Jump to content

Search the Community

Showing results for tags 'rtop'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Nebula
    • Malwarebytes Nebula Modules
    • Malwarebytes Endpoint Security
    • Other Malwarebytes Business Products
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...

Date Created

  • Start


Last Updated

  • Start


Filter by number of...


  • Start





Website URL






Found 2 results

  1. What is ByteFence Anti-Malware? The Malwarebytes research team has determined that ByteFence Anti-Malware is nagware and is often silently installed by bundlers. How do I know if I am infected with ByteFence Anti-Malware? This is how the main screen of the potentially unwanted application looks: You will find these icons in your taskbar, on your desktop and in your startmenu: And see these warnings during install: You may see this entry in your list of installed programs: and this Scheduled Task: How did ByteFence Anti-Malware get on my computer? Potentially unwanted programs use different methods for spreading themselves. This particular one is also available on their website. How do I remove ByteFence Anti-Malware? Our program Malwarebytes can detect and remove this potentially unwanted program. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of ByteFence Anti-Malware? No, Malwarebytes removes ByteFence Anti-Malware completely. This PUP creates a scheduled task. You can read here how to check for and, if necessary, remove Scheduled Tasks. If you installed this potentially unwanted program yourself and you want to continue using it, you can learn how to exclude the detections here. How would the full version of Malwarebytes help protect me? We hope our application has helped you eradicate this potentially unwnted software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes for additional protection. As you can see below the full version of Malwarebytes would have protected you against the ByteFence Anti-Malware PUP. It would have warned you before the could install itself, giving you a chance to stop it before it became too late. Technical details for experts Possible signs in FRST logs: (Byte Technologies LLC) C:\Program Files\ByteFence\ByteFence.exe () C:\Program Files\ByteFence\rsLggr.exe (Byte Technologies LLC) C:\Program Files\ByteFence\ByteFenceService.exe () C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe () C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt R2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [156640 2017-10-03] (Byte Technologies LLC) R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [302920 2017-11-17] () C:\Windows\System32\Tasks\ByteFence C:\Users\{username}\Desktop\ByteFence Anti-Malware.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware C:\ProgramData\ByteFence C:\Program Files\ByteFence ByteFence Anti-Malware (HKLM-x32\...\ByteFence) (Version: - Byte Technologies LLC) Task: {BCC85629-805B-4CDD-A730-DA2B5E3AD27A} - System32\Tasks\ByteFence => C:\Program Files\ByteFence\ByteFence.exe [2017-10-03] (Byte Technologies LLC) Hosts file # unchecky_begin # These rules were added by the Unchecky program in order to block advertising software modules # fix for traceroute and netstat display anomaly tracking.opencandy.com.s3.amazonaws.com media.opencandy.com cdn.opencandy.com tracking.opencandy.com api.opencandy.com api.recommendedsw.com rp.yefeneri2.com os.yefeneri2.com os2.yefeneri2.com installer.betterinstaller.com installer.filebulldog.com d3oxtn1x3b8d7i.cloudfront.net inno.bisrv.com nsis.bisrv.com cdn.file2desktop.com cdn.goateastcach.us cdn.guttastatdk.us cdn.inskinmedia.com cdn.insta.oibundles2.com cdn.insta.playbryte.com cdn.llogetfastcach.us cdn.montiera.com cdn.msdwnld.com cdn.mypcbackup.com cdn.ppdownload.com cdn.riceateastcach.us cdn.shyapotato.us cdn.solimba.com cdn.tuto4pc.com