Jump to content

GPU on 99 Load, suspect discreet gpu miner

Dumplet

By Dumplet
in Resolved Malware Removal Logs

 Share

Recommended Posts

Dumplet

Dumplet

Posted
Posted

Hello,

 

After clicking a link from my friend over skype, my chrome browser downloaded a picture. When I opened the pic it had a cross over it with a directory on my HDD. I ignored it for a while until I noticed that my computer's fan was extremely loud and it was coming from my gpu. I checked hardware monitor and after booting up, within an hour my gpu load shot up to around 98-99. I was idle listening to music on Spotify.

 

My first inquiry is, do I have a gpu miner virus? Second would be are any of my passwords compromised?post-181268-0-57676800-1420577950_thumb.

 

post-181268-0-62855600-1420577972_thumb.

 

Both pics show the load and gpu activity, oddly though, the lod is maxed but the activity is almost idle.

 

Thanks for reading.

Link to post
Share on other sites
_argus

_argus

Posted
Posted

Helllo,

My name is Argus and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

 
 
 
warning.gif Rules and policies

We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
FRST.gif Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Link to post
Share on other sites
Dumplet

Dumplet

Posted
  • Author
Posted
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-01-2015

Ran by Rubie (administrator) on RUBIE-PC on 06-01-2015 16:22:37

Running from C:\Users\Rubie\Downloads

Loaded Profile: Rubie (Available profiles: Rubie)

Platform: Windows 7 Enterprise (X64) OS Language: English (United States)

Internet Explorer Version 8 (Default browser: Chrome)

Boot Mode: Normal


 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

() C:\Program Files (x86)\Everything\Everything.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Spotify Ltd) C:\Users\Rubie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(SVP-Team.com) C:\Program Files (x86)\SVP\svptube\svptube.exe

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE

() C:\Program Files (x86)\Everything\Everything.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Users\Rubie\AppData\Roaming\Audacity\CODEXi\Steam

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\Rubie\Downloads\FRST64 (1).exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2461504 2014-09-16] (NVIDIA Corporation)

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-27] (AVAST Software)

HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2014-10-08] (Power Software Ltd)

HKLM-x32\...\Run: [Everything] => C:\Program Files (x86)\Everything\Everything.exe [1048576 2014-08-05] ()

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3838800 2014-12-13] (LogMeIn Inc.)

HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3095328 2014-09-16] (Nota Inc.)

HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\Run: [spotify Web Helper] => C:\Users\Rubie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-16] (Spotify Ltd)

HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\Run: [sVPtube] => C:\Program Files (x86)\SVP\svptube\svptube.exe [15120896 2014-03-24] (SVP-Team.com)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk

ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk -> C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKU\S-1-5-21-1243950774-1183063232-2593923303-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} ->  No File

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKU\S-1-5-21-1243950774-1183063232-2593923303-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 68.237.161.12

 

FireFox:

========

FF ProfilePath: C:\Users\Rubie\AppData\Roaming\Mozilla\Firefox\Profiles\71say5dp.default

FF DefaultSearchEngine: Google

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()

FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll (EA Digital Illusions CE AB)

FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll (Unity Technologies ApS)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()

FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Extension: MEGA - C:\Users\Rubie\AppData\Roaming\Mozilla\Firefox\Profiles\71say5dp.default\Extensions\firefox@mega.co.nz.xpi [2014-11-30]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-09-27]

 

Chrome: 

=======

CHR Profile: C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-13]

CHR Extension: (Google Docs) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-13]

CHR Extension: (Google Drive) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-13]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-13]

CHR Extension: (YouTube) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-13]

CHR Extension: (Google Search) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-13]

CHR Extension: (Google Sheets) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-13]

CHR Extension: (Avast Online Security) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-13]

CHR Extension: (Google Wallet) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-13]

CHR Extension: (Gmail) - C:\Users\Rubie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-13]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-09-27]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-27] (AVAST Software)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [701824 2014-12-24] ()

R2 Everything; C:\Program Files (x86)\Everything\Everything.exe [1048576 2014-08-05] () [File not signed] <==== ATTENTION

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-16] (NVIDIA Corporation)

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-08] (Hewlett-Packard Co.) [File not signed]

R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-12-02] (LogMeIn, Inc.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-16] (NVIDIA Corporation)

S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-17] (Electronic Arts)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-11-07] ()

S2 WLMS; C:\Windows\system32\wlms\wlms.exe [19456 2009-07-14] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-27] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-27] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-27] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-27] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-21] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-09-27] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-27] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-27] ()

R1 ElRawDisk; C:\Windows\system32\drivers\rsdrvx64.sys [26024 2009-02-12] (EldoS Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-06] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-01-05] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]

S3 GPU-Z; \??\C:\Users\Rubie\AppData\Local\Temp\GPU-Z.sys [X]

S3 X6va017; \??\C:\Windows\SysWOW64\Drivers\X6va017 [X]

S3 X6va027; \??\C:\Windows\SysWOW64\Drivers\X6va027 [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-06 16:22 - 2015-01-06 16:22 - 02123776 _____ (Farbar) C:\Users\Rubie\Downloads\FRST64 (1).exe

2015-01-05 03:38 - 2015-01-05 03:38 - 00000000 ____D () C:\Users\Rubie\Documents\Square Enix

2015-01-05 01:25 - 2015-01-05 01:25 - 00020992 _____ (Microsoft Corporation) C:\Users\Rubie\Downloads\svchost.exe

2015-01-05 01:24 - 2015-01-05 01:24 - 00000000 ____D () C:\Users\Rubie\Downloads\ProcessExplorer

2015-01-05 01:17 - 2015-01-05 01:18 - 177998224 _____ (NVIDIA Corporation) C:\Users\Rubie\Downloads\314.22-desktop-win8-win7-winvista-64bit-english-whql.exe

2015-01-05 01:07 - 2015-01-05 01:07 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TechPowerUp GPU-Z

2015-01-05 01:07 - 2015-01-05 01:07 - 00000000 ____D () C:\Program Files (x86)\GPU-Z

