Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for MyPrintScreen

- - - - -
Started by Metallica , Feb 13 2020 05:46 AM
soundfrost

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 13 February 2020 - 05:46 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is MyPrintScreen?

The Malwarebytes research team has determined that MyPrintScreen is a potentially unwanted program that behaves like a trojan.
It downloads other threats to the affected system.

How do I know if my computer is affected by MyPrintScreen?

You may see this warning during install:

warning1.png

this control on your desktop:

warning2.png

this entry in your start menu:

icons.png

and this entry in your list of installed Programs and Features:

warning4.png

You will see this menu when you make a screenshot:

main.png

How did MyPrintScreen get on my computer?

Adware applications use different methods for distributing themselves. This particular one was downloaded from their website:

website.png

How do I remove MyPrintScreen?

Our program Malwarebytes can detect and remove this potentially unwanted program.
  • Please download Malwarebytes for Windows to your desktop.
  • Double-click MBSetup.exe and follow the prompts to install the program.
  • When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
  • Click on the Get started button.
  • Click Scan to start a Threat Scan.
  • When the scan is finished click Quarantine to remove the found threats.
  • Reboot the system if prompted to complete the removal process.
Is there anything else I need to do to get rid of MyPrintScreen?
  • You can uninstall MyPrintScreen after the reboot if you no longer wish to use it.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this potentially unwanted program.

As you can see below the full version of Malwarebytes would have protected you against the MyPrintScreen PUP. It would have blocked the installer before it became too late.

protection1.png


and both Malwarebytes Premium and Browser Guard would have blocked their domain:

protection2.png


protection3.png


Technical details for experts

Possible signs in FRST logs:
(GenericTools Company) [File not signed] C:\Users\{username}\AppData\Local\GenericTools\GenericTools.exe
(АЙ СI СI, ТОВ -> MyPrintScreen Company) C:\Users\{username}\AppData\Local\MyPrintScreen\MyPrintScreen.exe
HKCU\...\Run: [MyPrintScreen] => C:\Users\{username}\AppData\Local\MyPrintScreen\MyPrintScreen.exe [442512 2018-01-19] (АЙ СI СI, ТОВ -> MyPrintScreen Company)
HKCU\...\Run: [GenericTools] => C:\Users\{username}\AppData\Local\GenericTools\GenericTools.exe [233984 2020-02-04] (GenericTools Company) [File not signed]
HKCU\...\Run: [SiSoft] => C:\Users\{username}\AppData\Local\GenericTools\SiSoft.exe [184832 2020-01-08] (SiSoft LTD) [File not signed]
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPrintScreen
C:\Users\{username}\AppData\Local\MyPrintScreen
C:\Users\{username}\AppData\Local\GenericTools

