Jump to content

All Activity

This stream auto-updates     

  1. Past hour
  2. Go through this article which is pinned at the top of the forum and perform those checks, paying particular attention to those involving Chrome. https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/
  3. Wow, that was quick! Thanks for sorting it out. Andy
  4. Today
  5. Hi, This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation: https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/ Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore. This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore.
  6. What is Qbit Speedup Pro?The Malwarebytes research team has determined that Qbit Speedup Pro is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.More information can be found on our Malwarebytes Labs blog.How do I know if I am infected with Qbit Speedup Pro?This is how the main screen of the system optimizer looks:You will find these icons in your taskbar, your startmenu, and on your desktop:and see these warnings during install:and this screen during "operations":You may see this entry in your list of installed programs:and this task in your list of Scheduled Tasks:How did Qbit Speedup Pro get on my computer?These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website.How do I remove Qbit Speedup Pro?Our program Malwarebytes can detect and remove this potentially unwanted application. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of Qbit Speedup Pro? No, Malwarebytes removes Qbit Speedup Pro completely. This PUP creates a scheduled task. You can read here how to check for and, if necessary, remove Scheduled Tasks. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this system optimizer.As you can see below the full version of Malwarebytes would have protected you against the Qbit Speedup Pro installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late. and we block access to their domain.Technical details for expertsYou may see these entries in FRST logs: (CLOVER PC UTILITIES -> ) C:\Program Files\Qbit-Speedup -Pro for {computername}\rtc.exe Task: {B6E363AD-1251-4C3C-A1B7-C1397391276B} - System32\Tasks\Qbit-Speedup -Pro_Logon => C:\Program Files\Qbit-Speedup -Pro for {computername}\rtc.exe [2575560 2019-04-16] (CLOVER PC UTILITIES -> ) C:\Users\{username}\AppData\Roaming\Qbit-Speedup -Pro For {computername} C:\ProgramData\Qbit-Speedup -Pro for {computername} C:\Windows\System32\Tasks\Qbit-Speedup -Pro_Logon C:\Users\Public\Desktop\Qbit-Speedup -Pro.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit-Speedup -Pro for {computername} C:\Program Files\Qbit-Speedup -Pro for {computername} Qbit-Speedup -Pro (HKLM\...\{BAE30E83-FEED-4714-BA45-7F0EAF5266AB}_is1) (Version: 1.0.0.17 - ) Alterations made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files\Qbit-Speedup -Pro for {computername} Adds the file application.ico"="2/21/2019 2:11 PM, 56150 bytes, A Adds the file danish_iss.ini"="5/16/2018 11:25 AM, 2402 bytes, A Adds the file Dutch_iss.ini"="5/16/2018 11:25 AM, 2600 bytes, A Adds the file english_iss.ini"="5/16/2018 11:25 AM, 2256 bytes, A Adds the file finish_iss.ini"="5/16/2018 11:25 AM, 2368 bytes, A Adds the file French_iss.ini"="5/16/2018 11:25 AM, 2792 bytes, A Adds the file german_iss.ini"="5/16/2018 11:25 AM, 2658 bytes, A Adds the file gmtrs.dll"="4/16/2019 3:43 PM, 1962184 bytes, A Adds the file HtmlRenderer.dll"="4/16/2019 3:43 PM, 235208 bytes, A