SOLVED Unknown Chinese app preventing signing out

[6bubbs]

Hi all

When signing out of windows 10 this week I noticed a message that appeared for a few seconds, telling me that an app was preventing signing out. The title of the app in question was expressed in what appear to be Chinese symbols (please excuse my ignorance). See attached photos of the message.

I have never before seen an app or program like this(ie one with chinese symbols) and am concerned that it is something malicious such as spyware. I searched for this app on both task manager and on the program list (accessed via control panel), but couldn't find it, which makes me more suspicious - this could mean it is deliberately hidden, or simply that I am looking in the wrong place!

I appreciate that it could just be something that the system has not translated to English, but find it odd that it should happen now and that i cannot find it in the program list.

For what it is worth, my McAfee subscription is up to date. Have just run a full scan - no issues detected.

Has anyone seen anything like this before, or can anyone say whether the app is likely to be malicious (and, if so, how i can find and remove it)?

Any opinions would be very gratefully received, even if those opinions are that I am an idiot who is worrying about nothing!

Thanks

 

[davidhk129]

They are in Chinese language forms but they are gibberish.
I am a Chinese.

Can't tell you why that happened.
Speculatively, you might have visited some websites that are questionable.
If your McAfee finds nothing in full scan, then I suppose you are ok.
Try a sign out again and see if you still see the same.

 

[Trouble]

Just in the interest of perhaps a second opinion, hit it with this
https://toolslib.net/downloads/viewdownload/1-adwcleaner/
And see if it turns up anything.

 

[6bubbs]

Thanks for that info davidhk129.

I am always ultra cautious about downloading stuff and about which websites I visit, but if it is spyware then it must have come from somewhere. I know i should be reassured than McAfee cannot detect any issues, but at same time i know that McAfee isn't perfect.

Have signed out a couple of times since your post - sure enough, the message about the app appeared each time, so the app is still running. If it was legit then it I wouldn't expect it to be gibberish. The app seems to be hidden so i can't investigate.

The more i think about it the more i think it is malicious.

 

[davidhk129]

I am a Malwarebytes convert.
Would you mind download the free edition and run it in full scan ?
For first time use, it needs to be updated first, then scan.
https://www.malwarebytes.org/mwb-download/

 

[davidhk129]

Adding..............
Have you gone to regedit and check the software lists. Something that might look fishy ?

 

[6bubbs]

Have hit it with adwcleaner and also norton power eraser - nothing came up unfortunately.

will check malwarebytes and registry editor tomorrow - thank you for the advice.

 

[6bubbs]

Have now checked software lists via regedit as suggested - nothing obviously strange in there. Have also updated malwarebytes and ran full scan, which found nothing apart from some unrelated PUPs. Have removed the PUPs but still getting the same message when I log off, so the questionable app remains!

any ideas whether it is a risk?

thanks again

 

[davehc]

Is there nothing unusual showing under the start up tab in the taskmanager,
Maybe, as you are obviously familiar with the registry, you could try this.
If Able(+) copy the chinese symbols.
Open regedit again at the root,(Computer) and, in "Edit" paste the text and apply the search. Delete all the entries found.

 

[6bubbs]

Nothing unusual at all in start up tab of task manager.

Am unable to copy the text - neither right click nor ctrl c will work on the message.

I have searched the registry using the find facility on the edit tab. I searched for Chinese symbols (search text copied from a translation site) which appeared similar to some of those appearing in the log off message, but again nothing sadly.

I am well and truly stumped.

 

[davehc]

You could try, at the clcose down screen, cancel and go back to the desktop. Click the taskview button on the taskbar. - The small hollow square with two wings. It will show you all running programs/Apps. Should you be luck and see the offending item, it would be a good idea to try and identify it. But, hold the mouse over it and drag it to the bottom of the screen. Hold it there for a couple of secs, and it will close - just a thought, might do the trick.

 

[davidhk129]

6bubbs,
Just a silly thought of mine........
Create another admin account ( I assume you are using an admin account ) > log on to it and test the new account. Find out if the same issue persist.

If problem gone, then you have a corrupt admin account.
Backup whatever you want to keep and delete the corrupt account.

 

[6bubbs]

Thanks Davehc - have tried your suggestion. no matter how quickly i cancel the sign out, i lose most functionality once the sign out procedure ceases (taskbar, start menu, right click functions etc all gone - just a blank screen). The only thing i can access at that stage is the task manager, which tells me that no applications are running (other than itself!).

Davidhk - thanks for the suggestion. will back up everything, create new admin account and let you know how i get on.

Some people have suggested that i get rid of windows 10 and revert to windows 7, as this issue coincided (approximately) with installation of windows 10. Does this seem a little extreme to you?

Thanks again.

 

[davidhk129]

Some people have suggested that i get rid of windows 10 and revert to windows 7, as this issue coincided (approximately) with installation of windows 10. Does this seem a little extreme to you

Not really.
It all depends on what you want or need out of the system.
If you are happy with your Win 7, and if it has been trouble-free for you, there is no harm going back.
Win 10 is a new OS and there are still issues to be sorted out. It could be prudent to stay back and let MS sort things out first.
Besides, you have until July 28th 2016 to upgrade to Windows 10. Your free upgrade offer is still good until then.

 

[6bubbs]

Update - have created new admin account and deleted the old one. The strange message no longer appears when logging off - have tried a few times. So, whilst I wasn't able to identify the suspicious app the problem no longer seems to be there.

I didn't get round to uninstalling windows 10 - i won't try that now unless this problem rears its head again.

Thank you all for your help, it is very much appreciated.

 

[teddybear]

Update - have created new admin account and deleted the old one. The strange message no longer appears when logging off - have tried a few times. So, whilst I wasn't able to identify the suspicious app the problem no longer seems to be there.

I didn't get round to uninstalling windows 10 - i won't try that now unless this problem rears its head again.

Thank you all for your help, it is very much appreciated.

had same problem went away after uninstalling sollitare /xbox

 

[MarcT]

Could it be this:

http://www.urtech.ca/2016/01/solved...cters-app-is-preventing-you-from-signing-out/

...had the same problem with a relative's PC.

 

[gregory]

You have IBM/Trusteer Apex or Rapport installed. Trusteer Rapport is a module from Apex that Trusteer has distributed through many banks to protect the browser from being hacked and the figures are incorrectly displayed unicode. Check this site:
http://www.urtech.ca/2016/01/solved...cters-app-is-preventing-you-from-signing-out/