(cache) Solved - Chinese ucdrv malware | PC Help Forum
  1. Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Virus removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
    Dismiss Notice

Solved Chinese ucdrv malware

Discussion in 'Malware Removal' started by srkzzzi, Feb 16, 2017.

Thread Status:
Not open for further replies.
  1. srkzzzi

    srkzzzi PCHF Member PCHF Member

    Joined:
    Feb 16, 2017
    Messages:
    5
    Here are the logs once again

    FRST.txt

    Addition.txt

     

    Attached Files:

    Last edited by a moderator: Feb 17, 2017
    Malnutrition likes this.
  2. Malnutrition

    Malnutrition PCHF Malware School Teacher PCHF Malware Teacher PCHF Member PCHF Security Team

    Joined:
    Jul 22, 2016
    Messages:
    1,688
    Alright, It will take me a while to look these over.

    Run this scan while you wait for me. :)

    Zemana Scan.

    Please download Zemana AntiMalware and save it to your Desktop.
    • Install the program and once the installation is complete it will start automatically.
    • Click the Cog/Sproket Wheel, [​IMG] at the top right of Zemana
    • Select Advanced - I have read the warning and wish to proceed.
    • Place a tick next to Detect Suspicious (Root CA) Certificates.
    • Then click the house icon in Zemana.
    • Then, press Scan to begin.
    • After the short scan is finished, if threats are detected press Next to remove them.
    Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
    • Open Zemana AntiMalware again.
    • Click on [​IMG] icon and double click the latest report.
    • Now click File > Save As and choose your Desktop before pressing Save.
    • The only left thing is to Copy Paste saved report in your next message.
    • This will open a logfile, post that in your next reply
    File Search With Everything Search Engine.

    Download and install the Everything Search Engine
    Right Click Run As Admin. Type or Copy Paste UCBrowser into search window.
    Then Click Edit. >>>Select all.
    Right Click highlighted items>>>>>>>> Copy full name to clipboard.
    Paste content of clipboard, here in your next reply.
     
  3. srkzzzi

    srkzzzi PCHF Member PCHF Member

    Joined:
    Feb 16, 2017
    Messages:
    5
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\Browsers\ucbrowser.browser
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\Browsers\ucbrowser.browser
    C:\Windows\WinSxS\amd64_netfx4-browser_files_b03f5f7f11d50a3a_4.0.14305.0_none_ca91f5e702314acf\ucbrowser.browser
    C:\Windows\WinSxS\x86_netfx4-browser_files_b03f5f7f11d50a3a_4.0.14305.0_none_123f2cbe16ad73d5\ucbrowser.browser
    C:\Windows\Prefetch\UCBROWSER.EXE-E739332C.pf
    C:\Users\Tuf Tuf\AppData\Local\Temp\UCBrowserSecureUpdater.xml
    C:\Windows\Temp\UCBrowserSecureUpdater.xml
     

    Attached Files:

  4. Malnutrition

    Malnutrition PCHF Malware School Teacher PCHF Malware Teacher PCHF Member PCHF Security Team

    Joined:
    Jul 22, 2016
    Messages:
    1,688
    Remove the programs below with Geek Uninstaller. If something will not uninstall, then use Force Mode.


    µTorrent (HKU\S-1-5-21-4011794534-997363082-2150810316-1001\...\uTorrent) (Version: 3.4.9.43295 - BitTorrent Inc.)
    Advanced SystemCare 9 (HKLM-x32\...\Advanced SystemCare_is1) (Version: 9.4.0 - IObit)
    Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
    IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 5.4.0.125 - IObit)
    Smart Defrag 5 (HKLM-x32\...\Smart Defrag_is1) (Version: 5.4.0 - IObit)

    FRST Fix.

    Click Here to Download Fixlist.

    Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  5. srkzzzi

    srkzzzi PCHF Member PCHF Member

    Joined:
    Feb 16, 2017
    Messages:
    5
    here's the log.

     

    Attached Files:

    Last edited by a moderator: Feb 17, 2017
  6. Malnutrition

    Malnutrition PCHF Malware School Teacher PCHF Malware Teacher PCHF Member PCHF Security Team

    Joined:
    Jul 22, 2016
    Messages:
    1,688
    Any problems now?
     
  7. srkzzzi

    srkzzzi PCHF Member PCHF Member

    Joined:
    Feb 16, 2017
    Messages:
    5
    No not anymore, i can't thank you enough man. Mad respect. Have a great day and thanks once more!
     
    jmarket and Malnutrition like this.
  8. Malnutrition

    Malnutrition PCHF Malware School Teacher PCHF Malware Teacher PCHF Member PCHF Security Team

    Joined:
    Jul 22, 2016
    Messages:
    1,688
    Glad to have helped!! Please tell a friend ...... or two about us. [​IMG]

    Optimize your internet connection.

    Click here for instructions.


    suggest the following in place of adblock.
    Alternate DNS Server. Ad Blocking DNS.
    Ublock Origin.
    Anti Ad Block Killer.



    Also, keep your browsing private with these tools:

    Self Destructing Cookies.
    Self Destructing Cookies Chrome.





    Some items to keep you safe on the internet.


    VooDoo Shield. control of what is running on your machine
    Qualys BrowserCheck
    To update plugins.
    Web Of Trust To Avoid Shady Websites.
    Unchecky To Avoid Bundled Software.
    Privazer To Clean up your mahcine.



    Now Lets Clean up the tools we used and remove old restore points.



    Download DelFix by "Xplode" to your Desktop.
    Right Click the tool and Run as Admin ( Xp Users Double Click)
    Put a check mark next the items below:


    Remove disinfection tools
    Create registry backup
    Purge System Restore




    Now click on "Run" button.
    allow the program to complete its work.
    all the tools we used will be removed.
    Tool will create and open a log report (DelFix.txt)
    Note: The report can be located at the following location C:\DelFix.txt
     
  9. srkzzzi

    srkzzzi PCHF Member PCHF Member

    Joined:
    Feb 16, 2017
    Messages:
    5
    I'll tell my friends about you bcs of your awesome help, and thanks for the aditional programs. Best of luck to you.
     
    jmarket and Malnutrition like this.
Thread Status:
Not open for further replies.