Adds the file HtmlRenderer.WinForms.dll"="4/16/2019 3:43 PM, 73928 bytes, A Adds the file Interop.IWshRuntimeLibrary.dll"="4/16/2019 3:43 PM, 62664 bytes, A Adds the file Interop.SHDocVw.dll"="4/16/2019 3:43 PM, 177352 bytes, A Adds the file italian_iss.ini"="5/16/2018 11:25 AM, 2532 bytes, A Adds the file japanese_iss.ini"="5/16/2018 11:25 AM, 1844 bytes, A Adds the file langs.db"="11/10/2018 3:17 PM, 477184 bytes, A Adds the file Microsoft.Win32.TaskScheduler.dll"="4/16/2019 3:43 PM, 184520 bytes, A Adds the file NAudio.dll"="4/16/2019 3:43 PM, 484552 bytes, A Adds the file Newtonsoft.Json.dll"="4/16/2019 3:43 PM, 474312 bytes, A Adds the file norwegian_iss.ini"="5/16/2018 11:25 AM, 2358 bytes, A Adds the file PaddleCheckoutSDK.dll"="4/16/2019 3:43 PM, 72392 bytes, A Adds the file portuguese_iss.ini"="5/16/2018 11:25 AM, 2424 bytes, A Adds the file rtc.exe"="4/16/2019 3:43 PM, 2575560 bytes, A Adds the file rtc.exe.config"="4/16/2019 3:43 PM, 6263 bytes, A Adds the file russian_iss.ini"="5/16/2018 11:25 AM, 2494 bytes, A Adds the file spanish_iss.ini"="5/16/2018 11:25 AM, 2548 bytes, A Adds the file swedish_iss.ini"="5/16/2018 11:25 AM, 2270 bytes, A Adds the file System.Data.SQLite.DLL"="4/16/2019 3:44 PM, 304328 bytes, A Adds the file TAFactory.IconPack.dll"="4/16/2019 3:44 PM, 50376 bytes, A Adds the file unins000.dat"="4/26/2019 9:14 AM, 85469 bytes, A Adds the file unins000.exe"="4/26/2019 9:14 AM, 1242312 bytes, A Adds the file unins000.msg"="4/26/2019 9:14 AM, 22701 bytes, A Adds the folder C:\Program Files\Qbit-Speedup -Pro for {computername}\x64 Adds the file SQLite.Interop.dll"="4/16/2019 3:43 PM, 1189064 bytes, A Adds the folder C:\Program Files\Qbit-Speedup -Pro for {computername}\x86 Adds the file SQLite.Interop.dll"="4/16/2019 3:43 PM, 868040 bytes, A Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit-Speedup -Pro for {computername} Adds the file Buy Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 993 bytes, A Adds the file Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 981 bytes, A Adds the file Uninstall Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 1012 bytes, A Adds the folder C:\ProgramData\Qbit-Speedup -Pro for {computername} Adds the file mdb.db"="10/26/2018 10:37 AM, 6643712 bytes, A Adds the file pcspstartrepair_en.mp3"="5/16/2018 11:25 AM, 130973 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Qbit-Speedup -Pro For {computername} Adds the file Errorlog.txt"="4/26/2019 9:16 AM, 17882 bytes, A Adds the file exlist.bin"="4/26/2019 9:14 AM, 258019 bytes, A Adds the file notifier.xml"="4/26/2019 9:15 AM, 12994 bytes, A Adds the file update.xml"="4/26/2019 9:14 AM, 36026 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Qbit-Speedup -Pro For {computername}\smico In the existing folder C:\Users\Public\Desktop Adds the file Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 963 bytes, A In the existing folder C:\Windows\System32\Tasks Adds the file Qbit-Speedup -Pro_Logon"="4/26/2019 9:14 AM, 3076 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BAE30E83-FEED-4714-BA45-7F0EAF5266AB}_is1] "DisplayIcon"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}\rtc.exe" "DisplayName"="REG_SZ", "Qbit-Speedup -Pro" "DisplayVersion"="REG_SZ", "1.0.0.17" "EstimatedSize"="REG_DWORD", 18813 "Inno Setup: App Path"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" "Inno Setup: Icon Group"="REG_SZ", "Qbit-Speedup -Pro for {computername}" "Inno