*solved* I need help *don’t use this software* its a keylogger spy!

[Gamezertruth]

hey

I have a big problem with damn Chinese antivirus so I ask for help to removing a Chinese antivirus Program(a keylogger spy) that spy on your laptop camera!

[Gamezertruth]

AVZ Antiviral Toolkit log; AVZ version is 4.43
Scanning started at 03.08.2015 19:09:42
Database loaded: signatures - 297605, NN profile(s) - 2, malware removal microprograms - 56, signature database released 03.08.2015 16:00
Heuristic microprograms loaded: 394
PVS microprograms loaded: 9
Digital signatures of system files loaded: 749467
Heuristic analyzer mode: Medium heuristics mode
Malware removal mode: enabled
Windows version is: 6.1.7601, Service Pack 1 "Windows 7 Ultimate" ; AVZ is run with administrator rights
System Restore: enabled
1. Searching for Rootkits and other software intercepting API functions
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section .text
 Analysis: ntdll.dll, export table found in section .text
 Analysis: user32.dll, export table found in section .text
 Analysis: advapi32.dll, export table found in section .text
 Analysis: ws2_32.dll, export table found in section .text
 Analysis: wininet.dll, export table found in section .text
 Analysis: rasapi32.dll, export table found in section .text
 Analysis: urlmon.dll, export table found in section .text
 Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
 Driver loaded successfully
 SDT found (RVA=16CB00)
 Kernel ntkrnlpa.exe found in memory at address E3255000
   SDT = E33C1B00
   KiST = E32D3F6C (401)
Function NtAlpcSendWaitReceivePort (27) intercepted (E34AB887->B65F3CA0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtAssignProcessToJobObject (2B) intercepted (E3458064->B65F4DB0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateFile (42) intercepted (E34A8ABE->B65F3310), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateKey (46) intercepted (E3459FAF->B65F2DC0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateProcess (4F) intercepted (E353651B->B65F4770), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateProcessEx (50) intercepted (E3536566->B65F4670), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateSection (54) intercepted (E347C66B->B65F3FF0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateSymbolicLinkObject (56) intercepted (E345A97A->B65F4420), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateThread (57) intercepted (E3536322->B65F3900), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateThreadEx (58) intercepted (E34CA157->B65F4B00), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtCreateUserProcess (5D) intercepted (E34C7FEE->B65F4E70), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtDeleteFile (66) intercepted (E33F15E4->B65F3E60), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtDeleteKey (67) intercepted (E34449C5->B65F34F0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtDeleteValueKey (6A) intercepted (E3436368->B65F35B0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtDeviceIoControlFile (6B) intercepted (E34CD3FB->B65F3BA0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtDuplicateObject (6F) intercepted (E348ACA3->B65F39F0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtEnumerateValueKey (77) intercepted (E34C2916->B65F3820), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtGetNextProcess (8B) intercepted (E35382DC->B65F4C10), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtGetNextThread (8C) intercepted (E34E6D66->B65F4930), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtLoadDriver (9B) intercepted (E341EAF1->B65F3AE0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtOpenKeyEx (B7) intercepted (E3469193->BC1EA620), hook C:\Windows\system32\drivers\qutmipc.sys
Function NtOpenProcess (BE) intercepted (E346B093->BC12838A), hook C:\Windows\System32\drivers\zamguard32.sys
Function NtOpenSection (C2) intercepted (E34C30CB->B65F3F20), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtOpenThread (C6) intercepted (E34B7791->B65F4860), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtProtectVirtualMemory (D7) intercepted (E349BC79->B65F4340), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtQueryValueKey (10A) intercepted (E34A3CE3->B65F3740), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtQueueApcThread (10D) intercepted (E3454DE8->B65F4F80), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtRenameKey (122) intercepted (E34F5E4B->B65F45B0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtRequestWaitReplyPort (12B) intercepted (E349714A->B65F3670), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtRestoreKey (12E) intercepted (E34EBA5D->B65F5060), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtSetContextThread (13C) intercepted (E3537B8D->B65F44F0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtSetInformationFile (149) intercepted (E34B018F->B65F2F70), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtSetSecurityObject (15B) intercepted (E345A7AB->B65F5130), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtSetSystemInformation (15E) intercepted (E34A79C8->B65F3D90), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtSetValueKey (166) intercepted (E34635AC->B65F3150), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtSuspendThread (16F) intercepted (E34EEF23->B65F40E0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtSystemDebugControl (170) intercepted (E34DF5B6->B65F4260), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtTerminateProcess (172) intercepted (E34B4429->BC128444), hook C:\Windows\System32\drivers\zamguard32.sys
Function NtTerminateThread (173) intercepted (E34D237A->B65F41A0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtUnmapViewOfSection (181) intercepted (E34BE04A->B65F4CF0), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtWriteFile (18C) intercepted (E34C8ED2->B65F3050), hook C:\Windows\System32\drivers\Bhbase.sys
Function NtWriteVirtualMemory (18F) intercepted (E34B9126->B65F3230), hook C:\Windows\System32\drivers\Bhbase.sys
Functions checked: 401, intercepted: 42, restored: 0
1.3 Checking IDT and SYSENTER
 Analyzing CPU 1
 Analyzing CPU 2
 Analyzing CPU 3
 Analyzing CPU 4
 Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
 Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking IRP handlers
 Driver loaded successfully
 Checking - complete
2. Scanning RAM
 Number of processes found: 51
 Number of modules loaded: 583
Scanning RAM - complete
3. Scanning disks
C:\Users\b\AppData\Local\Epic Privacy Browser\Application\40.0.2214.91\libegl.dll >>> suspicion for Trojan-PSW.Win32.Sinowal.n ( 0B505210 07CFC386 001CF588 00234CCC 73728)
File quarantined succesfully (C:\Users\b\AppData\Local\Epic Privacy Browser\Application\40.0.2214.91\libegl.dll)
4. Checking  Winsock Layered Service Provider (SPI/LSP)
 LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
C:\Program Files\360\360Safe\safemon\360UDiskGuard.dll --> Suspicion for Keylogger or Trojan DLL
C:\Program Files\360\360Safe\safemon\360UDiskGuard.dll>>> Behaviour analysis
 Behaviour typical for keyloggers was not detected
File quarantined succesfully (C:\Program Files\360\360Safe\safemon\360UDiskGuard.dll)
Note: Do NOT delete suspicious files, send them for analysis  (see FAQ for more details),  because there are lots of useful hooking DLLs
6. Searching for opened TCP/UDP ports used by malicious software
 Checking - disabled by user
7. Heuristic system check
Checking - complete
8. Searching for vulnerabilities
>> Services: potentially dangerous service allowed: TermService (Remote Desktop Services)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery)
>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
Checking - complete
9. Troubleshooting wizard
Checking - complete
Files scanned: 66026, extracted from archives: 31852, malicious software found 0, suspicions - 1
Scanning finished at 03.08.2015 19:24:22
Time of scanning: 00:14:41
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://forum.kaspersky.com/index.php?showforum=19
For automatic scanning of files from the AVZ quarantine you can use the service http://virusdetector.ru/

