Reduled/Blackfight/Reddit etc.. Virus

system · May 18, 2015, 6:02pm

Hello I tried everytrhing and nothing seesm to work…
Here’s what I have from Farbar

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-05-2015 02
Ran by Michel at 2015-05-18 13:35:00
Running from C:\Users\Michel\Downloads
Boot Mode: Normal

==================== Accounts: =============================

Administrateur (S-1-5-21-94275921-2831837396-2655263634-500 - Administrator - Disabled)
Invité (S-1-5-21-94275921-2831837396-2655263634-501 - Limited - Disabled)
Michel (S-1-5-21-94275921-2831837396-2655263634-1002 - Administrator - Enabled) => C:\Users\Michel
nan-c_000 (S-1-5-21-94275921-2831837396-2655263634-1003 - Limited - Enabled) => C:\Users\nan-c_000

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with “hidden” flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acapela Text to Speech for WordQ 3_1 (Core) (HKLM-x32.…{8364ED51-93B7-40BB-BD60-E47C35BC7A20}) (Version: 9.1.1 - Quillsoft)
Acapela Text-to-Speech for WordQ 3_1 (Canadian French) (HKLM-x32.…{FFA6F706-BA8A-49B2-93D0-ADDEEBF4BA03}) (Version: 9.1.1 - Quillsoft Ltd.)
Adobe Flash Player 17 NPAPI (HKLM-x32.…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Français (HKLM-x32.…{AC76BA86-7AD7-1036-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM.…{BCF4DA9E-A219-2BFF-8A17-81BB135E9BCA}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32.…{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM.…{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32.…{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Launcher (HKLM-x32.…{40376CD0-67E0-4190-86CA-8BD8CBAC331C}) (Version: 2.00.11 - ASUSTeK Computer Inc.)
ASUS Manager - PC Cleanup (HKLM-x32.…{E22A19AE-7DDB-4959-B1DB-A0996294352A}) (Version: 2.00.03 - ASUSTeK Computer Inc.)
ASUS Manager - Power Manager (HKLM-x32.…{DD248BEE-E925-4720-A775-9A42276BB6EA}) (Version: 2.01.02 - ASUSTeK Computer Inc.)
ASUS Manager - Recovery (HKLM-x32.…{CF4A14CB-C4CB-4241-B659-7C58517515CF}) (Version: 2.00.08 - ASUSTeK Computer Inc.)
ASUS Manager - Update (HKLM-x32.…{675BBE8A-0ED3-4048-8723-BA51EAB8E1A8}) (Version: 2.01.03 - ASUSTeK Computer Inc.)
ASUS Manager - USB Lock (HKLM-x32.…{1931C916-6CB8-4E4D-8561-EA20C426AE19}) (Version: 2.00.10 - ASUSTeK Computer Inc.)
ASUS Manager (HKLM-x32.…{F5E5AD85-4A90-4604-A887-464D3818D8FD}) (Version: 2.05.04 - ASUSTeK Computer Inc.)
ASUS Music Maker (HKLM-x32.…\MAGIX_{AB515018-7F9D-4047-B0C0-F26BAC30F3E1}) (Version: 18.0.4.1 - MAGIX AG)
ASUS Music Maker (Version: 18.0.4.1 - MAGIX AG) Hidden
ASUSDVD (HKLM-x32.…\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5424.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.5424.52 - CyberLink Corp.) Hidden
AsusVibe2.0 (HKLM-x32.…\Asus Vibe2.0) (Version: 2.0.12.310 - ASUSTEK)
Avast Free Antivirus (HKLM-x32.…\Avast) (Version: 10.2.2218 - AVAST Software)
Bonjour (HKLM.…{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM-x32.…\Easy-WebPrint EX) (Version: 1.5.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32.…\Canon_IJ_Network_Scanner_Selector_EX) (Version: - Canon Inc.)
Canon IJ Network Tool (HKLM-x32.…\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32.…\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32.…\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG3500 series MP Drivers (HKLM.…{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}Canon_MG3500_series) (Version: 1.01 - Canon Inc.)
Canon MG3500 series On-screen Manual (HKLM-x32.…\Canon MG3500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM-x32.…\Canon My Image Garden) (Version: 3.1.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32.…\Canon My Image Garden Design Files) (Version: 3.1.0 - Canon Inc.)
Canon My Printer (HKLM-x32.…\CanonMyPrinter) (Version: 3.2.1 - Canon Inc.)
Canon Quick Menu (HKLM-x32.…\CanonQuickMenu) (Version: 2.5.0 - Canon Inc.)
CCleaner (HKLM.…\CCleaner) (Version: 5.05 - Piriform)
Cisco EAP-FAST Module (HKLM-x32.…{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32.…{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32.…{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink PhotoDirector 3 (HKLM-x32.…\InstallShield{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4428 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32.…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-94275921-2831837396-2655263634-1002.…\Dropbox) (Version: 2.6.24 - Dropbox, Inc.)
eManual (HKLM-x32.…{0C84E634-EB68-4A54-B21E-A05EC87A4CC5}) (Version: 1.00.07 - ASUSTeK Computer Inc.)
Firebird SQL Server - MAGIX Edition (HKLM-x32.…{39AB2E37-1A55-4292-A5D3-971E9F70D0F8}) (Version: 2.1.32.0 - MAGIX AG)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Full Tilt Poker (HKLM-x32.…{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}) (Version: 5.8.21.WIN.FullTilt.COM - )
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32.…\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32.…{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
iCloud (HKLM.…{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)
McAfee Security Scan Plus (HKLM-x32.…\McAfee Security Scan) (Version: 3.0.285.6 - McAfee, Inc.)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32.…{90120000-0011-0000-0000-0000000FF1CE}PROPLUS{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 365 - fr-fr (HKLM.…\O365HomePremRetail - fr-fr) (Version: 15.0.4711.1003 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32.…{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32.…\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM.…{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-94275921-2831837396-2655263634-1002.…\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32.…{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32.…{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM.…{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM.…{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM.…{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32.…{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32.…{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32.…{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM.…{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32.…{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32.…{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32.…{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM.…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32.…{90120000-0016-040C-0000-0000000FF1CE}PROPLUS{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32.…{90120000-001A-040C-0000-0000000FF1CE}PROPLUS{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32.…{90120000-0018-040C-0000-0000000FF1CE}PROPLUS{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM-x32.…{90120000-001B-040C-0000-0000000FF1CE}PROPLUS{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Module linguistique Microsoft Visual Studio 2010 Tools pour Office Runtime (x64) - FRA (HKLM.…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - FRA) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.1 (x86 fr) (HKLM-x32.…\Mozilla Firefox 38.0.1 (x86 fr)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32.…\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32.…{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MySQL Connector/ODBC 3.51 (HKLM-x32.…{6A85286D-BA0F-4318-8C30-AD74A33AAD36}) (Version: 3.51.28 - Oracle Corporation)
MySQL Connector/ODBC 5.2(a) (HKLM-x32.…{6BAA9A62-1520-4063-A5B4-FFB3D6EC62BB}) (Version: 5.2.4 - Oracle Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4711.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4711.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4711.1003 - Microsoft Corporation) Hidden
PokerStars (HKLM-x32.…\PokerStars) (Version: - PokerStars)
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
REALTEK Bluetooth Driver (HKLM-x32.…{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.092613 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32.…{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30166 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32.…{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.18.621.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32.…{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7035 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32.…{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0224 - REALTEK Semiconductor Corp.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32.…{90120000-0011-0000-0000-0000000FF1CE}PROPLUS{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
WebStorage (HKLM-x32.…\WebStorage) (Version: 2.0.3.226 - ASUS Cloud Corporation)
Windows Live Essentials (HKLM-x32.…\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WordQ 3 (HKLM-x32.…{6FFDCB4F-381D-485D-879E-1B4DFFA316C4}) (Version: 3.1.41592 - Quillsoft Ltd.)
YGOPro DevPro (HKLM-x32.…{43589988-FB5A-4C3A-B7EE-1D831EF9E89F}) (Version: 1.9.9 - DevPro)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

