Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for ByteFence Anti-Malware

- - - - -
Started by Metallica , Nov 17 2017 04:57 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 17 November 2017 - 04:57 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is ByteFence Anti-Malware?

The Malwarebytes research team has determined that ByteFence Anti-Malware is nagware and is often silently installed by bundlers.

How do I know if I am infected with ByteFence Anti-Malware?

This is how the main screen of the potentially unwanted application looks:

main.png

You will find these icons in your taskbar, on your desktop and in your startmenu:

icons.png

And see these warnings during install:

warning1.png

warning2.png

You may see this entry in your list of installed programs:

warning4.png

and this Scheduled Task:

warning3.png

How did ByteFence Anti-Malware get on my computer?

Potentially unwanted programs use different methods for spreading themselves. This particular one is also available on their website.

website.png

How do I remove ByteFence Anti-Malware?

Our program Malwarebytes can detect and remove this potentially unwanted program.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of ByteFence Anti-Malware?
  • No, Malwarebytes removes ByteFence Anti-Malware completely.
  • This PUP creates a scheduled task. You can read here how to check for and, if necessary, remove Scheduled Tasks.
  • If you installed this potentially unwanted program yourself and you want to continue using it, you can learn how to exclude the detections here.
How would the full version of Malwarebytes help protect me?

We hope our application has helped you eradicate this potentially unwnted software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes for additional protection.

As you can see below the full version of Malwarebytes would have protected you against the ByteFence Anti-Malware PUP. It would have warned you before the could install itself, giving you a chance to stop it before it became too late.


protection1.png

Technical details for experts

Possible signs in FRST logs:

 (Byte Technologies LLC) C:\Program Files\ByteFence\ByteFence.exe
 () C:\Program Files\ByteFence\rsLggr.exe
 (Byte Technologies LLC) C:\Program Files\ByteFence\ByteFenceService.exe
 () C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
 () C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe
 Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
 R2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [156640 2017-10-03] (Byte Technologies LLC)
 R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [302920 2017-11-17] ()
 C:\Windows\System32\Tasks\ByteFence
 C:\Users\{username}\Desktop\ByteFence Anti-Malware.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
 C:\ProgramData\ByteFence
 C:\Program Files\ByteFence

ByteFence Anti-Malware (HKLM-x32\...\ByteFence) (Version: 3.16.0.1 - Byte Technologies LLC)
Task: {BCC85629-805B-4CDD-A730-DA2B5E3AD27A} - System32\Tasks\ByteFence => C:\Program Files\ByteFence\ByteFence.exe [2017-10-03] (Byte Technologies LLC)