[Julian]

oooooh I remember this one I saw is on a customers laptop last week. I used malware bytes to clean up all the malware ran it like 6 times in safe mode kept finding new things then I used hijack this to find those specific entries! It was annoying but that should be a start gamez!

[Samson]

"A Chinese antivirus Program"   

http://www.itproportal.com/2015/05/02/qihoo-360-antivirus-tool-stripped-of-awards-after-cheating/

[Gamezertruth]

oooooh I remember this one I saw is on a customers laptop last week. I used malware bytes to clean up all the malware ran it like 6 times in safe mode kept finding new things then I used hijack this to find those specific entries! It was annoying but that should be a start gamez!

Well it seems I am in trouble since I try to remove this program, but when I try to uninstall it it gives an error message (but I can not understand the message)
I also have another program, a very strong program, which has uninstall software feature (but that feature is for professional version) However, the program is used by found the remains of this program but need to register!

I have finished running multiple anti-virus anti-malware/antis-payware , however no anti-virus/anti-malware/antis-payware found any piece of that program except some Adware and virus!

After multiple infections, the computer has become action Oddly And it became the whole system does not respond and remains stuck for some time! and Internet connection began dropping badly today!

so I power on my laptop today and I was playing around and Suddenly Windows language pack has been removed from my system while I’m typing! and I have to checked that aside with going to Control Panel language options I've found that some of the "language packs" which I used were removed! (There is only a Chinese package ?) very wired  In addition, a personal files and programs icons have gone from desktop ?

I almost forget to mention that some of the Windows Services was hijacked just like (Window folders and file formats and etc.)

[Gamezertruth]

"A Chinese antivirus Program"   

http://www.itproportal.com/2015/05/02/qihoo-360-antivirus-tool-stripped-of-awards-after-cheating/

lol ! so you are with or Against Chinese software !

[Rick]

"A Chinese antivirus Program"   

http://www.itproportal.com/2015/05/02/qihoo-360-antivirus-tool-stripped-of-awards-after-cheating/

lol ! so you are with or Against Chinese software !

so much spam crosses my path from email scammers, I would have to say, they have a lot to learn morally on the subject.

search; remove 360

that will do the trick; but a re-install after any chinese software might be a safer solution!
Upgrade won't work in this case...

[Gamezertruth]

"A Chinese antivirus Program"   

http://www.itproportal.com/2015/05/02/qihoo-360-antivirus-tool-stripped-of-awards-after-cheating/

lol ! so you are with or Against Chinese software !

so much spam crosses my path from email scammers, I would have to say, they have a lot to learn morally on the subject.

search; remove 360

that will do the trick; but a re-install after any chinese software might be a safer solution!
Upgrade won't work in this case...

the same things but with spamming webpages for a fake downloaded! Reinstall the program makes things worse! (Get the system freezes for the first time) and due to the presence of a new version! (shutdown program option was to change somewhere in the program) so I really don’t know where the option goes in and still don’t understand the Language of the program

edit : I will give it a try with this software http://www.ursoftware.com/

[Gamezertruth]

anybody can help to which button to make uninstall ?

