Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Level Quality Watcher - How do I remove this malware?


  • Please log in to reply
10 replies to this topic

#1 Xalell3000

Xalell3000

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:24 AM

Posted 29 November 2013 - 02:26 PM

Hi!  

 

My computer has been acting terrible lately.  I have this folder on my computer that seems to be malware "Level Quality Watcher."  I would like to know how to remove it.  It was running and when I tried to turn it off in precesses it wasn't allowed.

 

There were so many different web pages on how to remove it, some of them look suspicious.  It is definitely intimidating.  I have Windows 7 Home.

 

How do I get this malware off my computer?

 

Thanks and I appreciate your assistance,

Xalell3000

 


BC AdBot (Login to Remove)

 


#2 Xalell3000

Xalell3000
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:24 AM

Posted 29 November 2013 - 08:02 PM

Hi Louis,

 

Thanks for the words of hope. I downloaded Malwarebytes Anti-Malware, ran a scan and it didn't disable the "Level Quality Watcher."  I couldn't even get the program to stop by going into the Task Manager. I was denied access on my own computer.  Nasty bit of malware, this is.  I went into the MSCONFIG file and stopped it from running.

 

I would really like to get it off my computer. Any assistance you could provide would be greatly appreciated.

 

You're the best!

 

Thanks,

Xalell



#3 Condobloke

Condobloke

  • Members
  • 1,673 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australian Outback....middle of nowhere....
  • Local time:04:24 PM

Posted 30 November 2013 - 07:03 AM

 
 

G'day Xalell3000, and Welcome to BC !!

 

Lets see if we can get rid of this pest for you.....

 

The following list may appear a little daunting.....

 

However...feel free to post the logs back in individual posts....or whatever you are comfortable with.

 

( I often find it less daunting if i download all the necessary programs to my desktop before I begin )

 

Please run these in the order I have listed them

 

 

 

If you would run these for me, we will make a start...

 

Download Security Check by Screen317 from HERE
* Save it to your Desktop.
* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Note: If a security program requests permission to access the Internet, allow it to do so.

 

 

Then....

 

Download  MiniToolBox MiniToolBox, Save it to your desktop and run it.
Close any Firefox browsers you may have open
Checkmark the following boxes:
•Flush DNS
•Report IE Proxy Settings
•Reset IE Proxy Settings
•Report FF Proxy Settings
•Reset FF Proxy Settings
•List content of Hosts
•List IP configuration
•List last 10 Event Viewer log
•List Installed Programs
•List Users, Partitions and Memory size.
•List Minidump Files
 
Click Go and copy / paste the result (Result.txt).

 

 

And then !!.....

 

Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

* Double-click on the Rkill desktop icon to run the tool.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

 

 

Then follow straight away with MBAM....

 

Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the finish of the installation, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version. <<< most important )
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here in your next Reply

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

 

 

Following this, we need to run MBAR....

 

Download Malwarebytes Anti-Rootkit from HERE  to your Desktop.

    Unzip downloaded file.
    Open the folder where the contents were unzipped and run mbar.exe
    Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    DO NOT click on the Cleanup button. Simply exit the program.
    When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

 

 

 

 

 

 

 

 

Condobloke

Outback Australia.

 

Currently in Cebu...cloudy one day, overcast and smoggy the next !!

#4 mastice

mastice

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:24 AM

Posted 03 December 2013 - 11:36 AM

I just wanted to post up a reply to this thread to thank Condobloke for posting the fix, in easy to follow instructions, on how to get rid of LQW.  The fix worked perfectly and the instructions were easy to understand.  Thank you! 



#5 Condobloke

Condobloke

  • Members
  • 1,673 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australian Outback....middle of nowhere....
  • Local time:04:24 PM

Posted 03 December 2013 - 05:19 PM

Thank you mastice !.....that is very kind of you.

If you would like to go HERE ....click on START NEW TOPIC......and then leave me a link to your topic.......I would really like to see the logs from the scans you ran.

Regards,


Edited by Condobloke, 03 December 2013 - 05:31 PM.

Condobloke

Outback Australia.

 

Currently in Cebu...cloudy one day, overcast and smoggy the next !!

#6 Condobloke

Condobloke

  • Members
  • 1,673 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australian Outback....middle of nowhere....
  • Local time:04:24 PM

Posted 08 December 2013 - 05:57 PM

XALELL3000, do you still require assistance ??

 

Regards,


Condobloke

Outback Australia.

 

Currently in Cebu...cloudy one day, overcast and smoggy the next !!

