Chinese program, Maohawifi, Automatic Butler ETC.

I tried my best deleting some of the files and ending the services before it went on for too long, but im afraid i havent done much at all. Some of the newly installed programs dont appear on "Uninstall Programs". I even deleted some stuff off the regedit and removed the apps from going through firewall as it made itself exceptions. Hope i didnt bleep up somewhere.

One program replaced the default opening of .zip, .7z, .cab files.

Im a complete newbie here.

 

to BleepingComputer.

Hi there,

my name is Jo and I will help you with your computer problems.

Please follow these guidelines:

• Read and follow the instructions in the sequence they are posted.
• print or copy & save instructions.
• back up all your private data / music / important files on another (external) drive before using our tools.
• Do not install / uninstall any applications, unless otherwise instructed.
• Use only that tools you have been instructed to use.
• Copy and Paste the log files inside your post, unless otherwise instructed.
• Ask for clarification, if you have any questions.
• Stay with this topic til you get the all clean post.
• My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

***

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  Vista / Windows 7/8 users right-click and select Run As Administrator.

• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

***

Temporarily disable your AV program so it does not interfere.
Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides.

Download Zoek tool from here

When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator
(it takes a few seconds to appear.)

Next, copy/paste the entire script inside the code box below to the input field of Zoek:

createsrpoint;
filesrcm; 
uninstall-list;
iedefaults;
ffdefaults;
chrdefaults;
emptyclsid;
emptyalltemp;
autoclean;

Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

Copy and paste the log to your next reply please.
 

***

i am running windows 10 does that "Security Check" file still apply?

Should I set a restore point?

 

FRST

i am running windows 10 does that "Security Check" file still apply?

Should I set a restore point?

It should work on Win 10

Yes: Enable System Restore and set a restore Point.

zoek has been running for 40minutes now, it hasnt closed/produced a txt file. Should i restart? 

ok, restart and see what happens.

i cant, it keeps reopening itself, i press close, end task in task manager. It keeps running. 

Ignore ZOEK and try to end/shut down Windows please and restart then.

i did that and its been 10 minutes zoek is still running. My PC seems fine now though, im worried some of the malware is hidden

 

zoek doesnt seem to work for me. 

ok, leave ZOEK alone...
 

***

Copy FRST / FSRT64.exe to your desktop!