Hosts file
# unchecky_begin
# These rules were added by the Unchecky program in order to block advertising software modules
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 rp.yefeneri2.com
0.0.0.0 os.yefeneri2.com
0.0.0.0 os2.yefeneri2.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com
0.0.0.0 cdn.bisrv.com
0.0.0.0 cdn.cdndp.com
0.0.0.0 cdn.download.sweetpacks.com
0.0.0.0 cdn.dpdownload.com
0.0.0.0 cdn.visualbee.net
# unchecky_end
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files\ByteFence
       Adds the file ByteFence.exe"="10/3/2017 11:11 AM, 3686368 bytes, A
       Adds the file ByteFence.exe.config"="2/4/2017 11:51 PM, 380 bytes, A
       Adds the file ByteFenceGUI.dll"="10/2/2017 12:48 PM, 858080 bytes, A
       Adds the file ByteFenceScan.exe"="10/3/2017 11:11 AM, 198624 bytes, A
       Adds the file ByteFenceScan.exe.config"="2/4/2017 11:51 PM, 380 bytes, A
       Adds the file ByteFenceService.exe"="10/3/2017 11:11 AM, 156640 bytes, A
       Adds the file ByteFenceService.exe.config"="11/2/2016 6:25 PM, 383 bytes, A
       Adds the file ByteFenceService.InstallLog"="11/17/2017 9:11 AM, 675 bytes, A
       Adds the file ByteFenceService.InstallState"="11/17/2017 9:11 AM, 5012 bytes, A
       Adds the file EULA.txt"="9/5/2017 4:37 PM, 43142 bytes, A
       Adds the file InstallUtil.InstallLog"="11/17/2017 9:11 AM, 640 bytes, A
       Adds the file Microsoft.Win32.TaskScheduler.dll"="7/15/2015 7:35 PM, 246520 bytes, A
       Adds the file rsEngine.dll"="9/26/2017 12:48 PM, 3212056 bytes, A
       Adds the file rsEngineHelper.exe"="9/26/2017 12:49 PM, 170776 bytes, A
       Adds the file rsEngineHelper.exe.config"="9/8/2014 4:55 PM, 383 bytes, A
       Adds the file rsLggr.dll"="3/21/2017 4:03 PM, 131352 bytes, A
       Adds the file rsLggr.exe"="3/7/2017 7:18 PM, 582936 bytes, A
       Adds the file rsUtils.dll"="9/26/2017 12:55 PM, 186136 bytes, A
       Adds the file Signatures.dat"="11/17/2017 9:11 AM, 919232 bytes, A
       Adds the file SignaturesCEAList.dat"="11/17/2017 9:11 AM, 40856 bytes, A
       Adds the file SignaturesCEFList.dat"="11/17/2017 9:11 AM, 5952 bytes, A
       Adds the file SignaturesCEList.dat"="11/17/2017 9:11 AM, 98156 bytes, A
       Adds the file SignaturesPacks.dat"="11/17/2017 9:11 AM, 160664 bytes, A
       Adds the file Uninstall.exe"="11/17/2017 9:11 AM, 67610 bytes, A
       Adds the file WhiteList.dat"="9/12/2017 2:38 PM, 266968 bytes, A
    Adds the folder C:\Program Files\ByteFence\Cache
    Adds the folder C:\Program Files\ByteFence\Logs
    Adds the folder C:\Program Files\ByteFence\rtop
       Adds the file uninstall.dat"="11/17/2017 9:13 AM, 1484 bytes, A
       Adds the file uninstall.exe"="11/17/2017 9:13 AM, 373064 bytes, A
    Adds the folder C:\Program Files\ByteFence\rtop\bin
       Adds the file inject.dll"="11/17/2017 9:13 AM, 1017160 bytes, A
       Adds the file inject_x64.dll"="11/17/2017 9:13 AM, 1203016 bytes, A
       Adds the file rtop_bg.exe"="11/17/2017 9:12 AM, 620872 bytes, A
       Adds the file rtop_svc.exe"="11/17/2017 9:13 AM, 302920 bytes, A
    Adds the folder C:\Program Files\ByteFence\Scans
    Adds the folder C:\Program Files\ByteFence\x64
       Adds the file ext_x64.dll"="7/5/2017 7:16 PM, 375576 bytes, A
       Adds the file lz4_x64.dll"="5/25/2016 2:38 PM, 129304 bytes, A
       Adds the file System.Data.SQLite.dll"="11/16/2016 6:05 PM, 1658136 bytes, A
    Adds the folder C:\Program Files\ByteFence\x86
       Adds the file ext_x86.dll"="7/5/2017 8:23 PM, 280344 bytes, A
       Adds the file lz4_x86.dll"="5/25/2016 2:38 PM, 106776 bytes, A
       Adds the file System.Data.SQLite.dll"="11/16/2016 6:06 PM, 1209624 bytes, A
    Adds the folder C:\ProgramData\ByteFence\RTOP
       Adds the file hosts_backup"="11/17/2017 9:12 AM, 824 bytes, A
       Adds the file uclogfile.bin"="11/17/2017 9:14 AM, 0 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
       Adds the file ByteFence Anti-Malware.lnk"="11/17/2017 9:11 AM, 1041 bytes, A
    In the existing folder C:\Users\{username}\Desktop
       Adds the file ByteFence Anti-Malware.lnk"="11/17/2017 9:11 AM, 1023 bytes, A
    In the existing folder C:\Windows\System32\drivers\etc
       Alters the file hosts
    In the existing folder C:\Windows\System32\Tasks
       Adds the file ByteFence"="11/17/2017 9:11 AM, 3404 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\ByteFence]
       "CLNG"="REG_SZ"", "en"
       "ELINSF"="REG_SZ"", "11/17/2017 9:11:29 AM"
       "EVNLSA"="REG_SZ"", "636465067385861443"
       "FETRSI"="REG_SZ"", "132"
       "FirstRun"="REG_SZ"", "11/17/2017 9:11:20 AM"
       "FSSATO"="REG_SZ"", "0"
       "IDT"="REG_SZ"", "1510909881"
       "INSSRTS"="REG_SZ"", "1"
       "InstallDate"="REG_SZ"", "11/17/2017 9:11:21 AM"
       "LFMAIN"="REG_SZ"", "636465067121173943"
       "PINSTP"="REG_SZ"", ""
       "PMASS"="REG_SZ"", "1"
       "PMPMMPH"="REG_SZ"", "1"
       "PMPMMPHH"="REG_SZ"", "1"
       "PMPMMPHS"="REG_SZ"", "1"
       "PMPMMPSS"="REG_SZ"", "1"
       "PSSET"="REG_SZ"", ""
