All my devices are hacked,

Closed
sss1967 Posts 9 Registration date Tuesday October 13, 2015 Status Member Last seen October 21, 2015 - Oct 13, 2015 at 09:38 AM
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 - Oct 21, 2015 at 05:05 PM
Hi all,

All my devices hacked by a group of people who I didn't do wrong anything. What ever we do with phone, laptop, computer, they know everything, They even know I wrote this mail. If anyone can help me Please!

10 responses

Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 13, 2015 at 04:44 PM
To help you and prescribe the remedy, I must make a diagnostic and to do so, I require a report.

1. Open this link and download ZHPDiag2 :
https://nicolascoolman.eu
(Don't be alarmed is the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message, ignore it.) Click on the download button

2. Save the file on your Desktop.

3. Double click on ZHPDiag.exe and follow the installation instructions.

(For Vista, Win 7 and 8 users, click right to ensure you execute with admin right)

4. Double click on the short cut ZHPDiag on your Destktop.

5. Click on Full.

Wait for the tool to finished (maybe a long time)

6. Close ZHPDiag.

7. To transmit the report, click on this link :

https://authentification.site

8. Search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt).
9. Copy the url link obtained from Speedyshare and paste it here in your reply.

Ambucias
Moderator and Virus/Security Contributor
0
Dear Ambucias,

Thank you for your reply and advise in just a short time. I try to do as the link you sent to me and save it at my laptop screen then follow all your instructions. When I click on the tool to scan, its does and show that 64 ( Insets ) and when I click on Repair then the screen was gone. I try to do that so many times but it happened the same. I checked at control panel and downloaded list, I didn't even seen that I had download them. I check them at Recycle bin also, but nothing there.
I try to download ZHPCleaner, ZHPDIA 15 too, all happened the same, but when I click Repair on ZHPDIA 15 Repair it took me to http://www.forum.nicolascoolman.fr/analyse-rapports-desinfection.html. I don't know what to do. The one thing strange is whenever I try to shut down my laptop I saw msg said " you and other user might lose the documents that you haven't save yet. "
Any idea dear ? Looking foward to seeing your reply again.

sss1967
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 14, 2015 at 04:55 AM
Hi

You have not followed my instructions.

You to scan only, upload the report on Speedyshare and post the url here for me to fetch the report so that I can analyse it.
0
sss1967 Posts 9 Registration date Tuesday October 13, 2015 Status Member Last seen October 21, 2015
Oct 14, 2015 at 10:14 PM
Ok, I will do that.

Thank you.
0
sss1967 Posts 9 Registration date Tuesday October 13, 2015 Status Member Last seen October 21, 2015
Oct 15, 2015 at 05:08 AM
http://speedy.sh/GmVfM/ZHPDiag-v2015.docx
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 15, 2015 at 07:08 AM
Thanks

There are 24 malware in your computer.

Follow these instructions to the letter to remove them.

1. Uninstall the following programmes with the Windows add/remove program utility:

C:\Program Files (x86)\bestadblocker
C:\Program Files (x86)\CeutTThePrice
C:\Program Files (x86)\CutThePrriCe