Setup: Language"="REG_SZ", "en" "Inno Setup: Setup Version"="REG_SZ", "5.5.8 (u)" "Inno Setup: User"="REG_SZ", "{username}" "InstallDate"="REG_SZ", "20190426" "InstallLocation"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}\" "MajorVersion"="REG_DWORD", 1 "MinorVersion"="REG_DWORD", 0 "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "QuietUninstallString"="REG_SZ", ""C:\Program Files\Qbit-Speedup -Pro for {computername}\unins000.exe" /SILENT" "UninstallString"="REG_SZ", ""C:\Program Files\Qbit-Speedup -Pro for {computername}\unins000.exe"" [HKEY_LOCAL_MACHINE\SOFTWARE\Qbit-Speedup -Pro For {computername}] "affired"="REG_DWORD", 1 "afterInstallUrl"="REG_SZ", "http://ins.trkinstl.com/install/qbsp/?" "apst"="REG_DWORD", 0 "buybowinapp"="REG_SZ", "http://store.qbitpcboost.live/qbsp/plan?" "cbkpoff"="REG_DWORD", 1 "country"="REG_SZ", "us" "cta"="REG_DWORD", 0 "delaytime"="REG_DWORD", 0 "EmailURL"="REG_SZ", "" "expired"="REG_DWORD", 0 "hdata"="REG_BINARY, ......................................................................................................................................................................................................................................................................................................................................... "Installstring"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" "ipaddrurl"="REG_SZ", "http://www.trkinstl.com/getip/" "isavst"="REG_DWORD", 0 "isiunidu"="REG_DWORD", 0 "isprmjsn"="REG_DWORD", 0 "isshowng"="REG_DWORD", 1 "issilent"="REG_DWORD", 0 "ISTELNO"="REG_DWORD", 1 "LangCode"="REG_SZ", "en" "ovoffdis"="REG_DWORD", 0 "paramurl"="REG_SZ", "http://trkr.trkinstl.com/ipfiles/" "pdtm"="REG_DWORD", 30 "playsound"="REG_DWORD", 1 "plurl"="REG_SZ", "http://pp.trkinstl.com/ProductPrice.svc/" "prereg"="REG_DWORD", 0 "PurchaseURL"="REG_SZ", "http://store.qbitpcboost.live/qbsp/price?" "reg"="REG_DWORD", 0 "RenewURL"="REG_SZ", "http://store.qbitpcboost.live/qbsp/renewal?" "runcam"="REG_DWORD", 1 "runpixel"="REG_DWORD", 1 "runsrc"="REG_DWORD", 1 "showtn"="REG_DWORD", 0 "showunins"="REG_DWORD", 0 "showwfo"="REG_DWORD", 0 "stdismax"="REG_DWORD", -1 "supporturl"="REG_SZ", "http://www.qbitpcboost.live/help/" "TELNO"="REG_SZ", "844-394-7312" "TELNO_ar"="REG_SZ", "+54 11 5236 0324" "TELNO_at"="REG_SZ", "+43 (0)720 902 309" "TELNO_au"="REG_SZ", "(61)280-733403" "TELNO_be"="REG_SZ", "+32-28085306" "TELNO_br"="REG_SZ", "+55 21 2391 4319" "TELNO_ch"="REG_SZ", "+41 (0)44 508 70 37" "TELNO_de"="REG_SZ", "0800 1822 974" "TELNO_dk"="REG_SZ", "+45 78 73 09 26" "TELNO_es"="REG_SZ", "+34 951 203 537" "TELNO_fi"="REG_SZ", "+358 (0)9 4270 4911" "TELNO_fr"="REG_SZ", "05 82 84 04 06" "TELNO_gb"="REG_SZ", "0800-031-5066" "TELNO_it"="REG_SZ", "+39 069 4802886" "TELNO_ja"="REG_SZ", "" "TELNO_lu"="REG_SZ", "0800 1822 974" "TELNO_nl"="REG_SZ", "+31-08-58882839" "TELNO_no"="REG_SZ", "+47 21 95 01 97" "TELNO_pt"="REG_SZ", "+351 70 750 2094" "TELNO_se"="REG_SZ", "+46-08124-10298" "TELNO_uk"="REG_SZ", "0800-031-5066" "TELNO_us"="REG_SZ", "844-394-7312" "WebURL"="REG_SZ", "http://www.qbitpcboost.live/" "wfoset"="REG_DWORD", 1 "x-ccode"="REG_SZ", "us" "x-datetime"="REG_SZ", "" "x-fetch"="REG_SZ", "0" "x-ip"="REG_SZ", "89_187_178_188" [HKEY_LOCAL_MACHINE\SOFTWARE\scd-pr] "affiliateid"="REG_SZ", "" "btnid"="REG_SZ", "" "country"="REG_SZ", "us" "LangCode"="REG_SZ", "en" "lpid"="REG_SZ", "" "pxl"="REG_SZ", "" "referUrl"="REG_SZ", "" "TELNO"="REG_SZ", "" "utm_campaign"="REG_SZ", "" "utm_medium"="REG_SZ", "" "utm_pubid"="REG_SZ", "" "utm_source"="REG_SZ", "" "x-at"="REG_SZ", "" "x-context"="REG_SZ", "" "x-plt"="REG_SZ", "" "x-var1"="REG_SZ", "" "x-var2"="REG_SZ", "" "x-var3"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\UWJpdC1TcGVlZHVwIC1Qcm8=\ACT] "data"="REG_BINARY, ........................................................................ [HKEY_CURRENT_USER\Software\Qbit-Speedup -Pro For {computername}] "affiliateid"="REG_SZ", "" "InstallString"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" "LangCode"="REG_SZ", "en" "TELNO"="REG_SZ", "844-394-7312" "TELNO_us"="REG_SZ", "844-394-7312" "utm_medium"="REG_SZ", "" "x-datetime"="REG_SZ", "" "x-fetch"="REG_SZ", "0" "x-ip"="REG_SZ", "89_187_178_188" [HKEY_CURRENT_USER\Software\Qbit-Speedup -Pro For {computername}\1.0.0.17] "Installstring"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" Malwarebytes log: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files\Qbit-Speedup -Pro for {computername} Adds the file application.ico"="2/21/2019 2:11 PM, 56150 bytes, A Adds the file danish_iss.ini"="5/16/2018 11:25 AM, 2402 bytes, A Adds the file Dutch_iss.ini"="5/16/2018 11:25 AM, 2600 bytes, A Adds the file english_iss.ini"="5/16/2018 11:25 AM, 2256 bytes, A Adds the file finish_iss.ini"="5/16/2018 11:25 AM, 2368 bytes, A Adds the file French_iss.ini"="5/16/2018 11:25 AM, 2792 bytes, A Adds the file german_iss.ini"="5/16/2018 11:25 AM, 2658 bytes, A Adds the file gmtrs.dll"="4/16/2019 3:43 PM, 1962184 bytes, A Adds the file HtmlRenderer.dll"="4/16/2019 3:43 PM, 235208 bytes, A Adds the file HtmlRenderer.WinForms.dll"="4/16/2019 3:43 PM, 73928 bytes, A Adds the file Interop.IWshRuntimeLibrary.dll"="4/16/2019 3:43 PM, 62664 bytes, A Adds the file Interop.SHDocVw.dll"="4/16/2019 3:43 PM, 177352 bytes, A Adds the file italian_iss.ini"="5/16/2018 11:25 AM, 2532 bytes, A Adds the file japanese_iss.ini"="5/16/2018 11:25 AM, 1844 bytes, A Adds the file langs.db"="11/10/2018 3:17 PM, 477184 bytes, A Adds the file Microsoft.Win32.TaskScheduler.dll"="4/16/2019 3:43 PM, 184520 bytes, A Adds the file NAudio.dll"="4/16/2019 3:43 PM, 484552 bytes, A Adds the file Newtonsoft.Json.dll"="4/16/2019 3:43 PM, 474312 bytes, A Adds the file norwegian_iss.ini"="5/16/2018 11:25 AM, 2358 bytes, A Adds the file PaddleCheckoutSDK.dll"="4/16/2019 3:43 PM, 72392 bytes, A Adds the file portuguese_iss.ini"="5/16/2018 11:25 AM, 2424 bytes, A Adds the file rtc.exe"="4/16/2019 3:43 PM, 2575560 bytes, A Adds the file rtc.exe.config"="4/16/2019 3:43 PM, 6263 bytes, A Adds the file russian_iss.ini"="5/16/2018 11:25 AM, 2494 bytes, A Adds the file spanish_iss.ini"="5/16/2018 11:25 AM, 2548 bytes, A Adds the file swedish_iss.ini"="5/16/2018 11:25 AM, 2270 bytes, A Adds the file System.Data.SQLite.DLL"="4/16/2019 3:44 PM, 304328 bytes, A Adds the file TAFactory.IconPack.dll"="4/16/2019 3:44 PM, 50376 bytes, A Adds the file unins000.dat"="4/26/2019 9:14 AM, 85469 bytes, A Adds the file unins000.exe"="4/26/2019 9:14 AM, 1242312 bytes, A Adds the file unins000.msg"="4/26/2019 9:14 AM, 22701 bytes, A Adds the folder C:\Program Files\Qbit-Speedup -Pro for {computername}\x64 Adds the file SQLite.Interop.dll"="4/16/2019 3:43 PM, 1189064 bytes, A Adds the folder C:\Program Files\Qbit-Speedup -Pro for {computername}\x86 Adds the file SQLite.Interop.dll"="4/16/2019 3:43 PM, 868040 bytes, A Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit-Speedup -Pro for {computername} Adds the file Buy Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 993 bytes, A Adds the file Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 981 bytes, A Adds the file Uninstall Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 1012 bytes, A Adds the folder C:\ProgramData\Qbit-Speedup -Pro for {computername} Adds the file mdb.db"="10/26/2018 10:37 AM, 6643712 bytes, A Adds the file pcspstartrepair_en.mp3"="5/16/2018 11:25 AM, 130973 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Qbit-Speedup -Pro For {computername} Adds the file Errorlog.txt"="4/26/2019 9:16 AM, 17882 bytes, A Adds the file exlist.bin"="4/26/2019 9:14 AM, 258019 bytes, A Adds the file notifier.xml"="4/26/2019 9:15 AM, 12994 bytes, A Adds the file update.xml"="4/26/2019 9:14 AM, 36026 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Qbit-Speedup -Pro For {computername}\smico In the existing folder C:\Users\Public\Desktop Adds the file Qbit-Speedup -Pro.lnk"="4/26/2019 9:14 AM, 963 bytes, A In the existing folder C:\Windows\System32\Tasks Adds the file Qbit-Speedup -Pro_Logon"="4/26/2019 9:14 AM, 3076 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BAE30E83-FEED-4714-BA45-7F0EAF5266AB}_is1] "DisplayIcon"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}\rtc.exe" "DisplayName"="REG_SZ", "Qbit-Speedup -Pro" "DisplayVersion"="REG_SZ", "1.0.0.17" "EstimatedSize"="REG_DWORD", 18813 "Inno Setup: App Path"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" "Inno Setup: Icon Group"="REG_SZ", "Qbit-Speedup -Pro for {computername}" "Inno Setup: Language"="REG_SZ", "en" "Inno Setup: Setup Version"="REG_SZ", "5.5.8 (u)" "Inno Setup: User"="REG_SZ", "{username}" "InstallDate"="REG_SZ", "20190426" "InstallLocation"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}\" "MajorVersion"="REG_DWORD", 1 "MinorVersion"="REG_DWORD", 0 "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "QuietUninstallString"="REG_SZ", ""C:\Program Files\Qbit-Speedup -Pro for {computername}\unins000.exe" /SILENT" "UninstallString"="REG_SZ", ""C:\Program Files\Qbit-Speedup -Pro for {computername}\unins000.exe"" [HKEY_LOCAL_MACHINE\SOFTWARE\Qbit-Speedup -Pro For {computername}] "affired"="REG_DWORD", 1 "afterInstallUrl"="REG_SZ", "http://ins.trkinstl.com/install/qbsp/?" "apst"="REG_DWORD", 0 "buybowinapp"="REG_SZ", "http://store.qbitpcboost.live/qbsp/plan?" "cbkpoff"="REG_DWORD", 1 "country"="REG_SZ", "us" "cta"="REG_DWORD", 0 "delaytime"="REG_DWORD", 0 "EmailURL"="REG_SZ", "" "expired"="REG_DWORD", 0 "hdata"="REG_BINARY, ......................................................................................................................................................................................................................................................................................................................................... "Installstring"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" "ipaddrurl"="REG_SZ", "http://www.trkinstl.com/getip/" "isavst"="REG_DWORD", 0 "isiunidu"="REG_DWORD", 0 "isprmjsn"="REG_DWORD", 0 "isshowng"="REG_DWORD", 1 "issilent"="REG_DWORD", 0 "ISTELNO"="REG_DWORD", 1 "LangCode"="REG_SZ", "en" "ovoffdis"="REG_DWORD", 0 "paramurl"="REG_SZ", "http://trkr.trkinstl.com/ipfiles/" "pdtm"="REG_DWORD", 30 "playsound"="REG_DWORD", 1 "plurl"="REG_SZ", "http://pp.trkinstl.com/ProductPrice.svc/" "prereg"="REG_DWORD", 0 "PurchaseURL"="REG_SZ", "http://store.qbitpcboost.live/qbsp/price?" "reg"="REG_DWORD", 0 "RenewURL"="REG_SZ", "http://store.qbitpcboost.live/qbsp/renewal?" "runcam"="REG_DWORD", 1 "runpixel"="REG_DWORD", 1 "runsrc"="REG_DWORD", 1 "showtn"="REG_DWORD", 0 "showunins"="REG_DWORD", 0 "showwfo"="REG_DWORD", 0 "stdismax"="REG_DWORD", -1 "supporturl"="REG_SZ", "http://www.qbitpcboost.live/help/" "TELNO"="REG_SZ", "844-394-7312" "TELNO_ar"="REG_SZ", "+54 11 5236 0324" "TELNO_at"="REG_SZ", "+43 (0)720 902 309" "TELNO_au"="REG_SZ", "(61)280-733403" "TELNO_be"="REG_SZ", "+32-28085306" "TELNO_br"="REG_SZ", "+55 21 2391 4319" "TELNO_ch"="REG_SZ", "+41 (0)44 508 70 37" "TELNO_de"="REG_SZ", "0800 1822 974" "TELNO_dk"="REG_SZ", "+45 78 73 09 26" "TELNO_es"="REG_SZ", "+34 951 203 537" "TELNO_fi"="REG_SZ", "+358 (0)9 4270 4911" "TELNO_fr"="REG_SZ", "05 82 84 04 06" "TELNO_gb"="REG_SZ", "0800-031-5066" "TELNO_it"="REG_SZ", "+39 069 4802886" "TELNO_ja"="REG_SZ", "" "TELNO_lu"="REG_SZ", "0800 1822 974" "TELNO_nl"="REG_SZ", "+31-08-58882839" "TELNO_no"="REG_SZ", "+47 21 95 01 97" "TELNO_pt"="REG_SZ", "+351 70 750 2094" "TELNO_se"="REG_SZ", "+46-08124-10298" "TELNO_uk"="REG_SZ", "0800-031-5066" "TELNO_us"="REG_SZ", "844-394-7312" "WebURL"="REG_SZ", "http://www.qbitpcboost.live/" "wfoset"="REG_DWORD", 1 "x-ccode"="REG_SZ", "us" "x-datetime"="REG_SZ", "" "x-fetch"="REG_SZ", "0" "x-ip"="REG_SZ", "89_187_178_188" [HKEY_LOCAL_MACHINE\SOFTWARE\scd-pr] "affiliateid"="REG_SZ", "" "btnid"="REG_SZ", "" "country"="REG_SZ", "us" "LangCode"="REG_SZ", "en" "lpid"="REG_SZ", "" "pxl"="REG_SZ", "" "referUrl"="REG_SZ", "" "TELNO"="REG_SZ", "" "utm_campaign"="REG_SZ", "" "utm_medium"="REG_SZ", "" "utm_pubid"="REG_SZ", "" "utm_source"="REG_SZ", "" "x-at"="REG_SZ", "" "x-context"="REG_SZ", "" "x-plt"="REG_SZ", "" "x-var1"="REG_SZ", "" "x-var2"="REG_SZ", "" "x-var3"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\UWJpdC1TcGVlZHVwIC1Qcm8=\ACT] "data"="REG_BINARY, ........................................................................ [HKEY_CURRENT_USER\Software\Qbit-Speedup -Pro For {computername}] "affiliateid"="REG_SZ", "" "InstallString"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" "LangCode"="REG_SZ", "en" "TELNO"="REG_SZ", "844-394-7312" "TELNO_us"="REG_SZ", "844-394-7312" "utm_medium"="REG_SZ", "" "x-datetime"="REG_SZ", "" "x-fetch"="REG_SZ", "0" "x-ip"="REG_SZ", "89_187_178_188" [HKEY_CURRENT_USER\Software\Qbit-Speedup -Pro For {computername}\1.0.0.17] "Installstring"="REG_SZ", "C:\Program Files\Qbit-Speedup -Pro for {computername}" As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
  7. Duplicate posts by mistake you may delete previews 2 posts mbam.zip
  8. Please check if these are indeed a false positive if need to be submitted separately , please notify. mbam pass: 20190426
  9. Please check if these are indeed a false positive if need to be submitted separately , please notify. https://drive.google.com/file/d/1BnnFIQUL6CBAnZTMOgFNH3pn76PfxiVa/view?usp=sharing pass: 20190426
  10. 8ball

    JamaL

    Please check if these are indeed a false positive if need to be submitted separately , please notify. https://drive.google.com/file/d/1BnnFIQUL6CBAnZTMOgFNH3pn76PfxiVa/view?usp=sharing pass: 20190426
  11. Hi, my c# program is being picked up as a malware. It isn't I promise. Can you check it out please. malwarebyteslog.txt PROPOSALHELPER.zip
  12. Thank you, this response came indeed; do you have any idea when the intended update will be ther/here? regards