2015-01-05 01:06 - 2015-01-05 01:06 - 01689384 _____ (techPowerUp (www.techpowerup.com)) C:\Users\Rubie\Downloads\GPU-Z.0.8.0.exe

2015-01-05 00:59 - 2015-01-05 00:59 - 00035058 _____ () C:\Users\Rubie\Downloads\Addition.txt

2015-01-05 00:58 - 2015-01-06 16:22 - 00014812 _____ () C:\Users\Rubie\Downloads\FRST.txt

2015-01-05 00:58 - 2015-01-06 16:22 - 00000000 ____D () C:\FRST

2015-01-05 00:57 - 2015-01-05 00:57 - 02123776 _____ (Farbar) C:\Users\Rubie\Downloads\FRST64.exe

2015-01-05 00:42 - 2015-01-05 00:42 - 00000000 ____D () C:\Users\Rubie\Downloads\2015-01-03d-win

2015-01-05 00:30 - 2015-01-05 00:30 - 00035064 _____ () C:\Windows\system32\Drivers\TrueSight.sys

2015-01-05 00:30 - 2015-01-05 00:30 - 00000000 ____D () C:\ProgramData\RogueKiller

2015-01-05 00:28 - 2015-01-05 00:29 - 15298136 _____ () C:\Users\Rubie\Downloads\RogueKiller.exe

2015-01-04 23:57 - 2015-01-04 23:57 - 00018024 _____ () C:\ComboFix.txt

2015-01-04 23:45 - 2015-01-04 23:57 - 00000000 ____D () C:\Qoobox

2015-01-04 23:45 - 2015-01-04 23:55 - 00000000 ____D () C:\Windows\erdnt

2015-01-04 23:45 - 2011-06-26 01:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-01-04 23:45 - 2010-11-07 12:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-01-04 23:45 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-01-04 23:45 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-01-04 23:45 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-01-04 23:45 - 2000-08-30 19:00 - 00098816 _____ () C:\Windows\sed.exe

2015-01-04 23:45 - 2000-08-30 19:00 - 00080412 _____ () C:\Windows\grep.exe

2015-01-04 23:45 - 2000-08-30 19:00 - 00068096 _____ () C:\Windows\zip.exe

2015-01-04 23:44 - 2015-01-04 23:44 - 05609498 ____R (Swearware) C:\Users\Rubie\Desktop\ComboFix.exe

2015-01-04 23:34 - 2015-01-04 23:42 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-01-04 23:32 - 2015-01-04 23:42 - 00000000 ____D () C:\Users\Rubie\Desktop\mbar

2015-01-04 23:32 - 2015-01-04 23:32 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Rubie\Downloads\mbar-1.08.2.1001.exe

2015-01-04 23:29 - 2015-01-04 23:29 - 04187592 _____ (Kaspersky Lab ZAO) C:\Users\Rubie\Downloads\tdsskiller.exe

2015-01-04 23:00 - 2015-01-04 23:23 - 312815616 _____ () C:\Users\Rubie\Downloads\kav_rescue_10.iso

2015-01-04 22:58 - 2015-01-04 23:00 - 90720296 _____ () C:\Users\Rubie\Downloads\2015-01-03d-win.zip

2015-01-04 22:48 - 2015-01-04 22:48 - 01188194 _____ () C:\Users\Rubie\Downloads\ProcessExplorer.zip

2015-01-04 19:44 - 2015-01-04 19:44 - 00000000 ____D () C:\Users\Rubie\Downloads\openhardwaremonitor-v0.7.1-beta

2015-01-04 19:43 - 2015-01-04 19:43 - 00511764 _____ () C:\Users\Rubie\Downloads\openhardwaremonitor-v0.7.1-beta.zip

2014-12-31 00:08 - 2014-12-31 00:13 - 00723475 _____ () C:\Users\Rubie\Documents\Mumble-2014-12-31-00-08-22-voice-us-east-1.balefulgaming.com-Mixdown.ogg

2014-12-30 19:37 - 2015-01-06 15:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-30 19:37 - 2015-01-04 23:34 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-12-30 19:37 - 2014-12-30 19:37 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-30 19:37 - 2014-12-30 19:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-30 19:37 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-12-30 19:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-12-30 19:36 - 2014-12-30 19:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-30 19:36 - 2014-12-30 19:36 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Rubie\Downloads\mbam-setup-2.0.4.1028.exe

2014-12-30 19:36 - 2014-12-30 19:36 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-30 18:35 - 2014-12-30 18:35 - 00000000 ____D () C:\ProgramData\Steam

2014-12-30 02:39 - 2014-12-30 02:39 - 00003240 _____ () C:\Windows\System32\Tasks\Steam_x64-S-2-106-91

2014-12-29 21:11 - 2014-12-29 21:19 - 00000494 _____ () C:\Users\Rubie\Desktop\config.ini

2014-12-29 21:10 - 2014-08-26 02:10 - 00973312 _____ (GameplayCrush) C:\Users\Rubie\Desktop\WindowedBorderlessGaming.exe

2014-12-29 21:09 - 2014-12-29 21:09 - 00554614 _____ () C:\Users\Rubie\Downloads\WindowedBorderlessGaming_2.1.0.0.zip

2014-12-29 21:02 - 2014-12-29 21:02 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\DarkSoulsII

2014-12-29 04:47 - 2014-12-29 04:47 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\qBittorrent

2014-12-29 04:43 - 2014-12-29 05:09 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\qBittorrent

2014-12-29 04:43 - 2014-12-29 04:43 - 00000000 ____D () C:\Users\Rubie\AppData\Local\qBittorrent

2014-12-29 04:42 - 2014-12-29 04:43 - 10509452 _____ (The qBittorrent project) C:\Users\Rubie\Downloads\qbittorrent_3.1.9.2_setup.exe

2014-12-29 04:33 - 2014-12-29 04:33 - 00003077 _____ () C:\Users\Rubie\Downloads\hgnb.py

2014-12-29 04:31 - 2014-12-29 04:32 - 00007129 _____ () C:\Users\Rubie\Downloads\waller.py

2014-12-29 04:21 - 2014-12-29 04:21 - 00005637 _____ () C:\Users\Rubie\Downloads\oldpbay.txt

