19 - 2016-04-17 09:19 - 00001314 _____ C:\ProgramData\webad.xml

2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 ____D C:\Users\Public\Thunder Network

2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 ____D C:\Users\HP\AppData\Roaming\LightGate

2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 ____D C:\ProgramData\Thunder Network

2016-04-17 09:19 - 2016-04-17 09:19 - 00000000 _____ C:\Users\HP\AppData\Roaming\svrupg.exe

2016-04-17 09:19 - 2015-12-04 16:14 - 01081344 _____ C:\ProgramData\LightGate.exe

2016-04-17 09:18 - 2016-04-17 09:18 - 01747456 _____ C:\ProgramData\service.exe

2016-04-17 09:18 - 2016-04-17 09:18 - 00002044 _____ C:\Windows\System32\Tasks\one3025

2016-04-17 09:18 - 2016-04-17 09:18 - 00000000 ____D C:\Users\HP\AppData\Local\Yeaplayer

2016-04-17 09:17 - 2016-04-17 09:39 - 00000620 _____ C:\Windows\Tasks\PPTAssistantUpdateTask_HP.job

2016-04-17 09:17 - 2016-04-17 09:39 - 00000350 _____ C:\Windows\Tasks\PPTAssistantNotifyTask_HP.job

2016-04-17 09:17 - 2016-04-17 09:19 - 00000000 ____D C:\Users\HP\AppData\Roaming\UPUpdata

2016-04-17 09:17 - 2016-04-17 09:17 - 00003648 _____ C:\Windows\System32\Tasks\PPTAssistantUpdateTask_HP

2016-04-17 09:17 - 2016-04-17 09:17 - 00003378 _____ C:\Windows\System32\Tasks\PPTAssistantNotifyTask_HP

2016-04-17 09:17 - 2016-04-17 09:17 - 00000000 ____D C:\Users\HP\AppData\Roaming\gplyra

2016-04-17 09:17 - 2016-04-17 09:17 - 00000000 ____D C:\ProgramData\kingsoft

2016-04-17 09:17 - 2016-04-17 09:17 - 00000000 ____D C:\Program Files (x86)\badu

2016-04-17 09:17 - 2016-03-04 16:13 - 00046352 _____ (zdengine) C:\Windows\system32\Drivers\zdwfp64.sys

2016-04-17 09:13 - 2016-04-17 09:13 - 00014600 _____ C:\Windows\System32\Tasks\Sosition Reports

2016-04-17 09:13 - 2016-04-17 09:13 - 00000000 ____D C:\Program Files (x86)\Sosition

2016-04-17 09:20 - 2016-04-17 09:20 - 0005120 _____ () C:\Users\HP\AppData\Roaming\GiftBag.db

2016-04-17 09:19 - 2016-04-17 09:19 - 0000000 _____ () C:\Users\HP\AppData\Roaming\svrupg.exe

2016-04-17 09:21 - 2016-04-15 16:48 - 1265152 _____ () C:\ProgramData\conhost.exe

2016-04-12 19:53 - 2016-04-12 19:53 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

2016-04-17 09:19 - 2015-12-04 16:14 - 1081344 _____ () C:\ProgramData\LightGate.exe

2016-04-17 09:21 - 2016-04-14 18:08 - 1274368 _____ () C:\ProgramData\MiniFriv01.exe

2016-04-17 09:34 - 2016-04-17 09:34 - 0002163 _____ () C:\ProgramData\msiql.exe.lnk

2016-04-17 09:18 - 2016-04-17 09:18 - 1747456 _____ () C:\ProgramData\service.exe

2016-04-17 09:19 - 2016-04-17 09:19 - 0001314 _____ () C:\ProgramData\webad.xml

CustomCLSID: HKU\S-1-5-21-2667258-1248907882-1807940605-1001_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 -> C:\Users\HP\AppData\Local\PPTAssist\pptassist64.dll => No File

CustomCLSID: HKU\S-1-5-21-2667258-1248907882-1807940605-1001_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32 -> C:\Users\HP\AppData\Local\PPTAssist\pptassist64.dll => No File

Task: {3EB46EEF-BA5D-4289-B518-897E3D3EA80F} - System32\Tasks\one3025 => C:\Program Files (x86)\QuickSearch\one3025.exe <==== ATTENTION

Task: {611EE060-BD1D-4FD3-B983-24882B91FD00} - System32\Tasks\PPTAssistantUpdateTask_HP => C:\Users\HP\AppData\Local\PPTAssist\assistupdate.exe

Task: {7147C8FD-9CC0-4E3A-A06B-1036BB955496} - System32\Tasks\Pwtyfemuk Cache => C:\Program Files (x86)\Pwtyfemuk\Pwtcchtsk.exe [2016-04-14] ()