#7 Condobloke

Condobloke

  • Members
  • 1,673 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australian Outback....middle of nowhere....
  • Local time:04:24 PM

Posted 10 December 2013 - 07:38 PM

We have not heard from you in 11 days, so I will take this topic off my watch list.

If you still need help, feel free to send me a pm.

 

Regards,


Condobloke

Outback Australia.

 

Currently in Cebu...cloudy one day, overcast and smoggy the next !!

#8 Xalell3000

Xalell3000
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:24 AM

Posted 13 December 2013 - 11:47 AM

Hi Condobloke,

 

My apologies. I did manage to disable the program.  I've been super busy and have not had time to go through all the steps, what with the holidays approaching.  I'll definitely try this after the holidays.

I did listen to Waltzing Matilda last week.  There was a youtube video that had the translation for us Americans.  (It is -9 C in Minneapolis today.)

 

I greatly appreciate your assistance.

 

Thanks,

Xalell3000



#9 Condobloke

Condobloke

  • Members
  • 1,673 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australian Outback....middle of nowhere....
  • Local time:04:24 PM

Posted 13 December 2013 - 05:35 PM

All Good !  I will be here.  gday-mate-aussie-smiley-emoticon.gif

 

 


Condobloke

Outback Australia.

 

Currently in Cebu...cloudy one day, overcast and smoggy the next !!

#10 Xalell3000

Xalell3000
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:24 AM

Posted 14 February 2014 - 03:00 PM

Hi Condobloke!

 

Your fix worked.  You are the best.  I apologize I didn't get to this sooner, but I got laid off from my job.  The CEO who probably makes millions shipped the jobs to the Philippines.  The governments seriously need to tax the top 1% like they do in Europe or we'll all be living in cardboard boxes.  I read how you have the same issues in Australia.

 

http://www.nydailynews.com/news/world/billionaire-gina-rinehart-sparks-controversy-2-a-day-pay-remark-article-1.1152735

 

We've had the coldest winter in 30 years here in Minnesota!

 

Thanks again!  I appreciate your help!



#11 Condobloke

Condobloke

  • Members
  • 1,673 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australian Outback....middle of nowhere....
  • Local time:04:24 PM

Posted 14 February 2014 - 04:27 PM

You are most Welcome !

 

Please run these to clean up :

 

Please download TFC, or Temp File CleanerTFC, by Old Timer
Usage Instructions:

Download TFC from the download link above and save the file on your desktop.
Close ALL running applications as TFC will terminate them before attempting to clean up the temporary files.
Double-click on the TFC icon.
When the program opens, click on the Start button. TFC will terminate the Explorer process and all running applications and then begin the process of cleaning out all of your temp folders.
When done, press OK and reboot your computer and finish the cleanup.

 

 

and finally......this scan will take a long time....2 hours + is not unusual....

 

 

Please scan your computer with ESET Online Scanner
Disable active Antivirus and Antimalware programs How To Temporarily Disable Your Anti-virusHow To Temporarily Disable Your Anti-virus
This scan is best performed with Internet Explorer, as it uses ActiveX
If you will not use Internet Explorer, then please read item 3 in this post
1 - Open Internet Explorer and hold down Control (Ctrl) key and click on This Link  to open ESET OnlineScan in a new window.
2 - Click the ESET Online Scanner button.
3 - For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
a - Click on eset.exe  to download the ESET Smart Installer. Save it to your desktop.
b - Double click on the  icon on your desktop.
4 - Check "YES, I accept the Terms of Use."
5 - Click the Start button.
6 - Accept any security warnings from your browser.
7 - Under scan settings, check "Scan Archives" and "Remove found threats"
8 - Click Advanced settings and select the following:
* Scan potentially unwanted applications
* Scan for potentially unsafe applications
* Enable Anti-Stealth technology
9 - ESET will then download updates for itself, install itself, and begin scanning your computer.
10 - Please be patient as this will take some time (first time scans are always longer).
11 - When the scan completes, click List Threats
12 - Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
13 - Click the Back button and then Click the Finish button.
NOTE:Sometimes if ESET finds no infections it will not create a log.
If you lose the log it can be found at C:\Program Files\ESET\EsetOnlineScanner\log.txt
If no infections are found then please tell me -
You can ignore any ESET detection of AdwCleaner...it is a false positive detection.

 

 

 

 

 


Condobloke

Outback Australia.

 

Currently in Cebu...cloudy one day, overcast and smoggy the next !!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users