Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Is Lightshot and Skillbrains malware/trojan/virus?

  • Please log in to reply
1 reply to this topic

#1 222sdfsd


  • Members
  • 1 posts
  • Local time:10:10 AM

Posted 26 March 2018 - 07:49 AM

I’m not a computer expert by any means but noticed something suspicious I’d like to get help with. I ran antivirus/malware scans by 4 different highly respected international companies and none found anything on my computer so how this keeps happening is even stranger to me.

I used to have a program called Lightshot--by Skillbrains. Upon installation it asked if I wanted to install/use Yandex.ru. I declined. I later uninstalled Lightshot.

But long after uninstalling everything I noticed something very odd by complete accident.
My computer no longer has IE installed. However the IE cookie folder remains. After manually emptying the IE cookie folder a few days ago I found 3 cookies being automatically and simultaneously installed there on a daily basis no matter what I did or didn’t do on my computer during that day. Strangely they were always installed in the middle of the night when I was dead asleep but the computer may have been left on.

Those cookies belonged to, you guessed it, yandex.ru (which I NEVER use), Skillbrains (Lightshot maker), and prntscr.com (also Lightshot). I do not browse those websites and do not have any software (that I’m aware of) installed on my computers by that company.

Somebody, tell me, how is this not malware? Barring full reinstall of my OS how do I get rid of this bs?
Given all of this I highly doubt this is all Skillbrains/Lightshot did to my computer. I wouldn’t be shocked if they’ve got even more serious spyware installed that I didn’t have the good fortune of accidentally discovering yet.

BC AdBot (Login to Remove)


#2 buddy215


  • Moderator
  • 13,395 posts
  • Gender:Male
  • Location:West Tennessee
  • Local time:03:10 AM

Posted 26 March 2018 - 08:18 AM

Welcome to BC...


Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'setup-lightshot.exe'


You didn't list the programs you scanned with so if you haven't used the ones below recently then use them to scan.


Use the programs below to clean, remove adware and remove malware.


Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of Google Chrome and Avast.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download


Malwarebytes - Clean Mode

  • Download and install the free version of Malwarebytes
    Note: If you have Malwarebytes already installed, you don't need to install it again. Simply start from the next bullet point
  • Once Malwarebytes is installed, launch it and let it update its database. You might have to click on the little arrow by Scan Status in the middle right pane for it to do so
  • Once the database update is complete, click on the Scan tab, then select the Threat Scan button and click on Start Scan
  • Let the scan run, the time required to complete the scan depends of your system and computer specs
  • Once the scan is complete, make sure that the first checkbox at the top is checked (which will automatically check every detected item), then click on the Quarantine Selected button
    • If it asks you to restart your computer to complete the removal, do so
  • Click on Export Summary after the deletion (in the bottom-left corner) and select Copy to Clipboard. Paste the content in your next reply

Download AdwCleaner by Xplode onto your desktop. (compatible with Windows 7, 8 and 10)

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.


Download and run the FREE online scanner from Free Virus Scan | Online Virus Scan from ESET | ESET

  • Place a checkmark in YES, I accept the Terms of Use, then click Start. Wait for ESET Online Scanner to load its components.
  • Select Enable detection of potentially unwanted applications.
  • Click Advanced Settings, then place a checkmark in the following:
    • Remove found threats
    • Scan archives
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Click Start to begin scanning.
  • ESET Online Scanner will start downloading signatures and scan. Please be patient, as this scan can take quite some time.
  • When the scan is done, click List threats (only available if ESET Online Scanner found something).
  • Click Export, then save the file to your desktop.
  • Click Back, then Finish to exit ESET Online Scanner.

Edited by buddy215, 26 March 2018 - 10:31 AM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users