Task: {7D8C859A-DD4D-44E8-85BE-B08D624A137C} - System32\Tasks\Sosition Reports => C:\Program Files (x86)\Sosition\SstrprTsk.exe [2016-04-14] ()

Task: {B78DCB88-7DEB-4B4C-90AF-961BD5C611C6} - System32\Tasks\Driver Booster SkipUAC (HP) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe

Task: {B9377E02-0FB1-409C-906B-9D471C095DE4} - System32\Tasks\PPTAssistantNotifyTask_HP => C:\Users\HP\AppData\Local\PPTAssist\notify.exe

Task: C:\Windows\Tasks\PPTAssistantNotifyTask_HP.job => C:\Users\HP\AppData\Local\PPTAssist\notify.exe

Task: C:\Windows\Tasks\PPTAssistantUpdateTask_HP.job => C:\Users\HP\AppData\Local\PPTAssist\assistupdate.exe

2016-04-17 09:34 - 2016-04-17 09:34 - 00100864 _____ () C:\Windows\TEMP\SppExtComObjHook.dll

FirewallRules: [{3CCAF9C1-A70F-4F6F-AEF5-33BC6EAB19C3}] => (Allow) C:\Users\HP\AppData\Roaming\UPUpdata\download\MiniThunderPlatform.exe

FirewallRules: [{7ACD7BC3-8735-4F66-B0CC-5596B3FC3F5C}] => (Allow) C:\Users\HP\AppData\Roaming\UPUpdata\download\MiniThunderPlatform.exe

FirewallRules: [{FFEB5E77-95EC-4064-B38E-C49044B657EE}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe

FirewallRules: [{370B06E5-787F-4437-BA29-FB92D9C5BF84}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe

CMD: ipconfig /flushdns

CMD: netsh winsock reset catalog

CMD: netsh int ip reset c:\resetlog.txt

Reboot:

*****************

 

Restore point was successfully created.

Processes closed successfully.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\conhost.exe -start => value removed successfully

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\LightGate => value removed successfully

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ QQPCTray => value removed successfully

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\HomePageHelper => value removed successfully

HKU\S-1-5-21-2667258-1248907882-1807940605-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Yeaplayer => value removed successfully

HKU\S-1-5-21-2667258-1248907882-1807940605-1001\Software\Microsoft\Windows\CurrentVersion\Run\\msiql => value removed successfully

"HKU\S-1-5-21-2667258-1248907882-1807940605-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F" => key removed successfully

"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\.QMDeskTopGCIcon" => key removed successfully

"HKCR\CLSID\{B7667919-3765-4815-A66D-98A09BE662D6}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}" => key removed successfully

"HKCR\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}" => key removed successfully

GoogleChromeUpService => service removed successfully

Pwtcchsrv => service removed successfully

SstrprSrv => service removed successfully

QQRepair5cf => service removed successfully

softaal => Unable to stop service.

softaal => service removed successfully

TSDefenseBt => service removed successfully

zdwfp => Unable to stop service.

zdwfp => service removed successfully

C:\ProgramData\TXQMPC => moved successfully

C:\Windows\System32\Tasks\Pwtyfemuk Cache => moved successfully

C:\Program Files (x86)\Pwtyfemuk => moved successfully

C:\Program Files (x86)\hohobnd => moved successfully

C:\ProgramData\msiql.exe.lnk => moved successfully

C:\ProgramData\conhost.exe => moved successfully

C:\ProgramData\MiniFriv01.exe => moved successfully

C:\Users\HP\AppData\Roaming\Tencent => moved successfully

C:\ProgramData\Tencent => moved successfully

C:\Windows\system32\Drivers\TAOKernelEx64.sys => moved successfully

C:\Windows\system32\Drivers\TFsFltX64.sys => moved successfully

C:\Users\HP\AppData\Roaming\GiftBag.db => moved successfully

C:\Program Files (x86)\Tencent => moved successfully

C:\ProgramData\webad.xml => moved successfully

C:\Users\Public\Thunder Network => moved successfully

C:\Users\HP\AppData\Roaming\LightGate => moved successfully

C:\ProgramData\Thunder Network => moved successfully

C:\Users\HP\AppData\Roaming\svrupg.exe => moved successfully

C:\ProgramData\LightGate.exe => moved successfully

C:\ProgramData\service.exe => moved successfully

C:\Windows\System32\Tasks\one3025 => moved successfully

C:\Users\HP\AppData\Local\Yeaplayer => moved successfully

C:\Windows\Tasks\PPTAssistantUpdateTask_HP.job => moved successfully

C:\Windows\Tasks\PPTAssistantNotifyTask_HP.job => moved successfully

C:\Users\HP\AppData\Roaming\UPUpdata => moved successfully

C:\Windows\System32\Tasks\PPTAssistantUpdateTask_HP => moved successfully

C:\Windows\System32\Tasks\PPTAssistantNotifyTask_HP => moved successfully

C:\Users\HP\AppData\Roaming\gplyra => moved successfully

C:\ProgramData\kingsoft => moved successfully

C:\Program Files (x86)\badu => moved successfully

C:\Windows\system32\Drivers\zdwfp64.sys => moved successfully

C:\Windows\System32\Tasks\Sosition Reports => moved successfully

C:\Program Files (x86)\Sosition => moved successfully

"C:\Users\HP\AppData\Roaming\GiftBag.db" => not found.