2.Select and copy all of the following bold lines

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
G2 - GCE: Preference [User Data\Default] [aodccmnahdhlpgomigbdlolmapdkglcn] TranslationBuddy
G2 - GCE: Preference [User Data\Default] [mpkhmmacbjndakceaikggpnnnddijeen] PConverter
G2 - GCE: Preference [User Data\Default] [nafaimnnclfjfedmmabolbppcngeolgf] iLivid
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/
O2 - BHO: CeutTThePrice [64Bits] - {064823B5-11E8-4F1C-B4C8-B12B94A925E7} . (...) -- C:\Program Files (x86)\CeutTThePrice\QUsd2KulioqKaj.dll (.not file.)
O2 - BHO: bestadblocker [64Bits] - {1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879} (Orphean)
O42 - Logiciel: CutThePrriCe - (...) [HKLM][64Bits] -- {1DE30A2D-4C8C-2B78-AB3B-88A2944D7CA1}
O42 - Logiciel: bestadblocker - (...) [HKLM][64Bits] -- {4820778D-AB0D-6D18-C316-52A6A0E1D507}
O42 - Logiciel: CeutTThePrice - (...) [HKLM][64Bits] -- {A2C98B47-B5F4-94AA-281D-4135416774CF}
HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware
3 - CFD: 2015/07/25 15:37:07 - [] D -- C:\Program Files (x86)\bestadblocker
3 - CFD: 2015/07/25 15:38:24 - [] D -- C:\Program Files (x86)\CeutTThePrice
3 - CFD: 2015/07/26 00:28:38 - [] D -- C:\Program Files (x86)\CutThePrriCe
O69 - SBI: SearchScopes [HKCU] {33BB0A4E-99AF-4226-BDF6-49120163DE86} - (mystartsearch) - http://www.mystartsearch.com/
C:\Users\San\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{064823B5-11E8-4F1C-B4C8-B12B94A925E7}
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1DE30A2D-4C8C-2B78-AB3B-88A2944D7CA1}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}
C:\Program Files (x86)\bestadblocker
C:\Program Files (x86)\CeutTThePrice
C:\Program Files (x86)\CutThePrriCe


3.ZHP Diag created a short cut on your desktop called ZHP Fix, launch ZHP Fix (For Windows 7 click right to run as admin. Answer yes if you get an enquiry as to wether you want to run it or not.

4.Click on the the Import button and the lines will automatically paste themselves.

5. Click on the Go button to clean

6. Confirm by clicking OK

7. ZHP Fix will ask if you wish to empty the bin, click on your choice...it may take time

8. A report will appear on your desktop and on C:\ZHP\ZHPFix[R1].txt which you can copy and paste in your reply.


Good luck
0
Dear Sir,

I try to do as your instructions. All I should delete are from Window 8, so some didn't allowed me. It took me 4 hours already but I'm not finish yet. So I will do that tomorrow.

I will let you know everything when I am done.

Many thanks,

sss1967.
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170 > sss1967
Oct 15, 2015 at 04:18 PM
Have you used ZHP Fix has I instructed?
0
sss1967 > sss1967
Oct 15, 2015 at 07:36 PM
No, i haven't finish yet. Some data didn't allowed me.to uninstail them. Some data were reinstail themself. What should i do ? But i will try again.
Thanks.
sss1967
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 16, 2015 at 04:26 AM
Hi
Sorry my mistake

Download ZHP Fix here:

https://nicolascoolman.eu

1. Install ZHP Fix

2. Copy these bold lines

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
G2 - GCE: Preference [User Data\Default] [aodccmnahdhlpgomigbdlolmapdkglcn] TranslationBuddy
G2 - GCE: Preference [User Data\Default] [mpkhmmacbjndakceaikggpnnnddijeen] PConverter
G2 - GCE: Preference [User Data\Default] [nafaimnnclfjfedmmabolbppcngeolgf] iLivid
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/
O2 - BHO: CeutTThePrice [64Bits] - {064823B5-11E8-4F1C-B4C8-B12B94A925E7} . (...) -- C:\Program Files (x86)\CeutTThePrice\QUsd2KulioqKaj.dll (.not file.)
O2 - BHO: bestadblocker [64Bits] - {1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879} (Orphean)
O42 - Logiciel: CutThePrriCe - (...) [HKLM][64Bits] -- {1DE30A2D-4C8C-2B78-AB3B-88A2944D7CA1}
O42 - Logiciel: bestadblocker - (...) [HKLM][64Bits] -- {4820778D-AB0D-6D18-C316-52A6A0E1D507}
O42 - Logiciel: CeutTThePrice - (...) [HKLM][64Bits] -- {A2C98B47-B5F4-94AA-281D-4135416774CF}
HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware
3 - CFD: 2015/07/25 15:37:07 - [] D -- C:\Program Files (x86)\bestadblocker
3 - CFD: 2015/07/25 15:38:24 - [] D -- C:\Program Files (x86)\CeutTThePrice
3 - CFD: 2015/07/26 00:28:38 - [] D -- C:\Program Files (x86)\CutThePrriCe
O69 - SBI: SearchScopes [HKCU] {33BB0A4E-99AF-4226-BDF6-49120163DE86} - (mystartsearch) - http://www.mystartsearch.com/
C:\Users\San\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{064823B5-11E8-4F1C-B4C8-B12B94A925E7}
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1DE30A2D-4C8C-2B78-AB3B-88A2944D7CA1}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}
C:\Program Files (x86)\bestadblocker
C:\Program Files (x86)\CeutTThePrice
C:\Program Files (x86)\CutThePrriCe