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
Save it in the same location as / FSRT / FSRT64 (usually your desktop) as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-4214910342-2877779051-553598100-1001\...\Run: [msiql] => C:\Users\Ame\AppData\Local\Temp\00009230\msiql.exe [2072064 2017-01-22] () <===== ATTENTION
HKU\S-1-5-21-4214910342-2877779051-553598100-1001\...\Run: [msiql] => C:\Users\Ame\AppData\Local\Temp\00009230\msiql.exe [2072064 2017-01-22] <===== ATTENTION
HKU\S-1-5-21-4214910342-2877779051-553598100-1001\...\MountPoints2: {0bbd4b75-c909-11e6-af50-ebab5c7818d6} - "F:\setup.exe" 
HKU\S-1-5-21-4214910342-2877779051-553598100-1001\...\MountPoints2: {e62c46fd-77cd-11e6-af12-507b9dd00ef5} - "E:\setup-multi2.exe" 
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [No File]
S2 GoogleChromeUpService; C:\ProgramData\service.exe [1620992 2017-01-22]  <==== ATTENTION
S2 MaohaWifiSvr; D:\Program Files (x86)\Maoha\MaohaAP\MaohaWifiSvr.exe [X]
S4 McMPFSvc; "C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]
R3 WdNisSvc; "%ProgramFiles%\Windows Defender\NisSrv.exe" [X]
R3 WdNisSvc; "C:\Program Files\Windows Defender\NisSrv.exe" [X]
R2 WinDefend; "%ProgramFiles%\Windows Defender\MsMpEng.exe" [X]
R2 WinDefend; "C:\Program Files\Windows Defender\MsMpEng.exe" [X]
S3 WMPNetworkSvc; "%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe" [X]
S3 WMPNetworkSvc; "C:\Program Files\Windows Media Player\wmpnetwk.exe" [X]
U1 ucdrv; C:\Program Files (x86)\UCBrowser\Security:ucdrv-x64.sys [23652 ] (UC Web Inc.) <==== ATTENTION
S3 dbx; system32\DRIVERS\dbx.sys [X]
R4 KuaiZipDrive; \??\C:\Windows\system32\drivers\KuaiZipDrive.sys [X]
R4 KuaiZipDrive; C:\Windows\system32\drivers\KuaiZipDrive.sys [X]
C:\Users\Ame\AppData\Local\Temp\0Uninst.exe
C:\Users\Ame\AppData\Local\Temp\1Uninst.exe
2016-09-11 10:42 - 2016-12-29 06:51 - 0102912 _____ () C:\Users\Ame\AppData\Local\Temp\bitool.dll
2016-09-11 10:42 - 2016-12-29 06:51 - 0102912 _____ C:\Users\Ame\AppData\Local\Temp\bitool.dll
2016-11-18 20:10 - 2016-11-18 20:10 - 0737856 _____ (Oracle Corporation) C:\Users\Ame\AppData\Local\Temp\jre-8u111-windows-au.exe
2017-01-22 17:50 - 2017-01-22 17:50 - 0210840 _____ () C:\Users\Ame\AppData\Local\Temp\mininewsrepair.exe
2017-01-22 17:50 - 2017-01-22 17:50 - 0210840 _____ C:\Users\Ame\AppData\Local\Temp\mininewsrepair.exe
2016-09-10 00:53 - 2016-09-10 00:54 - 58093736 _____ (SweetLabs,Inc.) C:\Users\Ame\AppData\Local\Temp\oct296A.tmp.exe
2017-01-18 18:52 - 2017-01-18 18:53 - 54267784 _____ (SweetLabs,Inc.) C:\Users\Ame\AppData\Local\Temp\oct491B.tmp.exe
2016-10-15 08:30 - 2016-10-15 08:30 - 57270728 _____ (SweetLabs,Inc.) C:\Users\Ame\AppData\Local\Temp\octD305.tmp.exe
HKU\S-1-5-21-4214910342-2877779051-553598100-1001\...\ChromeHTML: -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) <==== ATTENTION
Task: {8DDE53B3-68BD-4E70-A7BB-CA98ACC79238} - System32\Tasks\WindowsUpda2ta => C:\Users\Ame\AppData\Roaming\MICROSOFT\am.js [2016-10-10] <==== ATTENTION
Task: C:\Windows\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: C:\Windows\Tasks\UCBrowserUpdaterCore.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
ShortcutWithArgument: C:\Users\Ame\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\70873245968a01f1\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"
AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x64.sys [23652]
AlternateDataStreams: C:\Windows\system32\drivers:x64 [1479458]
AlternateDataStreams: C:\Windows\system32\drivers:x86 [1205026]
EmptyTemp:
End

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system

Run FRST / FSRT64 again as Administrator like we did before but this time press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

---

Download and run Chrome Software Cleaner

sorry,

 

Please download Malwarebytes Anti-Rootkit and save it to your desktop.

• Be sure to print out and follow the instructions provided on that same page.
• Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
• Double click on downloaded file. OK self extracting prompt.
• MBAR will start. Click in the introduction screen "next" to continue.
• Click in the following screen "Update" to obtain the latest malware definitions.
• Once the update is complete select "Next" and click "Scan".

With some infections, you may see two messages boxes.

• 'Could not load protection driver'. Click 'OK'.
• 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

• If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
• If there is no malware found, please let me know as well.

***

Please download AdwCleaner by Xplode and save to your Desktop.
Double-click AdwCleaner.exe
Vista / Windows 7/8/10 users right-click and select Run As Administrator.

• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Logfile button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
  If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

***

Edited by Jo*, 23 January 2017 - 09:30 AM.

its system-log not MBAR-log, i assume theyre the same. Found 3

 

Should I press the clean button on both of the program now?