2014-12-29 04:21 - 2014-12-29 04:21 - 00005637 _____ () C:\Users\Rubie\Downloads\oldpbay.py

2014-12-29 04:19 - 2014-12-29 04:19 - 00005693 _____ () C:\Users\Rubie\Downloads\original21.txt

2014-12-29 04:12 - 2014-12-29 04:14 - 00005693 _____ () C:\Users\Rubie\Downloads\search.py

2014-12-28 22:56 - 2014-12-28 22:56 - 09249728 _____ () C:\Users\Rubie\Downloads\Portal_Turrets_Sound_Pack.ts3_soundpack

2014-12-28 20:23 - 2014-12-28 20:23 - 00000000 ____D () C:\Users\Rubie\AppData\Local\next car game free technology demo

2014-12-28 20:21 - 2014-12-28 20:21 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Next Car Game Free Technology Demo

2014-12-28 20:21 - 2014-12-28 20:21 - 00000000 ____D () C:\Program Files (x86)\Next Car Game Free Technology Demo

2014-12-28 19:42 - 2014-12-28 19:50 - 122688622 _____ (Bugbear Entertainment) C:\Users\Rubie\Downloads\Next_Car_Game_Free_Technology_Demo.exe

2014-12-28 19:07 - 2014-12-28 19:07 - 00000020 _____ () C:\Users\Rubie\Downloads\games for multiplayer.txt

2014-12-28 03:16 - 2014-12-28 03:16 - 00000000 ____D () C:\Users\Rubie\AppData\Local\My Games

2014-12-24 23:30 - 2014-12-24 23:30 - 00000536 _____ () C:\Windows\eReg.dat

2014-12-24 23:30 - 2014-12-24 23:30 - 00000000 ____D () C:\Program Files (x86)\Maxis

2014-12-24 22:33 - 2014-12-24 22:37 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Equalify

2014-12-24 22:31 - 2014-12-24 22:31 - 00000000 ____D () C:\Users\Rubie\Downloads\rack cityy

2014-12-24 16:06 - 2014-12-24 16:11 - 00000188 _____ () C:\Users\Rubie\Desktop\Good Looks Test.txt

2014-12-19 18:35 - 2014-12-19 18:46 - 00000000 ____D () C:\Users\Rubie\AppData\Local\join.me

2014-12-19 18:35 - 2014-12-19 18:35 - 00001098 _____ () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\join.me.lnk

2014-12-19 18:35 - 2014-12-19 18:35 - 00001092 _____ () C:\Users\Rubie\Desktop\join.me.lnk

2014-12-19 18:35 - 2014-12-19 18:35 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\join.me

2014-12-19 18:34 - 2014-12-19 18:34 - 16899072 _____ () C:\Users\Rubie\Downloads\join.me.msi

2014-12-18 23:49 - 2015-01-04 23:21 - 00000000 ____D () C:\Users\Rubie\Downloads\real trap stuff

2014-12-18 22:19 - 2014-12-18 22:19 - 00050127 _____ () C:\Users\Rubie\Downloads\JSTOR  The Journal of Human Resources, Vol. 36, No. 2 (Spring, 2001), pp. 253-273.htm

2014-12-18 22:19 - 2014-12-18 22:19 - 00000000 ____D () C:\Users\Rubie\Downloads\JSTOR  The Journal of Human Resources, Vol. 36, No. 2 (Spring, 2001), pp. 253-273_files

2014-12-17 21:27 - 2014-12-19 18:44 - 00000000 ____D () C:\Users\Rubie\AppData\Local\osu!

2014-12-17 21:27 - 2014-12-17 21:27 - 00000950 _____ () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\osu!.lnk

2014-12-17 21:27 - 2014-12-17 21:27 - 00000942 _____ () C:\Users\Rubie\Desktop\osu!.lnk

2014-12-17 21:26 - 2014-12-17 21:26 - 03160648 _____ (ppy) C:\Users\Rubie\Downloads\osu!install.exe

2014-12-17 17:28 - 2014-12-17 17:28 - 00000990 _____ () C:\Users\Public\Desktop\Configure ReClock.lnk

2014-12-17 17:28 - 2014-12-17 17:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SVP 3.1

2014-12-17 17:28 - 2014-12-17 17:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReClock

2014-12-17 17:28 - 2014-12-17 17:28 - 00000000 ____D () C:\Program Files (x86)\ReClock

2014-12-17 17:27 - 2014-12-17 17:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow

2014-12-17 17:27 - 2014-12-17 17:27 - 00000000 ____D () C:\Program Files (x86)\ffdshow

2014-12-17 17:27 - 2014-02-09 20:36 - 00112640 _____ () C:\Windows\SysWOW64\ff_vfw.dll

2014-12-17 17:26 - 2014-12-17 17:26 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5

2014-12-17 17:26 - 2014-12-17 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5

2014-12-17 17:26 - 2014-12-17 17:26 - 00000000 ____D () C:\Program Files (x86)\AviSynth 2.5

2014-12-17 17:25 - 2014-12-17 17:29 - 00000000 ____D () C:\ProgramData\SVP 3.1

2014-12-17 17:25 - 2014-12-17 17:28 - 00000000 ____D () C:\Program Files (x86)\SVP

2014-12-17 17:25 - 2014-12-17 17:25 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\MPC-HC

2014-12-17 17:24 - 2014-12-17 17:24 - 00001702 _____ () C:\Users\Rubie\Desktop\MPC-HC x64.lnk

2014-12-17 17:24 - 2014-12-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC x64

2014-12-17 17:24 - 2014-12-17 17:24 - 00000000 ____D () C:\Program Files\MPC-HC

2014-12-17 17:21 - 2014-12-17 17:22 - 34398836 _____ (SmoothVideo Project ) C:\Users\Rubie\Downloads\SVP_3.1.6.exe

2014-12-16 18:53 - 2014-12-16 18:53 - 03456095 _____ () C:\Users\Rubie\Downloads\a91f9670_DSC_1354.jpeg

2014-12-16 16:49 - 2014-12-16 16:49 - 00137888 _____ (Spotify Ltd) C:\Users\Rubie\Downloads\SpotifySetup.exe