3. Open ZHP Fix

4. Click on import

5. Click on GO

6. Confirm

7. A report will appear on your desktop and on C:\ZHP\ZHPFix[R1].txt which you can copy and paste in your reply.
0
Dear Sir,

I did step by step as your instructions, after I click confirm, then it was loading and the green line was appear. but in a short time the fourm was gone, I try to open the icon so many times but it couldn't open at all. The line wasn't in the middle. Then I thought I might wrong and install again, but it happen the same. What should I do ?

Thanks in advance.

sss1967
0

Didn't find the answer you are looking for?

Ask a question
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 16, 2015 at 04:37 PM
Tell you what...

1. Download and run this tool:

https://ccm.net/downloads/security-and-maintenance/6911-adwcleaner/

2. After completing the above, generate another ZHPDiag report and upload it on Speedyshare and post the speedyshare url here.

Good luck
0
http://speedy.sh/k8vzr/ZHPDiag-v2015.docx-2nd-report.txt


sss1967
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 17, 2015 at 05:58 AM
Hi

We have progress! You went down from 24 to 8 malware.

Now please see if ZHP Fix will work.

I believe you already know the procedure. Let ZHP Fix work even if it takes a long.

Here are the bold lines to copy and import:

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/
O2 - BHO: CeutTThePrice [64Bits] - {064823B5-11E8-4F1C-B4C8-B12B94A925E7} . (...) -- C:\Program Files (x86)\CeutTThePrice\QUsd2KulioqKaj.dll (.not file.)
O2 - BHO: bestadblocker [64Bits] - {1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879} (Orphean)
HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware
O69 - SBI: SearchScopes [HKCU] {33BB0A4E-99AF-4226-BDF6-49120163DE86} - (mystartsearch) - http://www.mystartsearch.com/
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{064823B5-11E8-4F1C-B4C8-B12B94A925E7}
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879}
0
sss1967 Posts 9 Registration date Tuesday October 13, 2015 Status Member Last seen October 21, 2015
Oct 17, 2015 at 07:10 AM
Dear sir,

Its still the same, Couldn't open it after its gone, I download and install again , and the same too, after gone I can't reopen it. May be I've not donate the owner yet ?

Don't you think so ?

I will show you how mobile was hacking, I can't fix it, but I am sure.

Thank you.

sss1967
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 17, 2015 at 04:29 PM
Please,

Remove ZHP Fix from your computer.

Download it again.

This time, make sure you run it as administrator.

If you get another problem, boot your machine in safe mode and try ZHP Fix again.

Let me know.
0
sss1967 Posts 9 Registration date Tuesday October 13, 2015 Status Member Last seen October 21, 2015
Oct 18, 2015 at 05:45 AM
Hi sir,

, Before I start it Let me ask you first. How about adwcleaner ? just keep it like that or do you want me to do something ?
0
sss1967 Posts 9 Registration date Tuesday October 13, 2015 Status Member Last seen October 21, 2015
Oct 18, 2015 at 07:54 AM
Dear Sir,

Finally, Its work this time, But at first, second, and third times were the same. The fourth times then it was done. Here is the report and I have more laptops. Should I do the same ?