       "RTPMA"="REG_SZ"", "1"
       "ScheduleScanEnabled"="REG_SZ"", "1"
       "ScheduleScanMode"="REG_SZ"", "2"
       "SIGLC"="REG_SZ"", "11/17/2017 9:11:58 AM"
       "U"="REG_SZ"", "33d8c6d1-d3dc-44fe-b001-8ac52b410b2a"
       "UH"="REG_SZ"", "464D06AA81944213158F16D5C74846D2"
       "UNCKIE"="REG_SZ"", "1"
       "UNCKIED"="REG_SZ"", "11/17/2017 9:11:57 AM"
       "WLLCK"="REG_SZ"", "11/17/2017 9:11:59 AM"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan]
       "(Default)"="REG_SZ"", "Scan with ByteFence Anti-Malware..."
       "Icon"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFence.exe",0"
       "Position"="REG_SZ"", "Middle"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan\command]
       "(Default)"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFenceScan.exe" /scan:"%1""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan]
       "(Default)"="REG_SZ"", "Scan with ByteFence Anti-Malware..."
       "Icon"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFence.exe",0"
       "Position"="REG_SZ"", "Middle"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan\command]
       "(Default)"="REG_SZ"", ""C:\Program Files\ByteFence\ByteFenceScan.exe" /scan:"%1""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ByteFence]
       "ELINSF"="REG_SZ"", "11/17/2017 9:11:29 AM"
       "FETRSI"="REG_SZ"", "132"
       "FirstRun"="REG_SZ"", "11/17/2017 9:11:20 AM"
       "FSSATO"="REG_SZ"", "0"
       "IDT"="REG_SZ"", "1510909881"
       "INSSRTS"="REG_SZ"", "1"
       "InstallDate"="REG_SZ"", "11/17/2017 9:11:21 AM"
       "LFMAIN"="REG_SZ"", "636465067121173943"
       "PINSTP"="REG_SZ"", ""
       "PMASS"="REG_SZ"", "1"
       "PMPMMPH"="REG_SZ"", "1"
       "PMPMMPHH"="REG_SZ"", "1"
       "PMPMMPHS"="REG_SZ"", "1"
       "PMPMMPSS"="REG_SZ"", "1"
       "PSSET"="REG_SZ"", ""
       "RTPMA"="REG_SZ"", "1"
       "ScheduleScanEnabled"="REG_SZ"", "1"
       "ScheduleScanMode"="REG_SZ"", "2"
       "SIGLC"="REG_SZ"", "11/17/2017 9:11:58 AM"
       "U"="REG_SZ"", "33d8c6d1-d3dc-44fe-b001-8ac52b410b2a"
       "UH"="REG_SZ"", "464D06AA81944213158F16D5C74846D2"
       "UNCKIE"="REG_SZ"", "1"
       "UNCKIED"="REG_SZ"", "11/17/2017 9:11:57 AM"
       "WLLCK"="REG_SZ"", "11/17/2017 9:11:59 AM"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ByteFence\RTOP]
       "HideTrayIcon"="REG_DWORD"", 1
       "InstTime"="REG_QWORD, ....
       "LastUpdateCheckTime"="REG_DWORD"", 61259511
       "Path"="REG_SZ"", "C:\Program Files\ByteFence\rtop"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence]
       "DisplayIcon"="REG_SZ"", "C:\Program Files\ByteFence\Uninstall.exe"
       "DisplayName"="REG_SZ"", "ByteFence Anti-Malware"
       "DisplayVersion"="REG_SZ"", "3.16.0.1"
       "InstallSource"="REG_SZ"", "C:\Program Files\ByteFence\"
       "NoModify"="REG_DWORD"", 1
       "NoRepair"="REG_DWORD"", 1
       "Publisher"="REG_SZ"", "Byte Technologies LLC"
       "UninstallString"="REG_SZ"", ""C:\Program Files\ByteFence\uninstall.exe""
       "URLInfoAbout"="REG_SZ"", "https://www.bytefence.com"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ByteFenceService]
       "Description"="REG_SZ"", "ByteFence Anti-Malware protetcion service"
       "DisplayName"="REG_SZ"", "ByteFence Anti-Malware Service"
       "ErrorControl"="REG_DWORD"", 1
       "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\ByteFence\ByteFenceService.exe""
       "ObjectName"="REG_SZ"", "LocalSystem"
       "Start"="REG_DWORD"", 2
       "Type"="REG_DWORD"", 16
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\ByteFenceService]
       "EventMessageFile"="REG_EXPAND_SZ, "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\EventLogMessages.dll"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rtop]
       "Description"="REG_SZ"", "ByteFence Security service to prevents Potentially Unwanted Programs."
       "DisplayName"="REG_SZ"", "rtop"
       "ErrorControl"="REG_DWORD"", 1
       "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe""
       "ObjectName"="REG_SZ"", "LocalSystem"
       "Start"="REG_DWORD"", 2
       "Type"="REG_DWORD"", 16
       "WOW64"="REG_DWORD"", 1
    [HKEY_USERS\.DEFAULT\Software\ByteFence\RTOP]
    [HKEY_CURRENT_USER\Software\ByteFence\RTOP]
       "HideTrayIcon"="REG_DWORD"", 1
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/17/17
Scan Time: 9:32 AM
Log File: d505895c-cb71-11e7-9303-080027750297.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2018
Components Version: 1.0.212
Update Package Version: 1.0.3280
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 333970
Threats Detected: 19
Threats Quarantined: 19
Time Elapsed: 2 min, 35 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 3
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\RTOP\BIN\RTOP_SVC.EXE, Quarantined, [633], [390139],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCESERVICE.EXE, Quarantined, [633], [388726],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCE.EXE, Quarantined, [633], [389016],1.0.3280