2014-12-15 15:09 - 2014-12-15 15:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-12-13 22:10 - 2014-12-13 22:10 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Need for Speed World

2014-12-13 21:32 - 2014-12-13 21:32 - 00002259 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-12-13 21:32 - 2014-12-13 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-12-13 21:31 - 2015-01-06 15:39 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-13 21:31 - 2015-01-06 01:36 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-13 21:31 - 2014-12-13 21:31 - 00003892 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-12-13 21:31 - 2014-12-13 21:31 - 00003640 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-12-13 21:30 - 2014-12-13 21:30 - 00880784 _____ (Google Inc.) C:\Users\Rubie\Downloads\ChromeSetup.exe

2014-12-13 20:51 - 2014-12-13 20:51 - 00000000 ____D () C:\Users\Rubie\AppData\Local\Electronic_Arts_Inc

2014-12-13 20:36 - 2014-12-13 20:36 - 00000000 ____D () C:\Users\Rubie\Downloads\PokeMMO-Client

2014-12-13 20:35 - 2014-12-13 20:48 - 00001274 _____ () C:\Users\Public\Desktop\Need for Speed World.lnk

2014-12-13 20:35 - 2014-12-13 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed World

2014-12-13 20:34 - 2014-12-13 20:34 - 00001520 _____ () C:\Users\Public\Desktop\SimCity 2000 Special Edition.lnk

2014-12-13 20:34 - 2014-12-13 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SimCity 2000 Special Edition

2014-12-13 20:28 - 2014-12-13 20:28 - 12457183 _____ () C:\Users\Rubie\Downloads\PokeMMO-Client.zip

2014-12-13 20:07 - 2014-12-13 20:07 - 17103000 _____ (Electronic Arts, Inc.) C:\Users\Rubie\Downloads\OriginThinSetup.exe

2014-12-13 17:58 - 2014-12-13 17:59 - 00000000 ____D () C:\Program Files\Virtual Audio Cable

2014-12-13 17:58 - 2014-12-13 17:58 - 00066728 _____ (Eugene V. Muzychenko) C:\Windows\system32\Drivers\vrtaucbl.sys

2014-12-13 17:58 - 2014-12-13 17:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Audio Cable

2014-12-13 17:55 - 2014-12-13 17:55 - 00000000 ____D () C:\Users\Rubie\Downloads\Virtual Audio Cable 4.10 - vac410full

2014-12-13 17:54 - 2014-12-13 17:54 - 00387040 _____ () C:\Users\Rubie\Downloads\Virtual Audio Cable 4.10 - vac410full.zip

2014-12-13 17:53 - 2014-12-13 17:54 - 03827720 _____ (foobar2000.org) C:\Users\Rubie\Downloads\foobar2000_v1.3.6.exe

2014-12-13 17:22 - 2014-12-13 17:22 - 00304351 _____ () C:\Users\Rubie\Downloads\aim_prac_headshots-b1.zip

2014-12-10 18:50 - 2014-12-10 18:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-12-09 18:50 - 2014-12-09 18:50 - 00000000 ____D () C:\Users\Rubie\AppData\Local\Blizzard

2014-12-09 18:18 - 2014-12-09 18:50 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-12-09 18:18 - 2014-12-09 18:18 - 00001185 _____ () C:\Users\Public\Desktop\Hearthstone.lnk

2014-12-09 18:18 - 2014-12-09 18:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone

2014-12-09 18:09 - 2014-12-09 20:00 - 00000000 ____D () C:\Users\Rubie\AppData\Local\Battle.net

2014-12-09 18:09 - 2014-12-09 18:15 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Battle.net

2014-12-09 18:09 - 2014-12-09 18:09 - 00000000 ____D () C:\Users\Rubie\AppData\Local\Blizzard Entertainment

2014-12-09 18:09 - 2014-12-09 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net

2014-12-09 18:09 - 2014-12-09 18:09 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment

2014-12-09 18:09 - 2014-12-09 18:09 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-12-09 18:06 - 2014-12-09 18:06 - 00000000 ____D () C:\ProgramData\Battle.net

2014-12-09 17:07 - 2014-12-09 17:07 - 00011630 _____ () C:\Users\Rubie\Downloads\install_old_windows.txt

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-06 16:19 - 2014-11-02 15:38 - 00000000 ____D () C:\Users\Rubie\AppData\Local\LogMeIn Hamachi

2015-01-06 16:19 - 2014-10-31 20:01 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\TeamViewer

2015-01-06 16:19 - 2014-09-29 20:33 - 00000000 ____D () C:\Program Files (x86)\Steam

2015-01-06 16:19 - 2009-07-14 00:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-01-06 16:18 - 2014-10-08 16:51 - 00000000 ____D () C:\Windows\Minidump

2015-01-06 15:44 - 2009-07-13 23:45 - 00011760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-06 15:44 - 2009-07-13 23:45 - 00011760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-06 15:42 - 2014-10-29 16:39 - 00183783 ____N () C:\Windows\WindowsUpdate.log

2015-01-06 15:42 - 2014-09-27 11:30 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-06 15:39 - 2014-09-27 22:46 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-01-06 15:39 - 2014-09-27 11:10 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-01-06 15:39 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-06 01:42 - 2014-11-23 13:56 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Everything

2015-01-06 00:31 - 2014-10-05 19:14 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Spotify

2015-01-05 15:52 - 2014-10-05 19:15 - 00000000 ____D () C:\Users\Rubie\AppData\Local\Spotify

2015-01-05 01:49 - 2014-11-04 16:44 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Mumble

2015-01-04 23:57 - 2009-07-13 22:20 - 00000000 __RHD () C:\Users\Default

2015-01-04 23:55 - 2009-07-13 21:34 - 00000215 _____ () C:\Windows\system.ini

2015-01-04 23:52 - 2014-09-27 21:28 - 00000000 ____D () C:\ProgramData\TEMP

2014-12-31 22:35 - 2014-10-24 19:09 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\TS3Client

2014-12-31 20:39 - 2014-10-31 19:33 - 00000000 ____D () C:\Users\Rubie\AppData\Local\ArmA 2 OA