cdn.appround.biz cdn.bigspeedpro.com cdn.bispd.com cdn.bisrv.com cdn.cdndp.com cdn.download.sweetpacks.com cdn.dpdownload.com cdn.visualbee.net # unchecky_end Alterations made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files\ByteFence Adds the file ByteFence.exe"="10/3/2017 11:11 AM, 3686368 bytes, A Adds the file ByteFence.exe.config"="2/4/2017 11:51 PM, 380 bytes, A Adds the file ByteFenceGUI.dll"="10/2/2017 12:48 PM, 858080 bytes, A Adds the file ByteFenceScan.exe"="10/3/2017 11:11 AM, 198624 bytes, A Adds the file ByteFenceScan.exe.config"="2/4/2017 11:51 PM, 380 bytes, A Adds the file ByteFenceService.exe"="10/3/2017 11:11 AM, 156640 bytes, A Adds the file ByteFenceService.exe.config"="11/2/2016 6:25 PM, 383 bytes, A Adds the file ByteFenceService.InstallLog"="11/17/2017 9:11 AM, 675 bytes, A Adds the file ByteFenceService.InstallState"="11/17/2017 9:11 AM, 5012 bytes, A Adds the file EULA.txt"="9/5/2017 4:37 PM, 43142 bytes, A Adds the file InstallUtil.InstallLog"="11/17/2017 9:11 AM, 640 bytes, A Adds the file Microsoft.Win32.TaskScheduler.dll"="7/15/2015 7:35 PM, 246520 bytes, A Adds the file rsEngine.dll"="9/26/2017 12:48 PM, 3212056 bytes, A Adds the file rsEngineHelper.exe"="9/26/2017 12:49 PM, 170776 bytes, A Adds the file rsEngineHelper.exe.config"="9/8/2014 4:55 PM, 383 bytes, A Adds the file rsLggr.dll"="3/21/2017 4:03 PM, 131352 bytes, A Adds the file rsLggr.exe"="3/7/2017 7:18 PM, 582936 bytes, A Adds the file rsUtils.dll"="9/26/2017 12:55 PM, 186136 bytes, A Adds the file Signatures.dat"="11/17/2017 9:11 AM, 919232 bytes, A Adds the file SignaturesCEAList.dat"="11/17/2017 9:11 AM, 40856 bytes, A Adds the file SignaturesCEFList.dat"="11/17/2017 9:11 AM, 5952 bytes, A Adds the file SignaturesCEList.dat"="11/17/2017 9:11 AM, 98156 bytes, A Adds the file SignaturesPacks.dat"="11/17/2017 9:11 AM, 160664 bytes, A Adds the file Uninstall.exe"="11/17/2017 9:11 AM, 67610 bytes, A Adds the file WhiteList.dat"="9/12/2017 2:38 PM, 266968 bytes, A Adds the folder C:\Program Files\ByteFence\Cache Adds the folder C:\Program Files\ByteFence\Logs Adds the folder C:\Program Files\ByteFence\rtop Adds the file uninstall.dat"="11/17/2017 9:13 AM, 1484 bytes, A Adds the file uninstall.exe"="11/17/2017 9:13 AM, 373064 bytes, A Adds the folder C:\Program Files\ByteFence\rtop\bin Adds the file inject.dll"="11/17/2017 9:13 AM, 1017160 bytes, A Adds the file inject_x64.dll"="11/17/2017 9:13 AM, 1203016 bytes, A Adds the file rtop_bg.exe"="11/17/2017 9:12 AM, 620872 bytes, A Adds the file rtop_svc.exe"="11/17/2017 9:13 AM, 302920 bytes, A Adds the folder C:\Program Files\ByteFence\Scans Adds the folder C:\Program Files\ByteFence\x64 Adds the file ext_x64.dll"="7/5/2017 7:16 PM, 375576 bytes, A Adds the file lz4_x64.dll"="5/25/2016 2:38 PM, 129304 bytes, A Adds the file System.Data.SQLite.dll"="11/16/2016 6:05 PM, 1658136 bytes, A Adds the folder C:\Program Files\ByteFence\x86 Adds the file ext_x86.dll"="7/5/2017 8:23 PM, 280344 bytes, A Adds the file lz4_x86.dll"="5/25/2016 2:38 PM, 106776 bytes, A Adds the file System.Data.SQLite.dll"="11/16/2016 6:06 PM, 1209624 bytes, A Adds the folder C:\ProgramData\ByteFence\RTOP Adds the file hosts_backup"="11/17/2017 9:12 AM, 824 bytes, A Adds the file uclogfile.bin"="11/17/2017 9:14 AM, 0 bytes, A Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware Adds the file ByteFence Anti-Malware.lnk"="11/17/2017 9:11 AM, 1041 bytes, A In the existing folder C:\Users\{username}\Desktop Adds the file ByteFence Anti-Malware.lnk"="11/17/2017 9:11 AM, 1023 bytes, A In the existing folder C:\Windows\System32\drivers\etc Alters the file hosts In the existing folder C:\Windows\System32\Tasks Adds the file ByteFence"="11/17/2017 9:11 AM, 3404 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\ByteFence] "CLNG"="REG_SZ"", "en" "ELINSF"="REG_SZ"", "11/17/2017 