TwinHeadedEagle · May 18, 2015, 6:05pm

Hello,

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

system · May 18, 2015, 6:25pm

Hi , everytime my computer come back from idle I receive 32 notifications from Avast that a menace was detected …
When I run CCleaner and reboot doesn’t do it for a while , but always come back.
I also found hqghumeaylnlf.exe Hqghumeaylnlf on TASK on the starting tablet

Eddy · May 18, 2015, 6:49pm

Michel, do not post the logs but attach them.

system · May 18, 2015, 7:07pm

Here you go thanks…

TwinHeadedEagle · May 18, 2015, 8:33pm

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
bitsadmin /reset /allusers;b
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · May 19, 2015, 10:16am

Thank you for your help… here are the notes

TwinHeadedEagle · May 19, 2015, 10:18am

Zoek did not finish well. Can you run it again?

system · May 19, 2015, 10:23am

I can’t close Zoek window keeps popping up…

TwinHeadedEagle · May 19, 2015, 10:23am

Please restart your PC and run Zoek again.

system · May 19, 2015, 10:52am

Here’s the file … Thank you again …
Wasn’t sure wich one so attached both

TwinHeadedEagle · May 19, 2015, 10:58am

Very good. How is your PC behaving now?

system · May 19, 2015, 11:17am

So far back to normal… Will advise tomorrow and let you know…

Greatly apreciated

system · May 19, 2015, 11:17pm

Still great many thanks…

system · May 20, 2015, 12:24am

I am having exactly the same problem. FRST logs attached.

TwinHeadedEagle · May 20, 2015, 6:01am

@mcgeol