2014-12-30 19:47 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Help

2014-12-30 19:37 - 2014-09-27 20:42 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\foobar2000

2014-12-30 18:31 - 2014-10-04 14:20 - 00000000 ____D () C:\Program Files\PeerBlock

2014-12-30 02:55 - 2014-10-28 17:30 - 00000000 ____D () C:\Windows\SysWOW64\directx

2014-12-30 02:39 - 2014-10-18 12:53 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Audacity

2014-12-30 02:38 - 2014-11-28 19:44 - 00000000 ____D () C:\Games

2014-12-29 04:47 - 2014-10-04 13:33 - 00000000 ____D () C:\Program Files (x86)\qBittorrent

2014-12-28 03:24 - 2014-09-29 21:32 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2014-12-28 03:16 - 2014-10-16 20:09 - 00000000 ____D () C:\Users\Rubie\Documents\My Games

2014-12-25 22:24 - 2014-11-30 16:50 - 00000000 ____D () C:\Program Files (x86)\ggRO

2014-12-25 00:13 - 2014-09-27 20:56 - 00000000 ____D () C:\ProgramData\Origin

2014-12-25 00:13 - 2014-09-27 20:56 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-12-24 23:31 - 2014-10-28 17:30 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-12-23 23:18 - 2009-07-14 00:13 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-19 17:54 - 2014-11-28 16:23 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\EurekaLog

2014-12-17 17:29 - 2014-09-29 21:32 - 00000000 ____D () C:\Users\Rubie\AppData\Roaming\NVIDIA

2014-12-16 16:50 - 2014-10-05 19:15 - 00001805 _____ () C:\Users\Rubie\Desktop\Spotify.lnk

2014-12-16 16:50 - 2014-10-05 19:15 - 00001791 _____ () C:\Users\Rubie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2014-12-16 15:48 - 2014-12-02 15:31 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi

2014-12-13 21:32 - 2014-09-27 11:08 - 00000000 ____D () C:\Users\Rubie\AppData\Local\Google

2014-12-13 21:32 - 2014-09-27 11:08 - 00000000 ____D () C:\Program Files (x86)\Google

2014-12-13 20:50 - 2014-09-27 20:56 - 00000000 ____D () C:\ProgramData\Electronic Arts

2014-12-13 20:34 - 2014-09-27 21:07 - 00000000 ____D () C:\Program Files (x86)\Origin Games

2014-12-13 17:54 - 2014-09-27 20:42 - 00001117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk

2014-12-13 17:54 - 2014-09-27 20:42 - 00001035 _____ () C:\Users\Public\Desktop\foobar2000.lnk

2014-12-13 17:54 - 2014-09-27 20:42 - 00000000 ____D () C:\Program Files (x86)\foobar2000

2014-12-12 18:17 - 2014-11-24 20:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-12-09 15:42 - 2014-09-27 11:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-12-09 15:42 - 2014-09-27 11:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-12-09 15:42 - 2014-09-27 11:30 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

 

Files to move or delete:

====================

C:\ProgramData\hash.dat

C:\Users\Rubie\jagex_cl_oldschool_LIVE.dat

C:\Users\Rubie\random.dat

 

 

Some content of TEMP:

====================

C:\Users\Rubie\AppData\Local\Temp\eauninstall.exe

C:\Users\Rubie\AppData\Local\Temp\SC4_uninst.exe

C:\Users\Rubie\AppData\Local\Temp\SimCity 4 Deluxe_uninst.exe

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-01-04 18:19

 

==================== End Of Log ============================

Link to post
Share on other sites
Dumplet

Dumplet

Posted
  • Author
Posted
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-01-2015

Ran by Rubie at 2015-01-05 00:59:08

Running from C:\Users\Rubie\Downloads

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

4500_G510nz_Help (x32 Version: 000.0.439.000 - Hewlett-Packard) Hidden

4500G510nz (x32 Version: 000.0.439.000 - Hewlett-Packard) Hidden

4500G510nz_Software_Min (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden

64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Addon Sync 2009 (HKLM-x32\...\{4E3AA543-09D7-401E-9DF2-2591D24C7C49}) (Version: 1.0.67 - YomaTools)

Adobe Flash Player 10 ActiveX (HKLM-x32\...\{922E8525-AC7E-4294-ACAA-43712D4423C0}) (Version: 10.0.22.87 - Adobe Systems, Inc.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Age of Empires II: HD Edition (HKLM-x32\...\{1194343F-ACFE-4AB4-B1C0-C1E913B729BF}_is1) (Version: 3.8.2662 - Microsoft Studios, Tolyak26)

Archeage (HKLM-x32\...\Glyph Archeage) (Version:  - Trion Worlds, Inc.)

Arma 2 (HKLM-x32\...\Steam App 33910) (Version:  - Bohemia Interactive)

ARMA 2: British Armed Forces - Data cache removal (HKLM-x32\...\A2BAF Data cache removal) (Version:  - )

Arma 2: British Armed Forces (HKLM-x32\...\Steam App 65700) (Version:  - Bohemia Interactive)

Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)

ARMA 2: Private Military Company - Data cache removal (HKLM-x32\...\A2PMC Data cache removal) (Version:  - )

Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)

Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)

avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)

AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)

Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.5.1 - EA Digital Illusions CE AB)

BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )

BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden

Bully Scholarship Edition (HKLM-x32\...\InstallShield_{A724605D-B399-4304-B8C7-33B3EF7D4677}) (Version: 1.00.0154 - Rockstar Games)

Bully Scholarship Edition (x32 Version: 1.00.0154 - Rockstar Games) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)

Chromium (HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\Chromium) (Version: 40.0.2172.0 - Chromium) <==== ATTENTION!