9:11:29 AM" "EVNLSA"="REG_SZ"", "636465067385861443" "FETRSI"="REG_SZ"", "132" "FirstRun"="REG_SZ"", "11/17/2017 9:11:20 AM" "FSSATO"="REG_SZ"", "0" "IDT"="REG_SZ"", "1510909881" "INSSRTS"="REG_SZ"", "1" "InstallDate"="REG_SZ"", "11/17/2017 9:11:21 AM" "LFMAIN"="REG_SZ"", "636465067121173943" "PINSTP"="REG_SZ"", "" "PMASS"="REG_SZ"", "1" "PMPMMPH"="REG_SZ"", "1" "PMPMMPHH"="REG_SZ"", "1" "PMPMMPHS"="REG_SZ"", "1" "PMPMMPSS"="REG_SZ"", "1" "PSSET"="REG_SZ"", "" "RTPMA"="REG_SZ"", "1" "ScheduleScanEnabled"="REG_SZ"", "1" "ScheduleScanMode"="REG_SZ"", "2" "SIGLC"="REG_SZ"", "11/17/2017 9:11:58 AM" "U"="REG_SZ"", "33d8c6d1-d3dc-44fe-b001-8ac52b410b2a" "UH"="REG_SZ"", "464D06AA81944213158F16D5C74846D2" "UNCKIE"="REG_SZ"", "1" "UNCKIED"="REG_SZ"", "11/17/2017 9:11:57 AM" "WLLCK"="REG_SZ"", "11/17/2017 9:11:59 AM" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan] "(Default)"="REG_SZ"", "Scan with ByteFence Anti-Malware..." "Icon"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFence.exe",0" "Position"="REG_SZ"", "Middle" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan\command] "(Default)"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFenceScan.exe" /scan:"%1"" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan] "(Default)"="REG_SZ"", "Scan with ByteFence Anti-Malware..." "Icon"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFence.exe",0" "Position"="REG_SZ"", "Middle" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan\command] "(Default)"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFenceScan.exe" /scan:"%1"" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ByteFence] "ELINSF"="REG_SZ"", "11/17/2017 9:11:29 AM" "FETRSI"="REG_SZ"", "132" "FirstRun"="REG_SZ"", "11/17/2017 9:11:20 AM" "FSSATO"="REG_SZ"", "0" "IDT"="REG_SZ"", "1510909881" "INSSRTS"="REG_SZ"", "1" "InstallDate"="REG_SZ"", "11/17/2017 9:11:21 AM" "LFMAIN"="REG_SZ"", "636465067121173943" "PINSTP"="REG_SZ"", "" "PMASS"="REG_SZ"", "1" "PMPMMPH"="REG_SZ"", "1" "PMPMMPHH"="REG_SZ"", "1" "PMPMMPHS"="REG_SZ"", "1" "PMPMMPSS"="REG_SZ"", "1" "PSSET"="REG_SZ"", "" "RTPMA"="REG_SZ"", "1" "ScheduleScanEnabled"="REG_SZ"", "1" "ScheduleScanMode"="REG_SZ"", "2" "SIGLC"="REG_SZ"", "11/17/2017 9:11:58 AM" "U"="REG_SZ"", "33d8c6d1-d3dc-44fe-b001-8ac52b410b2a" "UH"="REG_SZ"", "464D06AA81944213158F16D5C74846D2" "UNCKIE"="REG_SZ"", "1" "UNCKIED"="REG_SZ"", "11/17/2017 9:11:57 AM" "WLLCK"="REG_SZ"", "11/17/2017 9:11:59 AM" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ByteFence\RTOP] "HideTrayIcon"="REG_DWORD"", 1 "InstTime"="REG_QWORD, .... "LastUpdateCheckTime"="REG_DWORD"", 61259511 "Path"="REG_SZ"", "C:\Program Files\ByteFence\rtop" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence] "DisplayIcon"="REG_SZ"", "C:\Program Files\ByteFence\Uninstall.exe" "DisplayName"="REG_SZ"", "ByteFence Anti-Malware" "DisplayVersion"="REG_SZ"", "" "InstallSource"="REG_SZ"", "C:\Program Files\ByteFence\" "NoModify"="REG_DWORD"", 1 "NoRepair"="REG_DWORD"", 1 "Publisher"="REG_SZ"", "Byte Technologies LLC" "UninstallString"="REG_SZ"", ""C:\Program Files\ByteFence\uninstall.exe"" "URLInfoAbout"="REG_SZ"", "https://www.bytefence.com" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ByteFenceService] "Description"="REG_SZ"", "ByteFence Anti-Malware protetcion service" "DisplayName"="REG_SZ"", "ByteFence Anti-Malware Service" "ErrorControl"="REG_DWORD"", 1 "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\ByteFence\ByteFenceService.exe"" "ObjectName"="REG_SZ"", "LocalSystem" "Start"="REG_DWORD"", 2 "Type"="REG_DWORD"", 16 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\ByteFenceService] "EventMessageFile"="REG_EXPAND_SZ, "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\EventLogMessages.dll" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rtop] "Description"="REG_SZ"", "ByteFence