"C:\Users\HP\AppData\Roaming\svrupg.exe" => not found.

"C:\ProgramData\conhost.exe" => not found.

C:\ProgramData\DP45977C.lfl => moved successfully

"C:\ProgramData\LightGate.exe" => not found.

"C:\ProgramData\MiniFriv01.exe" => not found.

"C:\ProgramData\msiql.exe.lnk" => not found.

"C:\ProgramData\service.exe" => not found.

"C:\ProgramData\webad.xml" => not found.

"HKU\S-1-5-21-2667258-1248907882-1807940605-1001_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}" => key removed successfully

"HKU\S-1-5-21-2667258-1248907882-1807940605-1001_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3EB46EEF-BA5D-4289-B518-897E3D3EA80F}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3EB46EEF-BA5D-4289-B518-897E3D3EA80F}" => key removed successfully

C:\Windows\System32\Tasks\one3025 => not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\one3025" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{611EE060-BD1D-4FD3-B983-24882B91FD00}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{611EE060-BD1D-4FD3-B983-24882B91FD00}" => key removed successfully

C:\Windows\System32\Tasks\PPTAssistantUpdateTask_HP => not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PPTAssistantUpdateTask_HP" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7147C8FD-9CC0-4E3A-A06B-1036BB955496}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7147C8FD-9CC0-4E3A-A06B-1036BB955496}" => key removed successfully

C:\Windows\System32\Tasks\Pwtyfemuk Cache => not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Pwtyfemuk Cache" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7D8C859A-DD4D-44E8-85BE-B08D624A137C}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7D8C859A-DD4D-44E8-85BE-B08D624A137C}" => key removed successfully

C:\Windows\System32\Tasks\Sosition Reports => not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Sosition Reports" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B78DCB88-7DEB-4B4C-90AF-961BD5C611C6}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B78DCB88-7DEB-4B4C-90AF-961BD5C611C6}" => key removed successfully

C:\Windows\System32\Tasks\Driver Booster SkipUAC (HP) => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Driver Booster SkipUAC (HP)" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B9377E02-0FB1-409C-906B-9D471C095DE4}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9377E02-0FB1-409C-906B-9D471C095DE4}" => key removed successfully

C:\Windows\System32\Tasks\PPTAssistantNotifyTask_HP => not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PPTAssistantNotifyTask_HP" => key removed successfully

C:\Windows\Tasks\PPTAssistantNotifyTask_HP.job => not found.

C:\Windows\Tasks\PPTAssistantUpdateTask_HP.job => not found.

"C:\Windows\TEMP\SppExtComObjHook.dll" => not found.

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3CCAF9C1-A70F-4F6F-AEF5-33BC6EAB19C3} => value removed successfully

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7ACD7BC3-8735-4F66-B0CC-5596B3FC3F5C} => value removed successfully

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{FFEB5E77-95EC-4064-B38E-C49044B657EE} => value removed successfully

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{370B06E5-787F-4437-BA29-FB92D9C5BF84} => value removed successfully

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

 

=========  netsh winsock reset catalog =========

 

 

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

 

 

========= End of CMD: =========

 

 

=========  netsh int ip reset c:\resetlog.txt =========

 

Resetting Global, OK!

Resetting Interface, OK!

Resetting Unicast Address, OK!

Resetting Neighbor, OK!

Resetting Path, OK!

Resetting , failed.

tkomst nekad.

 

Resetting , OK!

Restart the computer to complete this action.

 

 

========= End of CMD: =========

 

 

 

The system needed a reboot.

 

==== End of Fixlog 13:44:38 ====

[svewik]

Verkar fungera bra

Här kommer loggarna

esetscan.txt

FRST.txt

Addition.txt

[Cecilia]

1. Installera ett bättre antivirusprogram än Defender, t ex Avira, AVG, Avast eller Ad-Aware.

 

2. Malwarebytes Anti-Malware (MBAM): https://www.malwarebytes.org/

 

 

3. Mycket skräp i temp-mappar enligt Esets skanner och följande skript tömmer papperskorgar och temp-mappar.

Starta programmet Anteckningar.
Kopiera alla rader i rutan:

CreateRestorePoint:
CloseProcesses:
EmptyTemp:

och klistra in i Anteckningar. Kontrollera att inga filer har delats upp på två rader.
Spara filen på skrivbordet med namnet fixlist.txt.