Counter-Strike (HKLM-x32\...\Steam App 10) (Version:  - Valve)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)

CPUID CPU-Z 1.71.1 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )

DARK SOULS™ II (HKLM-x32\...\Steam App 236430) (Version:  - FromSoftware, Inc)

DayZLauncher version 0.0.0.7 (HKLM-x32\...\{E31045B4-9DB5-44DF-9EBD-BD4CFDE640FD}_is1) (Version: 0.0.0.7 - Maca134)

Deus Ex: Human Revolution (HKLM-x32\...\Steam App 28050) (Version:  - Eidos Montreal)

Equalify v2.5.3 (Stable) (HKLM-x32\...\{33EC4F70-9F4B-406F-BB2A-F75A285E927D}) (Version: 2.5.3.0 - Equalify)

Everything 1.3.4.686 (x86) (HKLM-x32\...\Everything) (Version:  - )

ffdshow v1.3.4530 [2014-02-09] (HKLM-x32\...\ffdshow_is1) (Version: 1.3.4530.0 - )

foobar2000 v1.3.6 (HKLM-x32\...\foobar2000) (Version: 1.3.6 - Peter Pawlowski)

Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)

Geeks3D FurMark 1.15.0.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version:  - Geeks3D)

ggRO 1.0 (HKLM-x32\...\ggRO) (Version: 1.0 - )

Glyph (HKLM-x32\...\Glyph) (Version:  - Trion Worlds, Inc.)

GoldenEye: Source (HKLM-x32\...\GoldenEye Source) (Version: 4.2.4 - Team GoldenEye: Source)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Grand Theft Auto San Andreas + MultiPlayer [0.3e] (HKLM-x32\...\{E1D22FE1-AB5F-42CA-9480-6F70B96DDD88}_is1) (Version: 0.3(e) - RePack by -=M@N=-)

Gyazo 2.2 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version:  - Nota Inc.)

HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version:  - EFD Software)

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Hotline Miami (HKLM-x32\...\GOGPACKHOTLINEMIAMI_is1) (Version: 2.0.0.4 - GOG.com)

HP Officejet 4500 G510n-z (HKLM\...\{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}) (Version: 13.0 - HP)

Insurgency (HKLM-x32\...\Steam App 222880) (Version:  - New World Interactive)

Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)

join.me (HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\JoinMe) (Version: 1.18.0.189 - LogMeIn, Inc.)

Kerbal Space Program (HKLM-x32\...\Steam App 220200) (Version:  - Squad)

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)

League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden

LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.291 - LogMeIn, Inc.)

LogMeIn Hamachi (x32 Version: 2.2.0.291 - LogMeIn, Inc.) Hidden

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

MapleStory (HKLM-x32\...\Steam App 216150) (Version:  - Nexon)

Metro 2033 (HKLM-x32\...\Steam App 43110) (Version:  - 4A Games)

Microsoft .NET Framework 4.5.1 RC (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50861 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

MorphVOX Pro (HKLM-x32\...\{DE289787-7ECA-4BED-9D8C-99FAC407E3D6}) (Version: 4.3.13 - Screaming Bee)

Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)

MPC-HC 1.7.7 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.7 - MPC-HC Team)

MTA:SA v1.4.0 (HKLM-x32\...\MTA:SA 1.4) (Version: v1.4.0 - Multi Theft Auto)

Mumble 1.2.8 (HKLM-x32\...\{A9DBD31A-A09F-4C7E-86D1-3B21C59000D1}) (Version: 1.2.8 - Thorvald Natvig)

Need For Speed™ World (HKLM-x32\...\{3AF1B16A-7DC9-4C80-BAEC-70B088A7C5B8}) (Version: 1.0.0.0 - Electronic Arts)

Network64 (Version: 130.0.550.000 - Hewlett-Packard) Hidden

Next Car Game Free Technology Demo (HKLM-x32\...\Next Car Game Free Technology Demo) (Version:  - Bugbear Entertainment)

NVIDIA 3D Vision Controller Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)

NVIDIA Graphics Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)

NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)

Origin (HKLM-x32\...\Origin) (Version: 9.5.2.2829 - Electronic Arts, Inc.)

osu! (HKLM-x32\...\{3b800871-2351-4244-9768-bb65d4cfb6bb}) (Version: latest - ppy Pty Ltd)

PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version:  - OVERKILL - a Starbreeze Studio.)

PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)

PowerISO (HKLM-x32\...\PowerISO) (Version: 6.1 - Power Software Ltd)

PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.992 - Even Balance, Inc.)

Python 3.4.2 (HKLM-x32\...\{2583CDBA-8A53-4622-BB67-1D163714C1B4}) (Version: 3.4.16349 - Python Software Foundation)

qBittorrent 3.1.9.2 (HKLM-x32\...\qbittorrent) (Version: 3.1.9.2 - The qBittorrent project)

Ragnarok Online (HKLM-x32\...\{181579B5-0028-4E01-AC27-97ED80352279}) (Version: 14.2.4 - Gravity Interactive, Inc.)

Realm of the Mad God (HKLM-x32\...\Steam App 200210) (Version:  - Wild Shadow Studios)

ReClock (HKLM-x32\...\ReClock) (Version:  - SlySoft, Inc.)

Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)

Risk of Rain (HKLM-x32\...\Steam App 248820) (Version:  - )

Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden

Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)

SimCity 2000 Special Edition (HKLM-x32\...\{59D2C751-F7BE-4E9F-9C8C-1F16013802C7}) (Version: 2.0.0.1 - Electronic Arts)

SimCity 4 Deluxe (HKLM-x32\...\{A7A34FC9-DF24-4A36-00AD-D4EFE94CC116}) (Version:  - )

Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)

SmoothVideo Project version 3.1.6 (HKLM-x32\...\SmoothVideo Project_is1) (Version: 3.1.6 - SVP)

Source SDK Base 2007 (HKLM-x32\...\Steam App 218) (Version:  - Valve)

Speccy (HKLM\...\Speccy) (Version: 1.26 - Piriform)

Spiral Knights (HKLM-x32\...\Steam App 99900) (Version:  - Three Rings)

Spotify (HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

Sumotori Dreams (HKLM-x32\...\Sumotori Dreams) (Version:  - )

Sumotori Full Version (HKLM-x32\...\Sumotori Full Version) (Version:  - )

Super Crate Box (HKLM-x32\...\Steam App 212800) (Version:  - Vlambeer)

Synthesia (HKLM-x32\...\Synthesia) (Version: 9 - Synthesia LLC)