[Gamezertruth]

Re-install the software for the second time, and uninstall it using the Your Uninstaller program and this Chinese crap is still running ... I need help with it

[Gamezertruth]

more screenshots of the problems ....

[jraju]

Hi, Gamez,
                 Did you try revo uninstaller free . Please select the 4th option, once you select uninstall icon and then select uninstall. When it opens choose the 4th option downunder and then click. First, it would give you the option of uninstall from the software. Then after it is done, the program may urge you to reboot. Do not reboot and cancel and select next. then click next and The revo uninstaller then scan the system for registry entries of the program. Please choose the BOLD items, only bold items and then click delete. If the screen does not close, try to expand the path shown and select the shown bold items and click delete.
                                 Then click next, it shows the program paths and residue files. Just select all and click delete. clicking next would show you success message.
                                          After this is done, please reboot. to get rid of nasty programs.
http://www.revouninstaller.com/revo_uninstaller_free_download.html
download free version. it is enough. There are stil more options in the right click menu choose accordingly.

[Julian]

run mbam a couple times in safe mode next is go to msconfig and disable the services and startup for that program then try uninstalling. it is picky trust me I seen that program a lot this past month in multiple languages. here I use this and choose the force delete http://www.iobit.com/en/advanceduninstaller.php

[Gamezertruth]

jraju and Julian@ I have tried it and go to programs and features, but that program is not listed? So I've download several uninstall programs, however this program is still not listed!
However going to msconfig isn’t really help so have a problem since a malware services is re-enable itself ! here is a video https://youtu.be/z8r_GRyt5Bo 

[Julian]

hmmm alright so here is a use full tool just run in safe mode. and make sure to remove the right thing not the wrong a/v

http://support.eset.com/kb146/?locale=en_US

And here is a link to there online scanner I think its one of the most powerfull out there.

http://www.eset.com/us/online-scanner/

[Gamezertruth]

I just ran eset av remover tool but unable to detected 360 rogue program and only show Mbam for my

and I’m now run a scan with eset online scanner

[Gamezertruth]

it look like a rogue program http://www.im-infected.com/rogue/360-total-security-virus-removal.html

[Samson]

What was it that made you think that it was a good AV to install in the first place?

[Julian]

I dont think he installed this on purpose ive seen this in a Trojan dropper. If i can get a copy of this trojan i can pick it apart and make a removal this program acts like the blackwin trojan and the smithe fraud trojan annoying as heck usually wants personal info for identify theft/money im gonna personally infect a vm of mine to compare files and registry keys that have been modified. Then pick it apart and find how this works.

[Samson]

I dont think he installed this on purpose

From what I can understand, Gamez has installed it (more than once) of his own choice. I may be wrong, but that is how I read it.

Re-install the software for the second time, and uninstall it using the Your Uninstaller program and this Chinese crap is still running ... I need help with it

[Julian]

Gamez if you installed that on purpose i highly recommended to do all software testing in a virtualmachine environment or if you dont have a virtual machine os pm me a link to the download and ill test software for you and tell you haha dont make a post of links because for the safety of other users lol

[Gamezertruth]

What was it that made you think that it was a good AV to install in the first place?

I did not think so! Probably I got bundle with potentially unwanted software somehow when I type "MBR fix" on Google and I've been thinking that it was a clean program.(but I’m wrong it was an online setup to install a lot of crap and that was some of Chinese sites and English sites )

[Gamezertruth]

I dont think he installed this on purpose ive seen this in a Trojan dropper. If i can get a copy of this trojan i can pick it apart and make a removal this program acts like the blackwin trojan and the smithe fraud trojan annoying as heck usually wants personal info for identify theft/money im gonna personally infect a vm of mine to compare files and registry keys that have been modified. Then pick it apart and find how this works.

yes You are correct  I don’t install that AV but i got bundle with it somehow and I really I can do anything because of some setup have no option To cancel the installation

[Gamezertruth]

I dont think he installed this on purpose

From what I can understand, Gamez has installed it (more than once) of his own choice. I may be wrong, but that is how I read it.

Re-install the software for the second time, and uninstall it using the Your Uninstaller program and this Chinese crap is still running ... I need help with it

yes that right because Rick have ask my to search for "remove 360" and i get that link which they saying the best way to remove this thing is to re-installed http://www.tomsguide.com/answers/id-2350774/360-total-security-malware-removal.html

[Gamezertruth]

Gamez if you installed that on purpose i highly recommended to do all software testing in a virtualmachine environment or if you dont have a virtual machine os pm me a link to the download and ill test software for you and tell you haha dont make a post of links because for the safety of other users lol

no I don’t installed that AV myself but as I said i got this crap install it with other software ! and I don’t have a virtual-machine for test so I’ll PM you with links  - )
and thank you Julian for nice help