Qone8

Viruses and worms
1

I’ll try to follow this topic as good as I can.

I bought a new computer today, my brother wanted to install a file that would make downloads go better (Daemon Tools)
And all of a sudden there was Qone8 as my new homepage.

I have tried many things now I came up to Google, but SpyHunter4 still says I have 29 threats remaining, (started with 106) from which 1 is a Trojan.
The problem is I don’t have the slightest idea how this things work, and in my desperation I came here to ask for your advice.

Programs I’ve run before I came here:
Malware bytes
Spyhunter4 (which is payed and Im not sure if it helps)
Cloud system booster
ADW cleaner
Add removal tool

I am an Avast user, but Avast says my computer is clean (which he is certainly not, since I still get the homepage).
I’ve also tried Mcafee and Norton, which both didn’t give any results too.

I’ve scanned again with Malware Byes and I added the OTL files.

I’m sorry if my English is not very good, I’m no native.

Thanks in advance!

Yours,

Tom

2

Here is the next logfile

3
I am an Avast user, but Avast says my computer is clean (which he is certainly not, since I still get the homepage).
Qone8 is not a infection it is a PUP PUP = not virus / Possible Unwanted Program http://malwaretips.com/blogs/pup-optional-qone8-removal/ was your Malwarebytes updated when you scanned? PUP are not default selected for removal, you have to mark it for removal if detected
4

Hi,

Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

filesrcm;
startupall;
skipfix-iedefaults;
firefoxlook;
chromelook;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

5

Thanks Pondus and Argus!

I’ll try to see where I can activate PUP protection in Avast,Malwarebytes is the latest version (v2014.05.08.05), UPDATE: in the folder of ‘Non malware protection’ I have PUP and PUM as ‘threat detection as malware’.
Also I heard I had to run MB in safe mode, but I can’t get my computer to start up in safe mode (I tried to do the press and hold f8 thing while starting up) is that really nececary?

Added files are the zoek.log

6
Also I heard I had to run MB in safe mode, but I can't get my computer to start up in safe mode (I tried to do the press and hold f8 thing while starting up) is that really nececary?
malwarebytes is not designed to be run in safe mode (all drivers are not loaded) so this option should only be used if there is a problem running it normal
Avast,Malwarebytes is the latest version (v2014.05.08.05)
this is the database version ..... program version should be 2.0.1
in the folder of 'Non malware protection' I have PUP and PUM as 'threat detection as malware'.
PUP = not virus / Possible Unwanted Program ....usually crapware that comes bundled with freeware downloads PUM = Possible Unwanted Modification ... eks mbam will see that your firewall is turned off. who did that, you or malware? mbam does not know so give you this warning and will resett to default setting
7

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job;f
[HKEY_USERS\S-1-5-21-1524650996-2887028272-4037391066-1000\Software\Microsoft\Windows\CurrentVersion\Run];r
"CloudSystemBooster"=-'r
C:\Program Files (x86)\Anvisoft;fs
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];r
"CloudSystemBooster"=-;r
chrdefaults;
emptyalltemp;
autoclean;
emptyclsid;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

.

http://imageshack.us/a/img841/7292/thisisujrt.gif
Please download Junkware Removal Tool to your desktop.

[]Shut down your protection software now to avoid potential conflicts.
[]Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select “Run as Administrator”.
[]The tool will open and start scanning your system.
[]Please be patient as this can take a while to complete depending on your system’s specifications.
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[]Post the contents of JRT.txt into your next message.

8

I didn’t put off my Firewall, I saw that it said ‘offline’ so I wanted to put it back online, but Avast said it was not possible to do that.
And I will try to find the latest prgram version, shall I run it again then, or wait and post the logs first?

9

Follow argus instructions…you can do that when he is finish with the work

10

Ok I did what Argus told me.
My Windows gave me a blue screen and said the system failed.
It was dumping memory or something and when it hit 100 it restarted itself.
I got no new text file so I’ll try it again.

The text files are added now

11

Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

12

Thanks!

This are the results:

13

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

[*]Click on the Scan button.
[*]After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

[*]After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
[*]Post logfile will also be saved in the C:\AdwCleaner folder.

14

The scan has finished:
adwcleaner [S0]

But there were more files in the C: map, shall I add them too? (such as [S1], [R1], [R0] etc.)

15

How is the situation now?

16

Worse.

It went from 29 threats to 72 :frowning:
I checked with Spyhunter 4.
Avast and MWB both see no threats though…

17

does this spyhunter program have a log? … if so attach it, alternative a screenshot of what it detect

18

6 print screens are added,

http://nl.tinypic.com/r/2a61iqb/8
http://nl.tinypic.com/r/2nbfsxf/8
http://nl.tinypic.com/r/2vte1d1/8
http://nl.tinypic.com/r/5xpx05/8
http://nl.tinypic.com/r/ie1qj9/8
http://nl.tinypic.com/r/34641nk/8

In chronologic order

19

it seems mostly cookies and adware …

20

Run CCleaner

http://www.filehippo.com/download_ccleaner/

Re-run Zoek With this script

installedprogs;
firefoxlook;
Chromelook;
shortcutfix;
uninstall-list; 
Qone8;z