Malware - PC Registry Shield?

[mitchell65]

During my regular check on start up progs I noticed two new ones "pcreg" and "VProtect App" as here:

I can't find anything on VProtect App but in my Program Files I found "PC Registry Shield" which I think is Malware. Ihave rum Malwarebytes and found nothing report as follows:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.07.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
John :: WIN7 [administrator]

08/09/2013 09:46:49
mbam-log-2013-09-08 (09-46-49).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 270782
Time elapsed: 1 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Would appreciate some guidance now as to what program to run next.

 

[HonorGamer]

I'm no expert at this, but it could also be a virus. Have you tried running a virus scan too? Just to be safe. Just a suggestion though cause this is something that I'm not the best at lol.

 

[mitchell65]

I'm no expert at this, but it could also be a virus. Have you tried running a virus scan too? Just to be safe. Just a suggestion though cause this is something that I'm not the best at lol.

Yes that's all clear. I did run it first so should have mentioned that but I run a daily scan. I Googled the "PC Registry Shield" and found it to be malware.

 

[marsmimar]

PC Registry Shield appears to be one of those questionable "all-in-one-speed-up-your-computer-and-fix-everything-registry-cleaner-and-more." CNET has it on their download site.

PC Registry Shield - Free download and software reviews - CNET Download.com

From their FAQ page, how to uninstall:

In the unlikely event you wish to remove our application, you can easily uninstall just as you would any other software on your computer:

• Click Start in the lower left corner of your screen
• From the Programs menu, select PC Registry Shield.
• Select Uninstall.
• Follow the on-screen prompts until finished.

PC Registry Shield – FAQ | ShieldApps

This might be one of those times to get the free 30 day trial version of Revo Uninstaller Pro for a deep removal process. It may also get rid of that vprotect app.

Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall, Leftovers Uninstaller

 

[mitchell65]

Thank you Lee. Problem is PC Registry Shield does not appear in the list of programs so i am unable un install. As I said i Googled it and found this

It is a Malware (Virus, Worm, Trojan, etc.) , that pretends to be legitimate program but it doesn't do anything and will ask you to pay to resolve issue in your PC.
You could run a full system scan with:
Microsoft Safety Scanner - Antivirus | Remove Spyware, Malware, Viruses Free
To remove it.

 

[mitchell65]

Seem to have got rid of PC registry Shield with the MS software. Have found this on pcreg which is still in the Start up list in system config. Any ideas on my next step please?

 

[mitchell65]

have now found the registry entry here:

Looks normal to me so i wonder why it suddenly appeared in the Sys Config Start up list. Should i keep it enabled in that list of is it safe to disable?

 

[Layback Bear]

This looks like one of those IOBit (using another name) sneak in the back door programs.
If it was my computer I would also run Eset Online Scan and AdwCleaner.
You can bet that it also left cookies that call home. I would also run Super Anti Spyware.

Check in msconfig/StartUp and Services and see if it has a auto updater.

 

[mitchell65]

Many thanks Jack.
I had already run ADW Cleaner earlier and have now run Eset Online Scan and Super Anti Spyware and it was clear apart from a few Tracking Cookies which are now removed. There is no update in System Config. "Services". have also run Ccleaner.
However, before i started scanning I opened the path shown to pcreg and found this "services.exe". This appears to be a virus, trojan or similar as the services.exe legit file should be in C:\Windows\system32, which it is, so I have two files "services.exe". The following two screenshots explain:




I found a number of references to this on the net and all said that if the services.exe file was anywhere other than in the System32 folder then it was probably a virus or similar. Interested to hear any comments! I would like to clear his!

 

[DavidE]

You could upload the questionable file to VirusTotal for scanning.

Do you have a system backup image from before the problem started you can restore?

 

[mitchell65]

Thanks for that David.
Before I saw your post I had a brainwave (well for me it was) I navigated to the services.exe file in Program files and right clicked on it and chose "Scan with Malwarebytes". It came up with this:

I clicked Remove and all seems OK now.

 

[Layback Bear]

Chatzum is a tool bar that sneaked in probably with a free download of a program. I don't understand why all those security scans didn't find it. This might be the source.

http://www.chatzum.com/
Happy computing.

 

[mitchell65]

Thanks Jack,
It does seem odd that when I did a quick scan on Malwarebytes and it found nothing I did a full scan and still it found nothing then when I identified the iffy file and scanned that specifically with Malwarebytes it found the problem!
As far as your link is concerned I have never seen that site before and would have had no reason to as I don't use any social media sites and the graphics on that site made me dizzy just looking at it. What an appalling color scheme!
i suppose this will become one of life's mysteries!
thanks again for all you help

 

[DavidE]

That is odd MBAM only found it scanning the specific file.
Check what action you have set for "PUP" in the Scanner Settings.
Maybe it's set to "Do not show in results lists" and that's why a Quick or Full scan didn't list it?

 

[mitchell65]

Here's my scanner settings;

 

[DavidE]

OK, seems like it should have been listed in the other scans...

 

[mitchell65]

As Alice said "Curiouser andCuriouser"