Thank you so much.

sss1967

This is the report,

Rapport de ZHPFix 2015.8.24.7 par Nicolas Coolman, Update du 24/08/2015
Fichier d'export Registre : C:\Users\San\AppData\Roaming\ZHP\ZHPExportRegistry-18-10-2015-10-42-02 PM.txt
Run by San at 18/10/2015 10:41:35 PM
High Elevated Privileges : OK
Windows 8 Home Premium Edition, 64-bit Service Pack 1 (10240)

Recycle Bin emptied (23mn AMs)
Prefetcher emptied

========== Registry keys ==========
REMOVES: CLSID BHO: {064823B5-11E8-4F1C-B4C8-B12B94A925E7}
REMOVES: [HKLM\SOFTWARE\Classes\CLSID\{064823B5-11E8-4F1C-B4C8-B12B94A925E7}]
REMOVES: HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware
REMOVES: SearchScopes :{33BB0A4E-99AF-4226-BDF6-49120163DE86}

========== Registry values ==========
ABSENT value Standard Profile: FirewallRaz :
ABSENT value Domain Profile: FirewallRaz :

========== Elements of the registry data ==========
REMOVES: R1 Search Page = http://www.mysearch123.com/?type=hp&ts=1436950038&z=c950a9f38c4f86587f96ee1gcz6ceqctew2eaeeget&from=wpc&uid=WDCXWD5000LPCX-24C6HT0_WD-WX21A25AUFV5AUFV5

========== Folders ==========
Deletes temporary Windows (3)
REMOVES Flash Cookies (0)

========== Files ==========
Deletes temporary Windows (2) (387 octets)
REMOVES Flash Cookies (0) (0 octets)

========== Other ==========
NON-TREATY 3 - CFD: 2015/07/25 15:37:07 - [] D -- C:\Program Files (x86)\bestadblocker
NON-TREATY 3 - CFD: 2015/07/25 15:38:24 - [] D -- C:\Program Files (x86)\CeutTThePrice
NON-TREATY 3 - CFD: 2015/07/26 00:28:38 - [] D -- C:\Program Files (x86)\CutThePrriCe
NON-TREATY [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{064823B5-11E8-4F1C-B4C8-B12B94A925E7}]
NON-TREATY [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879}]


========== Summary ==========
4 : Registry keys
2 : Registry values
1 : Elements of the registry data
2 : Folders
2 : Files
5 : Other


End of clean in 38mn AMs

========== Path to file report ==========
C:\Users\San\AppData\Roaming\ZHP\ZHPFix[R1].txt - 18/10/2015 10:42:02 PM [1943]
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 18, 2015 at 04:34 PM
Great and thank you for the report.

Last but not least.

1. Click right on Windows Start (small window bottom left corner of your screen. A menu will appear.

2. Click left on programs and functions a window will open with the list of programs installed on your computer.

Search for the following programs, if you see them, delete them. They are malware. Here are the programmes.

bestadblocker
CeutTThePrice
CutThePrriCe


Let me know
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 19, 2015 at 04:51 AM
Hello

Everything was fine but you now have new malware.

Where do you get the stuff? Your Trend Micro antivirus is not the best.

Please run ZHP Fix again with the following bold lines:

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
O2 - BHO: CeutTThePrice [64Bits] - {064823B5-11E8-4F1C-B4C8-B12B94A925E7} . (...) -- C:\Program Files (x86)\CeutTThePrice\QUsd2KulioqKaj.dll (.not file.)
O2 - BHO: bestadblocker [64Bits] - {1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879} (Orphean)
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{064823B5-11E8-4F1C-B4C8-B12B94A925E7}
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879}


After the above, your computer should be clean but be careful when you browse internet and download things.