Stäng av alla program.
Starta FRST som finns på skrivbordet.
Klicka på knappen Fix.
Vänta tills programmet är klart.
Om datorn inte startas om automatiskt så gör det själv.

Programmet skapar en logg Fixlog.txt på skrivbordet.
Klistra in innehållet i den i ditt svar.

 

 

4. Sen varnar Esets skanner för crackade program/filer:

C:\Users\HP\Downloads\Microsoft Office ProPlus 2013 SP1 VL x86 en-US Jul2014\MTKV252.zip    a variant of MSIL/HackKMS.G potentially unsafe application
C:\Windows\SECOH-QAD.dll    Win64/HackKMS.D potentially unsafe application
C:\Windows\SECOH-QAD.exe    Win64/HackKMS.C potentially unsafe application
C:\Windows\AutoKMS\AutoKMS.exe    a variant of MSIL/HackKMS.G potentially unsafe application
Det innebär alltid en viss risk att använda cracks.

 

5. Dessa installationsfiler kommer att försöka installera adware:

C:\Users\HP\Downloads\daemon-tools-lite-4_49 (1).exe    a variant of Win32/InstallCore.AGM.gen potentially unwanted application
C:\Users\HP\Downloads\daemon-tools-lite-4_49 [1].exe    Win32/DownWare.L potentially unwanted application
C:\Users\HP\Downloads\daemon-tools-lite-4_49.exe    a variant of Win32/InstallCore.AGM.gen potentially unwanted application
 

[svewik]

Installationsfilerna glömde jag ta bort efter att jag tagit bort installationen.

Jag har tagit bord dem manuellt nu, det är väl ok?

 

Här är fixloggen

 

ix result of Farbar Recovery Scan Tool (x64) Version:17-04-2016

Ran by HP (2016-04-18 09:13:12) Run:2

Running from C:\Users\HP\Desktop

Loaded Profiles: HP (Available Profiles: HP)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

CreateRestorePoint:

CloseProcesses:

EmptyTemp:

*****************

 

Restore point was successfully created.

Processes closed successfully.

EmptyTemp: => 546 MB temporary data Removed.

 

 

The system needed a reboot.

 

==== End of Fixlog 09:13:18 ==

[Cecilia]

Har antivirusprogram och MBAM hittat något?

 

Hur fungerar datorn numera?

[svewik]

Win defender hittade inget

MBAM däremot hittade en del och jag fick välja det jag tyckte såg misstänkt ut:

 

En konstig sak dock. Det går inte att klistra in till e-forums editor om man använder Edge. Jag laddade in Opera och den funkade!

 

Annars verkar allt OK

mbamscan.txt

[Cecilia]

Det vore bra att få datorn kontrollerad med ytterligare ett bra antivirusprogram och inte bara Esets skanner (Defender räknar jag inte eftersom det är för dåligt).

 

Av det som MBAM hittade och som du har valt att inte åtgärda är alltihop reklamprogram och borde tas bort tycker jag. En del togs antagligen bort av din senaste fix med FRST, men definitivt inte allt.

 

Forumprogrammet är äldre än Edge och Internet Explorer version 11 och därför inte anpassat till dem. Du behöver klicka på knappen "Källa", som är knappen längst till vänster i övre raden, innan och efter du klistrar in.

[svewik]

OK. Ja jag sådana grejer rörande torrentsearch kanske berörde uTorrent som jag vill behålla. Men OK, man kan ju installera det igen om det blir fel. Så jag lät MBAM ta bort allt.

 

Installerat AdAware Free och den hittade inget.

 

Så nu verkar det klart ??

 

Hur rensar jag?

[Cecilia]

PUP.Optional.TorrentSearch

är att uTorrent ställer om sökmotor etc. i webbläsare, det har inte att göra med själva torrent-programmet.

 

För att avinstallera FRST och AdwCleaner:

Spara Delfix på Skrivbordet: http://www.bleepingcomputer.com/download/delfix/
Inaktivera Ad-Aware.

Starta DelFix.

Se till att det finns bockar framför dessa, men inga andra:
* Remove disinfection tools
* Create registry backup

Klicka på Run-knappen.

Om något verkar gå fel klistra in innehållet i DelFix.txt som kommer upp. Annars behöver jag inte se den.

 

Aktivera Ad-Aware eller starta om datorn.

[Pelle Penna]

Win defender hittade inget

MBAM däremot hittade en del och jag fick välja det jag tyckte såg misstänkt ut:

 

En konstig sak dock. Det går inte att klistra in till e-forums editor om man använder Edge. Jag laddade in Opera och den funkade!

 

Annars verkar allt OK

Ang Edge och inklistring så har jag samma problem med att kopiera och klistra in, så det är nog ett grundläggande fel och inte i din dator