MyPrintScreen (HKCU\...\MyPrintScreen_is1) (Version: 3.3.1.0 - MyPrintScreen Company)
Significant changes made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Local\GenericTools
       Adds the file GenericTools.exe"="2/4/2020 4:15 PM, 233984 bytes, A
       Adds the file libcurl.dll"="11/28/2017 4:27 PM, 318976 bytes, A
       Adds the file libeay32.dll"="11/21/2017 10:00 AM, 1178112 bytes, A
       Adds the file msvcp100.dll"="6/11/2011 2:58 AM, 421200 bytes, A
       Adds the file msvcr100.dll"="6/11/2011 2:58 AM, 773968 bytes, A
       Adds the file QtCore4.dll"="8/7/2013 5:32 PM, 2598912 bytes, A
       Adds the file QtGui4.dll"="6/27/2013 12:16 PM, 8581632 bytes, A
       Adds the file QtNetwork4.dll"="6/27/2013 12:10 PM, 1053696 bytes, A
       Adds the file QtScript4.dll"="6/27/2013 11:23 AM, 1341440 bytes, A
       Adds the file QtWebKit4.dll"="6/27/2013 12:29 PM, 13112320 bytes, A
       Adds the file SiSoft.exe"="1/8/2020 3:23 PM, 184832 bytes, A
       Adds the file ssleay32.dll"="5/10/2012 10:10 PM, 265216 bytes, A
       Adds the file ws"="2/13/2020 10:37 AM, 7876 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\MyPrintScreen
       Adds the file msvcp100.dll"="6/11/2011 2:58 AM, 421200 bytes, A
       Adds the file msvcr100.dll"="6/11/2011 2:58 AM, 773968 bytes, A
       Adds the file MyPrintScreen.exe"="1/19/2018 5:42 PM, 442512 bytes, A
       Adds the file QtCore4.dll"="8/7/2013 5:32 PM, 2598912 bytes, A
       Adds the file QtGui4.dll"="6/27/2013 12:16 PM, 8581632 bytes, A
       Adds the file QtNetwork4.dll"="6/27/2013 12:10 PM, 1053696 bytes, A
       Adds the file unins000.dat"="2/13/2020 10:37 AM, 16128 bytes, A
       Adds the file unins000.exe"="2/13/2020 10:36 AM, 1287881 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\MyPrintScreen\imageformats
       Adds the file qgif4.dll"="11/26/2012 12:31 PM, 26624 bytes, A
       Adds the file qico4.dll"="11/26/2012 12:31 PM, 28672 bytes, A
       Adds the file qjpeg4.dll"="11/26/2012 12:31 PM, 201216 bytes, A
       Adds the file qmng4.dll"="11/26/2012 12:31 PM, 222208 bytes, A
       Adds the file qsvg4.dll"="11/26/2012 12:31 PM, 21504 bytes, A
       Adds the file qtga4.dll"="11/26/2012 12:32 PM, 19968 bytes, A
       Adds the file qtiff4.dll"="11/26/2012 12:31 PM, 287232 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPrintScreen
       Adds the file How to use MyPrintScreen.url"="2/13/2020 10:37 AM, 54 bytes, A
       Adds the file MyPrintScreen.lnk"="2/13/2020 10:37 AM, 1142 bytes, A
       Adds the file Uninstall MyPrintScreen.lnk"="2/13/2020 10:37 AM, 1117 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_CURRENT_USER\Software\GenericTools]
       "insterra"="REG_SZ", "191112"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
       "GenericTools"="REG_SZ", "C:\Users\{username}\AppData\Local\GenericTools\GenericTools.exe"
       "MyPrintScreen"="REG_SZ", "C:\Users\{username}\AppData\Local\MyPrintScreen\MyPrintScreen.exe"
       "SiSoft"="REG_SZ", "C:\Users\{username}\AppData\Local\GenericTools\SiSoft.exe"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPrintScreen_is1]
       "DisplayIcon"="REG_SZ", "C:\Users\{username}\AppData\Local\MyPrintScreen\MyPrintScreen.exe"
       "DisplayName"="REG_SZ", "MyPrintScreen"
       "DisplayVersion"="REG_SZ", "3.3.1.0"
       "EstimatedSize"="REG_DWORD", 44930
       "Inno Setup: App Path"="REG_SZ", "C:\Users\{username}\AppData\Local\MyPrintScreen"
       "Inno Setup: Icon Group"="REG_SZ", "MyPrintScreen"
       "Inno Setup: Language"="REG_SZ", "en"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.3 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20200213"
       "InstallLocation"="REG_SZ", "C:\Users\{username}\AppData\Local\MyPrintScreen\"
       "MajorVersion"="REG_DWORD", 3
       "MinorVersion"="REG_DWORD", 3
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "MyPrintScreen Company"
       "QuietUninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\MyPrintScreen\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\MyPrintScreen\unins000.exe""
    [HKEY_CURRENT_USER\Software\myprintscreen.com\MyPrintScreen]
       "first"="REG_SZ", "false"
       "Language"="REG_SZ", "en"
       "Show snap button"="REG_SZ", "true"
    [HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Users\{username}\AppData\Local\MyPrintScreen\imageformats]
       "qgif4.dll"="REG_MULTI_SZ, "2012-11-26T12:31:46 gif "
       "qico4.dll"="REG_MULTI_SZ, "2012-11-26T12:31:58 ico "
       "qjpeg4.dll"="REG_MULTI_SZ, "2012-11-26T12:31:44 jpeg jpg "
       "qmng4.dll"="REG_MULTI_SZ, "2012-11-26T12:31:50 mng "
       "qtga4.dll"="REG_MULTI_SZ, "2012-11-26T12:32:00 tga "
       "qtiff4.dll"="REG_MULTI_SZ, "2012-11-26T12:31:56 tiff tif "
    [HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Users\{username}\AppData\Local\MyPrintScreen\imageformats]
       "qgif4.dll"="REG_MULTI_SZ, "40804 0 Windows msvc release full-config 2012-11-26T12:31:46 "
       "qico4.dll"="REG_MULTI_SZ, "40804 0 Windows msvc release full-config 2012-11-26T12:31:58 "
       "qjpeg4.dll"="REG_MULTI_SZ, "40804 0 Windows msvc release full-config 2012-11-26T12:31:44 "
       "qmng4.dll"="REG_MULTI_SZ, "40804 0 Windows msvc release full-config 2012-11-26T12:31:50 "
       "qsvg4.dll"="REG_MULTI_SZ, "40804 0 Windows msvc release full-config 2012-11-26T12:31:52 "
       "qtga4.dll"="REG_MULTI_SZ, "40804 0 Windows msvc release full-config 2012-11-26T12:32:00 "
       "qtiff4.dll"="REG_MULTI_SZ, "40804 0 Windows msvc release full-config 2012-11-26T12:31:56 "
Malwarebytes log:
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/13/20
Scan Time: 12:17 PM
Log File: 63d4d3bc-4e52-11ea-8df3-00ffdcc6fdfc.json