Regards
0
sss1967 Posts 9 Registration date Tuesday October 13, 2015 Status Member Last seen October 21, 2015
Oct 21, 2015 at 08:08 AM
Dear Sir,

Sorry for late reply.

Since I saw your msg then I lost all my hope, Actually I don't use Internet Explorer at the moment, and I don't really know where did I get it, All your bold line are from windows 8. The problem is before install window 10, I forgot to delete Google chrome and Internet explorer. All malwares are from window 8 and I don't use it at all. I don't know what to do.
I try to donate the owner of the software and I need to fill my address and ph number. Is it necessary? I'm willing to, but I don't want to fill that. What should I do ?
Thank you for everything.

May you guys have good health, happiness and peaceful life.

Many thanks,

sss1967.

This is the report.

Rapport de ZHPFix 2015.10.19.9 par Nicolas Coolman, Update du 19/10/2015
Fichier d'export Registre : C:\Users\San\AppData\Roaming\ZHP\ZHPExportRegistry-21-10-2015-10-34-54 PM.txt
Run by San at 21/10/2015 10:34:48 PM
High Elevated Privileges : OK
Windows 8 Home Premium Edition, 64-bit Service Pack 1 (10240)

Recycle Bin emptied (03mn AMs)
Prefetcher emptied

========== Registry values ==========
ABSENT value Standard Profile: FirewallRaz :
ABSENT value Domain Profile: FirewallRaz :

========== Elements of the registry data ==========
REMOVES: R1 Search Page = https://www.msn.com/fr-fr/?ocid=iehp

========== Folders ==========
Deletes temporary Windows (6)
REMOVES Flash Cookies (0)

========== Files ==========
Deletes temporary Windows (41) (158,215 octets)
REMOVES Flash Cookies (0) (0 octets)
REMOVES: c:\users\san\appdata\local\google\chrome\user data\default\preferences

========== Other ==========
NON-TREATY 3 - CFD: 2015/07/25 15:37:07 - [] D -- C:\Program Files (x86)\bestadblocker
NON-TREATY 3 - CFD: 2015/07/25 15:38:24 - [] D -- C:\Program Files (x86)\CeutTThePrice
NON-TREATY 3 - CFD: 2015/07/26 00:28:38 - [] D -- C:\Program Files (x86)\CutThePrriCe
NON-TREATY [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{064823B5-11E8-4F1C-B4C8-B12B94A925E7}]
NON-TREATY [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C1A8F29-CFE1-4DF4-AD0D-397A4B5C6879}]


========== Summary ==========
2 : Registry values
1 : Elements of the registry data
2 : Folders
3 : Files
5 : Other


End of clean in 00mn AMs

========== Path to file report ==========
C:\Users\San\AppData\Roaming\ZHP\ZHPFix[R1].txt - 18/10/2015 9:42:02 PM [2024]
C:\Users\San\AppData\Roaming\ZHP\ZHPFix[R2].txt - 18/10/2015 10:26:26 PM [1682]
C:\Users\San\AppData\Roaming\ZHP\ZHPFix[R3].txt - 21/10/2015 10:34:54 PM [1764]
0
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,170
Oct 21, 2015 at 05:05 PM
Hi

I don't know where you got that my bold lines were from Windows 8 because I got them from your ZHP Diag report which clearly showed that you were running Windows 10.

I never mentioned Internet Explorer to you but Explorer which are two different things.

Donating to ZHP Diag (Nicolas Coleman, a friend of mine) will not get you ahead nor get you special favours.

As I mentioned in my previous message, after the latest ZHP Fix, your computer should be cleaned of all malware. I just warned you to be careful when you surf on internet, not to go on sites which may contain malware; Cut the price is an example.

I also advised you to change your antivirus for a more efficient one. (I think that F-Secure or Kaspersky are more efficient)

It was my pleasure to help you.

Farewell

Ambucias
Moderator, Virus/Security Contributor
0