TalonRO Client 1.0.0 (HKLM-x32\...\TalonRO_is1) (Version: 1.0.0 - TalonRO)

TeamSpeak 3 Client (HKU\S-1-5-21-1243950774-1183063232-2593923303-1000\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)

TL-WN751ND Driver (HKLM-x32\...\{14770694-6C1C-4137-95F9-6F934D8491B4}) (Version: 1.00.0000 - TP-LINK)

Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden

TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 2.01.0012 - TP-LINK)

Unity Web Player (x64) (All users) (HKLM\...\UnityWebPlayer) (Version: 4.5.5f1 - Unity Technologies ApS)

Unturned (HKLM-x32\...\Steam App 304930) (Version:  - Nelson Sexton)

Virtual Audio Cable 4.10 (HKLM\...\Virtual Audio Cable 4.10) (Version:  - )

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden

Ys Origin (HKLM-x32\...\Steam App 207350) (Version:  - Nihon Falcom)

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

CustomCLSID: HKU\S-1-5-21-1243950774-1183063232-2593923303-1000_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> C:\Users\Rubie\AppData\Local\Chromium\Application\40.0.2172.0\delegate_execute.exe (The Chromium Authors) <==== ATTENTION

 

==================== Restore Points  =========================

 

29-12-2014 06:05:45 Scheduled Checkpoint

30-12-2014 02:56:05 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610

30-12-2014 02:56:30 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610

04-01-2015 23:45:28 ComboFix created restore point

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 21:34 - 2015-01-04 23:55 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {36E91BC1-796A-45B4-A89A-DF900530DF6D} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-27] (AVAST Software)

Task: {4C985EFA-24DA-45B9-885E-81D63E8FD408} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)

Task: {7BCF567C-2954-463C-8830-C9F7046354CA} - System32\Tasks\Steam_x64-S-2-106-91 => C:\Users\Rubie\AppData\Roaming\Audacity\CODEXi\Steam [2014-12-30] ()

Task: {8939887B-3AA0-4325-AE3D-AB614E51088B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-13] (Google Inc.)

Task: {9940AF4D-441A-4FC6-BC0B-23EB49202D19} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2014-07-03] ()

Task: {ED3D25C5-1B76-484F-97E8-8D18264A1DF0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09] (Adobe Systems Incorporated)

Task: {F7080B12-A56A-447C-8649-D873EE399A2C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-13] (Google Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (whitelisted) =============

 

2014-09-27 22:45 - 2014-09-13 16:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-11-23 13:56 - 2014-08-05 20:01 - 01048576 _____ () C:\Program Files (x86)\Everything\Everything.exe

2014-09-28 01:48 - 2014-11-07 15:53 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2015-01-05 00:28 - 2015-01-05 00:29 - 15298136 _____ () C:\Users\Rubie\Downloads\RogueKiller.exe

2014-09-27 11:08 - 2014-09-27 11:08 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll

2015-01-04 18:01 - 2015-01-04 18:01 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010401\algo.dll

2014-09-27 11:08 - 2014-09-27 11:08 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-12-13 21:32 - 2014-12-05 20:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll

2014-12-13 21:32 - 2014-12-05 20:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll

2014-12-13 21:32 - 2014-12-05 20:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll

2014-12-13 21:32 - 2014-12-05 20:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll

2014-12-13 21:32 - 2014-12-05 20:50 - 14913352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

AlternateDataStreams: C:\ProgramData:NT

AlternateDataStreams: C:\ProgramData:NT2

AlternateDataStreams: C:\Users\All Users:NT

AlternateDataStreams: C:\Users\All Users:NT2

AlternateDataStreams: C:\ProgramData\Application Data:NT

AlternateDataStreams: C:\ProgramData\Application Data:NT2

AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT

AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2

AlternateDataStreams: C:\ProgramData\TEMP:C76EDAC3

AlternateDataStreams: C:\Users\Rubie\Application Data:NT

AlternateDataStreams: C:\Users\Rubie\Application Data:NT2

AlternateDataStreams: C:\Users\Rubie\AppData\Roaming:NT

AlternateDataStreams: C:\Users\Rubie\AppData\Roaming:NT2

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

 

==================== EXE Association (whitelisted) =============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== MSCONFIG/TASK MANAGER disabled items =========

 

(Currently there is no automatic fix for this section.)

 

MSCONFIG\startupreg: Spotify => "C:\Users\Rubie\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

 

========================= Accounts: ==========================

 

Administrator (S-1-5-21-1243950774-1183063232-2593923303-500 - Administrator - Disabled)

Guest (S-1-5-21-1243950774-1183063232-2593923303-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1243950774-1183063232-2593923303-1002 - Limited - Enabled)

Rubie (S-1-5-21-1243950774-1183063232-2593923303-1000 - Administrator - Enabled) => C:\Users\Rubie

 

==================== Faulty Device Manager Devices =============

 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

Name: Ethernet Controller

Description: Ethernet Controller

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

Name: Officejet 4500 G510n-z

Description: Officejet 4500 G510n-z

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (12/31/2014 08:14:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: DayZLauncher.exe, version: 0.0.0.7, time stamp: 0x53f87bec

Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdbdf

Exception code: 0xe0434352

Fault offset: 0x0000b727

Faulting process id: 0x17ec

Faulting application start time: 0xDayZLauncher.exe0

Faulting application path: DayZLauncher.exe1

Faulting module path: DayZLauncher.exe2

Report Id: DayZLauncher.exe3

 

Error: (12/31/2014 08:14:22 PM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: DayZLauncher.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.ComponentModel.Win32Exception

Stack:

   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)

   at System.Windows.Threading.DispatcherOperation.InvokeImpl()

   at System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)

   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)

   at System.Windows.Threading.DispatcherOperation.Invoke()

   at System.Windows.Threading.Dispatcher.ProcessQueue()

   at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)

   at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)

   at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)

   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)

   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)

   at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)

   at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)

   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)

   at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)

   at System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)

   at System.Windows.Threading.Dispatcher.Run()

   at System.Windows.Application.RunDispatcher(System.Object)

   at System.Windows.Application.RunInternal(System.Windows.Window)

   at System.Windows.Application.Run(System.Windows.Window)

   at DayZLauncher.App.Main(System.String[])

 

Error: (12/28/2014 05:55:43 AM) (Source: System Restore) (EventID: 8211) (User: )

Description: The scheduled restore point could not be created.  Additional information: (0x8004230f).

