Infected with tencentdl Malware

Hi There,

 

I am currently infected with tencentdl Malware.  I have tried running Malwarebytes and it has removed files/keys in the hundreds but it doesn't seem to stop the spread of this thing.  I am in need of some more expert help.  I believe Malwarebytes got rid of some of it, but there still seems to be a bunch of Asian stuff popping up and it's very tough to do anything in an internet browser right now (thank god for Ad-block)

 

Computer: Windows 8.1

 

I will wait for a reply and thanks in advance for the help!

 

Regards,

Centuck

Hi Centuck

My name is Aura and I'll be assisting you with your issue. Follow the instructions below please.

MiniToolBox

• Download MiniToolBox and move the file to your Desktop;
• Right-click on MiniToolBox.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• Check the following options:
  • Flush DNS;
  • Report IE Proxy Settings;
  • Reset IE Proxy Settings;
  • Report FF Proxy Settings;
  • Reset FF Proxy Settings;
  • List content of Hosts;
  • List IP Configuration;
  • List Winsock Entries;
  • List Last 10 Event Viewer Errors;
  • List Installed Programs;
  • List Devices - Only Problems;
  • List Users, Partitions and Memory size;
    
• Once this is done, click on Go and wait for the scan to complete;
• Once the scan is complete, a log will open. Please copy/paste the content of the output log in your next reply;

Since you already ran Malwarebytes, I would like to see your previous Scan log. Open Malwarebytes and go under the History tab. From there, click on Application logs in the left pane.

Click on the most recent (usually at the top) Scan log to open it. From there, click on the Export button and select the first option, Copy to Clipboard

Paste the content of your clipboard in your next reply.

Thank you for the quick reply.  I ran Malwarebytes 3 times and it found stuff all 3 times.  1st time I didn't have scan for rootkits enabled.  

 

Here are the logs you requested:

 

 

Edited by Centuck, 03 February 2016 - 06:41 PM.

Installed programs from MiniToolBox are listed in the attached txt file.  The forum wouldn't let me post it.  Probably because of the Asian/Foreign lettering.

 

**EDIT Nevermind I don't know how to attach files.

Edited by Centuck, 03 February 2016 - 06:45 PM.

This is a lot of detections indeed. Can you try to copy/paste the list of installed programs on Pastebin.com, and post the URL to the paste here? You cannot attach anything in that section, hence why you can't find how to proceed with it.

I think it lost all the asian lettering now... but here it is.  

 

http://pastebin.com/GprrP2wq

What language is set on your system? Also, what language do you usually install your programs in?

Canadian English.

Do you know how programs in another language ended up on your system? Did you install them, or did you ever install language packs for them?

No.  They must have gotten on because of the Malware.  I'm guessing Malwarebytes got rid of whatever was installing stuff on my computer, but there are still a couple programs I can't delete from my system.  

 

Services that I know don't belong:

 

QQRepair1259 - QQRepair1259

QQPCRTP - QQPCMgr RTP Service

 

Programs I know don't belong:

 

Asian Lettering - Tencent - C:\Program Files (x86)\Tencent\QQPCMgr\11.2.17063.223

Asian Lettering - Asian Lettering - C:\Program Files (x86)\Baidu\BaiduAn\4.0.0.8029

YTDownloader - YTDownloader - C:\Program Files (x86)\YTDownloader

 

I have tried to delete these programs and/or delete their folders but windows says I require admin priviledges even though I'm on the only user on my laptop to my knowledge.

Edited by Centuck, 04 February 2016 - 05:27 PM.

YTDownloader shows as an installed program, can you uninstall it? Let's see if AdwCleaner and JRT can get rid of them.

Junkware Removal Tool (JRT)

• Download Junkware Removal Tool (JRT) and move it to your Desktop;
• Right-click on JRT.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• Press on any key to launch the scan and let it complete;
  
  Credits : BleepingComputer.com
• Once the scan is complete, a log will open. Please copy/paste the content of the output log in your next reply;

AdwCleaner - Fix Mode

• Download AdwCleaner and move it to your Desktop;
• Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• Accept the EULA (I accept), let the database update, then click on Scan;
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Cleaning button. This will kill all the active processes;
  
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it;
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply;

Your next reply(ies) should therefore contain:

• Copy/pasted JRT log;
• Copy/pasted AdwCleaner clean log;

I was actually already using the adware removal lol.  Here are the results:

 

I only have one of the things left located in C:\Program Files (x86)\Baidu\BaiduAn\4.0.0.8029.  

 

Edited by Centuck, 04 February 2016 - 06:11 PM.

Baidu really looks installed on your system. If you navigate in the Baidu folder and subfolders, do you see any file called setup.exe, uninstall.exe, unins.exe, uninst.exe, etc.?

There is an uninst.exe but if I run it, it brings up a screen with just Asian characters so I have no clue how to navigate.

 

Nevermind, I just got it installed by process of elimination.  Let me see if there are any other issues left on my computer.

Edited by Centuck, 04 February 2016 - 06:28 PM.

So you uninstalled Baidu successfully?