-Software Information-
Version: 4.0.4.49
Components Version: 1.0.823
Update Package Version: 1.0.19150
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 236126
Threats Detected: 33
Threats Quarantined: 32
Time Elapsed: 14 min, 29 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 2
RiskWare.Redirector, C:\USERS\{username}\APPDATA\LOCAL\GENERICTOOLS\GENERICTOOLS.EXE, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\SiSoft.exe, Quarantined, 4849, 467517, , , , 

Module: 15
RiskWare.Redirector, C:\USERS\{username}\APPDATA\LOCAL\GENERICTOOLS\GENERICTOOLS.EXE, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\libcurl.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\libeay32.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\libeay32.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtCore4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtCore4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtGui4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtGui4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtNetwork4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtNetwork4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtScript4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtWebKit4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\SiSoft.exe, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\ssleay32.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\ssleay32.dll, Quarantined, 4849, 467517, , , , 

Registry Key: 0
(No malicious items detected)

Registry Value: 2
RiskWare.Redirector, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|GenericTools, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SiSoft, Quarantined, 4849, 467517, , , , 

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
RiskWare.Redirector, C:\USERS\{username}\APPDATA\LOCAL\GENERICTOOLS, whitelisted, 4849, 467517, 1.0.19150, 0C000076D500000028AD977C, dds, 

File: 13
RiskWare.Redirector, C:\USERS\{username}\APPDATA\LOCAL\GENERICTOOLS\GENERICTOOLS.EXE, Quarantined, 4849, 467517, 1.0.19150, 0C000076D500000028AD977C, dds, 00588077
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\libcurl.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\libeay32.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtCore4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtGui4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtNetwork4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtScript4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\QtWebKit4.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\SiSoft.exe, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\ssleay32.dll, Quarantined, 4849, 467517, , , , 
RiskWare.Redirector, C:\Users\{username}\AppData\Local\GenericTools\ws, Quarantined, 4849, 467517, , , , 
PUP.Optional.SoundFrost, C:\USERS\{username}\DESKTOP\WEBSOFT.EXE, Quarantined, 161, 789932, 1.0.19150, , ame, 
PUP.Optional.SoundFrost, C:\USERS\{username}\DESKTOP\MYPRINTSCREEN.EXE, Quarantined, 161, 788387, 1.0.19150, 5BF1AFA902506587052E1825, dds, 00588077

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.