Module: 3
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\RTOP\BIN\RTOP_SVC.EXE, Quarantined, [633], [390139],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCESERVICE.EXE, Quarantined, [633], [388726],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCE.EXE, Quarantined, [633], [389016],1.0.3280

Registry Key: 5
PUP.Optional.ByteFence, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RTOP, Delete-on-Reboot, [633], [390139],1.0.3280
PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BCC85629-805B-4CDD-A730-DA2B5E3AD27A}, Delete-on-Reboot, [633], [389376],1.0.3280
PUP.Optional.ByteFence, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ByteFenceService, Delete-on-Reboot, [633], [388726],1.0.3280
PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\ByteFence, Delete-on-Reboot, [633], [389375],1.0.3280
PUP.Optional.ByteFence, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ByteFence, Delete-on-Reboot, [633], [389016],1.0.3280

Registry Value: 2
PUP.Optional.ByteFence, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RTOP|IMAGEPATH, Delete-on-Reboot, [633], [390139],1.0.3280
PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BCC85629-805B-4CDD-A730-DA2B5E3AD27A}|PATH, Delete-on-Reboot, [633], [389376],1.0.3280

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 6
PUP.Optional.ByteFence, C:\WINDOWS\SYSTEM32\TASKS\ByteFence, Delete-on-Reboot, [633], [388721],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\RTOP\BIN\RTOP_SVC.EXE, Delete-on-Reboot, [633], [390139],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCESERVICE.EXE, Delete-on-Reboot, [633], [388726],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\BYTEFENCE.EXE, Delete-on-Reboot, [633], [389016],1.0.3280
PUP.Optional.ByteFence, C:\USERS\{username}\DESKTOP\BYTEFENCE-INSTALLER_3.16.0.EXE, Delete-on-Reboot, [633], [389016],1.0.3280
PUP.Optional.ByteFence, C:\PROGRAM FILES\BYTEFENCE\UNINSTALL.EXE, Delete-on-Reboot, [633], [389016],1.0.3280

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.