  13. exile360: Thanks, I appreciate the recommendation. I am actually aware of them and have paid for some downloads from them in the past. In particular, I sometimes do use DosBox instead of my actual dos machines to play games since that emulator does sometimes works better than actual dos, but it sometimes takes a lot of work to find the optimal settings, so I was curious how they configured some of those games and therefore paid them for some downloads when they were on sale. I've found that a good emulator of very old machines/OS's like DosBox can sometimes be an exception to the rule of the original OS/hardware being better; I was mainly referring to various older versions of Windows. Anyway, there seem to be some distinct pluses and minuses of their service, but I'd be getting too far off-topic if I enumerated each of those (I would just say you already pointed out most of the pluses and that my biggest complaint is not actually their fault, but rather that, as far as I can tell, some of the current license holders that I assume they must pay royalties to seem more than a little nefarious, making me very hesitant to give those companies any of the money that they would theoretically receive downstream). It is probably enough to say that while I vastly prefer physical products, there are definitely times when I would advocate their service, particularly when they have a sale, and they are probably the best game download service that I am currently aware of (for example, I had a bad experience with Steam when a single-player (non-internet) game I bought on DVD insisted that I run their poorly-behaved internet-based DRM program in the background, therefore I do not purchase downloads from Steam).
  14. Okay, before we go any further. Let's go ahead and clean up and reset your browsers. Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues. If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in. Internet Explorer How to reset Internet Explorer settings Microsoft Edge How to Reset Microsoft Edge in Windows 10 Firefox Click on Help / Troubleshooting Information then click on the Refresh Firefox button. Chrome Reset Chrome back to defaults to completely clear out issues with Chrome. Open Chrome and at the top right, click More tools Extensions Write down the list of Extensions installed. Next, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser. Scroll down until you see the "reset sync" button to clear your data from the server and remove your passphrase. Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information. Press the Windows key + R at the same time, to bring up the run dialog box. Type in (or copy/paste) the following and press Enter: %localappdata%\Google\Chrome\User Data\Default\ Press Ctrl + A to select all the files and folders. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders. Example of all files and folders selected, except Bookmarks Restart your computer now. Then run FRST again and make sure you place a check mark on Additions.txt attach both new logs on your next reply. Thanks Ron
  15. It wasn't at the time the OP reported it. I verified it on my own system, but it is indeed back now. At the time that it had vanished it didn't show up either from the direct link to the Play Store from the Malwarebytes.com Android page or via searching for 'malwarebytes' on the Play Store but everything appears fine now.