Security service to prevents Potentially Unwanted Programs." "DisplayName"="REG_SZ"", "rtop" "ErrorControl"="REG_DWORD"", 1 "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe"" "ObjectName"="REG_SZ"", "LocalSystem" "Start"="REG_DWORD"", 2 "Type"="REG_DWORD"", 16 "WOW64"="REG_DWORD"", 1 [HKEY_USERS\.DEFAULT\Software\ByteFence\RTOP] [HKEY_CURRENT_USER\Software\ByteFence\RTOP] "HideTrayIcon"="REG_DWORD"", 1 Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 11/17/17 Scan Time: 9:32 AM Log File: d505895c-cb71-11e7-9303-080027750297.json Administrator: Yes -Software Information- Version: Components Version: 1.0.212 Update Package Version: 1.0.3280 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 333970 Threats Detected: 19 Threats Quarantined: 19 Time Elapsed: 2 min, 35 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 3 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\RTOP\BIN\RTOP_SVC.EXE, Quarantined, [633], [390139],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCESERVICE.EXE, Quarantined, [633], [388726],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCE.EXE, Quarantined, [633], [389016],1.0.3280 Module: 3 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\RTOP\BIN\RTOP_SVC.EXE, Quarantined, [633], [390139],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCESERVICE.EXE, Quarantined, [633], [388726],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCE.EXE, Quarantined, [633], [389016],1.0.3280 Registry Key: 5 PUP.Optional.ByteFence, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RTOP, Delete-on-Reboot, [633], [390139],1.0.3280 PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BCC85629-805B-4CDD-A730-DA2B5E3AD27A}, Delete-on-Reboot, [633], [389376],1.0.3280 PUP.Optional.ByteFence, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ByteFenceService, Delete-on-Reboot, [633], [388726],1.0.3280 PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\ByteFence, Delete-on-Reboot, [633], [389375],1.0.3280 PUP.Optional.ByteFence, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ByteFence, Delete-on-Reboot, [633], [389016],1.0.3280 Registry Value: 2 PUP.Optional.ByteFence, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RTOP|IMAGEPATH, Delete-on-Reboot, [633], [390139],1.0.3280 PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BCC85629-805B-4CDD-A730-DA2B5E3AD27A}|PATH, Delete-on-Reboot, [633], [389376],1.0.3280 Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 6 PUP.Optional.ByteFence, C:\WINDOWS\SYSTEM32\TASKS\ByteFence, Delete-on-Reboot, [633], [388721],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\RTOP\BIN\RTOP_SVC.EXE, Delete-on-Reboot, [633], [390139],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCESERVICE.EXE, Delete-on-Reboot, [633], [388726],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCE.EXE, Delete-on-Reboot, [633], [389016],1.0.3280 PUP.Optional.ByteFence, C:\USERS\{username}\DESKTOP\BYTEFENCE-INSTALLER_3.16.0.EXE, Delete-on-Reboot, [633], [389016],1.0.3280 PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\UNINSTALL.EXE, Delete-on-Reboot, [633], [389016],1.0.3280 Physical Sector: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat. We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
  2. Hello! I stumbled onto your forum and I am now concerned. My computer is being strange, It rebooted itself without a timer (after windows updates, etc.). I also have noticed that Avira is not turned on, and I can't seem to turn it back on, it keeps giving me notifications that I need to update it. Once I do, it says that Windows Defender and Avira are not running. Malwarebytes has not detected anything after Trojan-Dropper rtop_svc.exe. Attached are my log files. Thank you so so much! aswMBR.txt Attach.rar DDS.txt
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.