 

Error: (12/28/2014 05:55:43 AM) (Source: System Restore) (EventID: 8193) (User: )

Description: Failed to create restore point (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Description = Scheduled Checkpoint; Error = 0x8004230f).

 

Error: (12/28/2014 05:55:42 AM) (Source: VSS) (EventID: 12293) (User: )

Description: Volume Shadow Copy Service error: Error calling a routine on a Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine details EndPrepareSnapshots({b0e5ba6e-e1aa-4fc3-84d8-eb9b84d0dbea}) [hr = 0x80070008, Not enough storage is available to process this command.

].

 

 

Operation:

   Executing Asynchronous Operation

 

Context:

   Current State: DoSnapshotSet

 

Error: (12/27/2014 03:50:48 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.

.

 

Error: (12/27/2014 03:50:02 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.

.

 

Error: (12/27/2014 03:26:11 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.

.

 

Error: (12/27/2014 02:59:59 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.

.

 

Error: (12/27/2014 02:29:34 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: The data is invalid.

.

 

 

System errors:

=============

Error: (01/05/2015 00:30:24 AM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \??\C:\Windows\System32\drivers\TrueSight.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

 

Error: (01/05/2015 00:02:32 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

cdrom

 

Error: (01/04/2015 11:55:16 PM) (Source: Service Control Manager) (EventID: 7030) (User: )

Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

 

Error: (01/04/2015 11:54:45 PM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

 

Error: (01/04/2015 11:51:58 PM) (Source: Service Control Manager) (EventID: 7030) (User: )

Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

 

Error: (01/04/2015 10:07:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

cdrom

 

Error: (01/04/2015 10:07:26 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 9:11:21 PM on ‎1/‎4/‎2015 was unexpected.

 

Error: (01/04/2015 07:37:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

cdrom

 

Error: (01/04/2015 07:37:21 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 7:32:08 PM on ‎1/‎4/‎2015 was unexpected.

 

Error: (01/04/2015 06:01:08 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

cdrom

 

 

Microsoft Office Sessions:

=========================

Error: (12/31/2014 08:14:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: DayZLauncher.exe0.0.0.753f87becKERNELBASE.dll6.1.7600.163854a5bdbdfe04343520000b72717ec01d0255a936f743aC:\Program Files (x86)\DayZLauncher\DayZLauncher.exeC:\Windows\syswow64\KERNELBASE.dll8584fa58-9153-11e4-8bae-e1772b6d143c

 

Error: (12/31/2014 08:14:22 PM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: DayZLauncher.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.ComponentModel.Win32Exception

Stack:

   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)

   at System.Windows.Threading.DispatcherOperation.InvokeImpl()

   at System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)

   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)

   at System.Windows.Threading.DispatcherOperation.Invoke()

   at System.Windows.Threading.Dispatcher.ProcessQueue()

   at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)

   at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)

   at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)

   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)

   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)

   at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)

   at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)

   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)

   at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)

   at System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)

   at System.Windows.Threading.Dispatcher.Run()

   at System.Windows.Application.RunDispatcher(System.Object)

   at System.Windows.Application.RunInternal(System.Windows.Window)

   at System.Windows.Application.Run(System.Windows.Window)

   at DayZLauncher.App.Main(System.String[])

 

Error: (12/28/2014 05:55:43 AM) (Source: System Restore) (EventID: 8211) (User: )

Description: 0x8004230f

 

Error: (12/28/2014 05:55:43 AM) (Source: System Restore) (EventID: 8193) (User: )

Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationScheduled Checkpoint0x8004230f

 

Error: (12/28/2014 05:55:42 AM) (Source: VSS) (EventID: 12293) (User: )

Description: {b5946137-7b9f-4925-af80-51abd60b20d5}EndPrepareSnapshots({b0e5ba6e-e1aa-4fc3-84d8-eb9b84d0dbea})0x80070008, Not enough storage is available to process this command.

 

 

Operation:

   Executing Asynchronous Operation

 

Context:

   Current State: DoSnapshotSet

 

Error: (12/27/2014 03:50:48 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )


 

Error: (12/27/2014 03:50:02 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )


 

Error: (12/27/2014 03:26:11 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )


 

Error: (12/27/2014 02:59:59 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )


 

Error: (12/27/2014 02:29:34 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )


 

 

CodeIntegrity Errors:

===================================

  Date: 2015-01-04 23:54:45.768

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2015-01-04 23:54:45.753

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

 

==================== Memory info =========================== 

 

Processor: AMD FX-4130 Quad-Core Processor 

Percentage of memory in use: 64%

Total physical RAM: 4078.12 MB

Available physical RAM: 1464.41 MB

Total Pagefile: 8154.38 MB

Available Pagefile: 5616.16 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:931.41 GB) (Free:652.32 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 9BBC9CC0)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

 

==================== End Of Log ============================

Link to post
Share on other sites
_argus

_argus

Posted
Posted

Download 51a5f31352b88-icon_MBAR.pngMalwarebytes Anti-Rootkit to your desktop.

  • Double-click the icon to start the tool.
  • It will ask you where to extract it, then it will start.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Click in the introduction screen "next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder and paste the content of the following files in your next reply:
    • "mbar-log-{date} (xx-xx-xx).txt"
    • "system-log.txt"


 

 

 

 

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif
icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif


Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.



Please attach it to your reply.

 

fixlist.txt

Link to post
Share on other sites
_argus

_argus

Posted
Posted

Logs doesn't show active infection. I think it is hardware problem.

 

 

Download DelFix by Xplode and save it to your desktop.

  • Run the tool by right click on the 51a5ce45263de-delfix.png icon and Run as administrator option.
  • Make sure that these ones are checked:
    • Remove disinfection tools
    • Purge system restore
    • Reset system settings

    [*]Push Run and wait until the tool completes his work. [*]All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)


The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.