  16. Please go ahead and run all the scans again and post back new logs. We should be pretty close to being done Please run the following steps and post back the logs as an attachment when ready. STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan Now. When finished, please click Clean & Repair. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks Ron
  17. HI @WAL123, Just checked, and it's still there: https://play.google.com/store/apps/details?id=org.malwarebytes.antimalware Nathan
  18. Ok, Loaded another one and same results. Attached logs from before and after a restart. (same results.) Also a note, 1903 has been released on MSDN. So good chance that only CU's will be the only changes between now and consumer release. After the trial was ended, Defender went back to normal and active. @LiquidTension . mbst-grab-results after restart.zip mbst-grab-results.zip
  19. Hi, Thanks for reporting. This should be fixed by now. I'm quite surprised this is missing a digital signature and even version information. Small note, In above, you attached two times the exact same file. So if they use the exact same file for 32 and 64 bits, we should be OK here as this has been fixed.
  20. Hi Folks, I have a problem that Malware Bytes can't seem to find. I've been using the same MacBook Pro (OS X Yosemite 10.10.5) for nearly 10 years, and I have had no more than 2 or 3 problems with malware and things of that nature. I use Chrome as my browser for most things, and Google is my default search engine. Over the last few weeks, when searching in Google, my browser will redirect me to Bing on occasion. So, for example, let's say that I google "how to change a tire on a car." The search results will come up in Google, and I can click on one of the results, lets say How2FixCars.com. Typically, when I do a search, a new tab doesn't open up, but what happens now (occasionally) is that a new tab will open up, taking me to How2FixCars.com; meanwhile, the old tab with the Google results will switch to Bing (with the same search terms). Once in Bing, something even more annoying happens -- if I click on a result, say TireFix.com, it doesn't take me to TireFix.com; instead, it will take me to some semi-related site, selling something like cars, car wax, or whatever. The really odd thing is that it doesn't always happen. I'd estimate that I get redirected to Bing maybe 1 in every 5-to-10 searches -- very strange. It's obviously annoying, but I am concerned that whatever is on my computer might be doing something even more sinister than redirecting my searches. I would really appreciate some help. Thanks so much. -- RCH
  21. Hello @distramseless: If corrective actions are taken with Malwarebytes AdwCleaner v7.3.0.0, deleted items are safely quarantined. You may wish to restore from the AdwCleaner's quarantine. Please update your topic with your results if this restoration action is undertaken. HTH
  22. MachineLearning/Anomalous.94%, C:\PROGRAM FILES\COMMON FILES\LOGISHRD\SP6_UNINSTALL\TOOLS\RUNBROWSER.EXE, No Action By User, [0], [392687],1.0.10346 MachineLearning/Anomalous.94%, C:\PROGRAM FILES\COMMON FILES\LOGISHRD\SP6_UNINSTALL\TOOLS\64\RUNBROWSER.EXE, No Action By User, [0], [392687],1.0.10346 This is from the latest Logitech software update released on 25-April-2019. Windows 10x64 Pro. MBAM Log.txt RunBrowser.zip RunBrowser64.zip
  23. Kaspersky has finished and it looks like they weren't viruses but I deleted everything related to the items just in case anyways. But, windows defender said again there was a threat detected. The second photo is of the latest one.
  24. The detections were from items that FRST removed. Has Kaspersky completed? Running it from the USB is okay but should really be ran from your Desktop if possible or at least your C drive.
  1. Load more activity
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.