Removal instructions for Teras Games

[Metallica]

What is Teras Games?

The Malwarebytes research team has determined that Teras Games is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by Teras Games?

You may see this entry in your list of installed programs:

and these warnings during install:

and this icon on your desktop and in your start-menu:

How did Teras Games get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Teras Games?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to the following:
  • Enable free trial of Malwarebytes Anti-Malware Premium
  • Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
• Reboot your computer if prompted.

Is there anything else I need to do to get rid of Teras Games?

• The shortcuts called Teras Games on the desktop and in the start-menu can be deleted if they belonged to the PUP.

How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this adware application.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Teras Games adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

Possible signs in a HijackThis log:

O23 - Service: TxqKflOw - Today Solutions - C:\ProgramData\daXRnXaxjG\TxqKflOw.exe

Note: the name of the service, the residing folder and filename are random

You may see these signs in FRST logs:

 (Today Solutions) C:\ProgramData\daXRnXaxjG\TxqKflOw.exe R2 TxqKflOw; C:\ProgramData\daXRnXaxjG\TxqKflOw.exe [2732792 2015-08-21] (Today Solutions) C:\ProgramData\daXRnXaxjG C:\Users\{username}\Desktop\Teras Games.lnk C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Teras Games C:\Users\{username}\AppData\Local\TerasGames C:\TerasGames C:\ProgramData\TerasGamesTerasGames (HKLM-x32\...\TerasGames) (Version: 3.0.79 - Today Solutions)

Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\ProgramData\daXRnXaxjG       Adds the file IEClearCache.exe"="8/21/2015 10:30 AM, 29944 bytes, A       Adds the file IEClearCache.exe.config"="8/21/2015 10:30 AM, 168 bytes, A       Adds the file info.dat"="8/21/2015 10:30 AM, 128 bytes, A       Adds the file TxqKflOw.dat"="8/21/2015 10:30 AM, 128 bytes, A       Adds the file TxqKflOw.exe"="8/21/2015 10:30 AM, 2732792 bytes, A       Adds the file TxqKflOw.exe.config"="8/21/2015 10:30 AM, 288 bytes, A    Adds the folder C:\ProgramData\daXRnXaxjG\dat       Adds the file atZscIEZ.dll"="8/21/2015 10:30 AM, 1455352 bytes, A       Adds the file ecUDAIo.dll"="8/21/2015 10:30 AM, 1240824 bytes, A       Adds the file PvrzRtgI.exe"="8/21/2015 10:30 AM, 48376 bytes, A       Adds the file PvrzRtgI.exe.config"="8/21/2015 10:30 AM, 190 bytes, A       Adds the file SVlChzLrCF.exe"="8/21/2015 10:30 AM, 49912 bytes, A       Adds the file SVlChzLrCF.exe.config"="8/21/2015 10:30 AM, 190 bytes, A    Adds the folder C:\ProgramData\TerasGames       Adds the file TerasGames.ico"="8/21/2015 10:30 AM, 139059 bytes, A       Adds the file uninstall.exe"="8/21/2015 10:30 AM, 684280 bytes, A       Adds the file uninstall.exe.config"="8/21/2015 10:30 AM, 168 bytes, A    Adds the folder C:\TerasGamesRegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}]       "id"="REG_SZ", "c9aaac04e74f437f9df34baaea823c83"       "p"="REG_SZ", "249801"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}]       "(Default)"="REG_DWORD", 1       "v"="REG_DWORD", 1       "vs"="REG_SZ", "1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2970C7C-8392-4E6F-8B51-B763CF38E13C}]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fef5b27c-df71-0156-030a-d5d374a4df13}]       "id"="REG_SZ", "c9aaac04e74f437f9df34baaea823c83"       "ip"="REG_SZ", "249801"       "p"="REG_SZ", "249801"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}]       "id"="REG_SZ", "c9aaac04e74f437f9df34baaea823c83"       "p"="REG_SZ", "249801"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0b87f2d2-4ea0-0fae-0cec-e7f0500f3f3f}]       "ik"="REG_SZ", "{68f4b6b0-2b75-a1b3-95b3-f2274031f4f0}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{67a094de-f06a-08a1-3c32-68c3d97576de}]       "id"="REG_SZ", "c9aaac04e74f437f9df34baaea823c83"       "lpvcc"="REG_SZ", "3.0.79"       "p"="REG_SZ", "249801"       "sd"="REG_SZ", "265aae26-82dc-ebd4-082b-be329d25eece"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8e716327-690c-e1b0-2ca7-658899ece391}]       "id"="REG_SZ", "c9aaac04e74f437f9df34baaea823c83"       "lpvcc"="REG_SZ", "3.0.79"       "p"="REG_SZ", "249801"       "sd"="REG_SZ", "265aae26-82dc-ebd4-082b-be329d25eece"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}]       "(Default)"="REG_DWORD", 1       "v"="REG_DWORD", 1       "vs"="REG_SZ", "1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A2970C7C-8392-4E6F-8B51-B763CF38E13C}]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fef5b27c-df71-0156-030a-d5d374a4df13}]       "id"="REG_SZ", "c9aaac04e74f437f9df34baaea823c83"       "ip"="REG_SZ", "249801"       "p"="REG_SZ", "249801"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TxqKflOw_RASAPI32]       "ConsoleTracingMask"="REG_DWORD", -65536       "EnableAutoFileTracing"="REG_DWORD", 0       "EnableConsoleTracing"="REG_DWORD", 0       "EnableFileTracing"="REG_DWORD", 0       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"       "FileTracingMask"="REG_DWORD", -65536       "MaxFileSize"="REG_DWORD", 1048576    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TxqKflOw_RASMANCS]       "ConsoleTracingMask"="REG_DWORD", -65536       "EnableAutoFileTracing"="REG_DWORD", 0       "EnableConsoleTracing"="REG_DWORD", 0       "EnableFileTracing"="REG_DWORD", 0       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"       "FileTracingMask"="REG_DWORD", -65536       "MaxFileSize"="REG_DWORD", 1048576    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TerasGames]       "DisplayIcon"="REG_SZ", "C:\ProgramData\TerasGames\TerasGames.ico"       "DisplayName"="REG_SZ", "TerasGames"       "DisplayVersion"="REG_SZ", "3.0.79"       "EstimatedSize"="REG_DWORD", 5000       "HelpLink"="REG_SZ", "http://www.terasgames.com/"       "InstallDate"="REG_SZ", "8/21/2015"       "Publisher"="REG_SZ", "Today Solutions"       "UninstallString"="REG_SZ", ""C:\ProgramData\TerasGames\uninstall.exe""    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Service]       "EventMessageFile"="REG_EXPAND_SZ, "C:\Windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TxqKflOw]       "DependOnService"="REG_MULTI_SZ, "Winmgmt CryptSvc "       "DisplayName"="REG_SZ", "TxqKflOw"       "ErrorControl"="REG_DWORD", 1       "FailureActions"="REG_BINARY, <.....................       "ImagePath"="REG_EXPAND_SZ, ""C:\ProgramData\daXRnXaxjG\TxqKflOw.exe""       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 2       "Type"="REG_DWORD", 16       "WOW64"="REG_DWORD", 1

Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 8/21/2015Scan Time: 10:36 AMLogfile: mbamTerasGames,txt.txtAdministrator: YesVersion: 2.1.8.1057Malware Database: v2015.08.21.03Rootkit Database: v2015.08.16.01License: PremiumMalware Protection: DisabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 8.1CPU: x64File System: NTFSUser: PieterScan Type: Threat ScanResult: CompletedObjects Scanned: 346054Time Elapsed: 29 min, 44 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 1PUP.Optional.TerasGames.A, C:\ProgramData\daXRnXaxjG\TxqKflOw.exe, 3048, Delete-on-Reboot, [3b3c5eaded9e3afc8a8719b8cc3542be]Modules: 0(No malicious items detected)Registry Keys: 5PUP.Optional.TerasGames.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TxqKflOw, Quarantined, [3b3c5eaded9e3afc8a8719b8cc3542be], PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\CLASSES\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, Quarantined, [7106ee1d226977bfbc70534b2cd6ae52], PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, Quarantined, [7106ee1d226977bfbc70534b2cd6ae52], PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, Quarantined, [7106ee1d226977bfbc70534b2cd6ae52], PUP.Optional.TerasGames.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\TerasGames, Quarantined, [cfa80efd9bf073c30c05efe256abba46], Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 3PUP.Optional.TerasGames.A, C:\ProgramData\TerasGames, Quarantined, [e88f37d4dcaf4aec2951dbdc9272e917], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG\dat, Delete-on-Reboot, [73040a01296235010640137a976e07f9], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG, Delete-on-Reboot, [73040a01296235010640137a976e07f9], Files: 16PUP.Optional.TerasGames.A, C:\ProgramData\daXRnXaxjG\TxqKflOw.exe, Delete-on-Reboot, [3b3c5eaded9e3afc8a8719b8cc3542be], Adware.PullUpdate, C:\ProgramData\daXRnXaxjG\dat\atZscIEZ.dll, Delete-on-Reboot, [b3c40704fb901b1b5e32c40ae41dd828], PUP.Optional.ZombieInvasion.A, C:\ProgramData\daXRnXaxjG\dat\ecUDAIo.dll, Delete-on-Reboot, [c5b2ab6074173402cfa08aa613f2ad53], PUP.Optional.TerasGames.A, C:\ProgramData\daXRnXaxjG\dat\PvrzRtgI.exe, Delete-on-Reboot, [c0b7e9223556e84e050cce037b8648b8], PUP.Optional.TerasGames.A, C:\ProgramData\daXRnXaxjG\dat\SVlChzLrCF.exe, Delete-on-Reboot, [2f489e6d5b30a591cf423e9330d107f9], PUP.Optional.TerasGames.A, C:\ProgramData\TerasGames\uninstall.exe, Quarantined, [cfa80efd9bf073c30c05efe256abba46], PUP.Optional.TerasGames.A, C:\Users\Pieter\Desktop\pullupdate_7dd36764d420054011e14cf095e2651427f722796f266e0222b28.exe, Quarantined, [ed8a9c6f8902cb6b3cd5834ebf42d12f], PUP.Optional.TerasGames.A, C:\ProgramData\TerasGames\uninstall.exe.config, Quarantined, [e88f37d4dcaf4aec2951dbdc9272e917], PUP.Optional.TerasGames.A, C:\ProgramData\TerasGames\TerasGames.ico, Quarantined, [e88f37d4dcaf4aec2951dbdc9272e917], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG\dat\PvrzRtgI.exe.config, Delete-on-Reboot, [73040a01296235010640137a976e07f9], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG\dat\atZscIEZ.dll, Delete-on-Reboot, [73040a01296235010640137a976e07f9], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG\dat\SVlChzLrCF.exe.config, Delete-on-Reboot, [73040a01296235010640137a976e07f9], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG\info.dat, Delete-on-Reboot, [73040a01296235010640137a976e07f9], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG\TxqKflOw.dat, Delete-on-Reboot, [73040a01296235010640137a976e07f9], PUP.Optional.PullUpdate.A, C:\ProgramData\daXRnXaxjG\TxqKflOw.exe.config, Quarantined, [73040a01296235010640137a976e07f9], Physical Sectors: 0(No malicious items detected)(end)

As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.