Jump to content

Help Removing (you guessed it) Cryptowall 3.0

Wesreidau

By Wesreidau
in Resolved Malware Removal Logs

 Share

Recommended Posts

TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Hello,

They call me TwinHeadedEagle around here, and I'll be working with you.

Before we start please read and note the following:

  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
  • Note that we may live in totally different time zones, what may cause some delays between answers.
  • Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
:excl: I can't foresee everything, so if anything unexpected happens, please stop and inform me!

:excl: There are no silly questions. Never be afraid to ask if in doubt!

warning.gif Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Download 51a5f31352b88-icon_MBAR.pngMalwarebytes Anti-Rootkit to your desktop.

  • Double-click the icon to start the tool.
  • It will ask you where to extract it, then it will start.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Click in the introduction screen "next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"
FRST.gif Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please include their content into your next reply.
Link to post
Share on other sites
Wesreidau

Wesreidau

Posted
  • Author
Posted
As per instructions;

 

Malwarebytes Anti-Rootkit BETA 1.08.3.1004

www.malwarebytes.org

 

Database version:

  main:    v2015.02.03.07

  rootkit: v2015.02.03.01

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.17501

Commander :: BMP-2B [administrator]

 

2/3/2015 3:17:02 PM

mbar-log-2015-02-03 (15-17-02).txt

 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: 

Objects scanned: 379389

Time elapsed: 14 minute(s), 46 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 0

(No malicious items detected)

 

Physical Sectors Detected: 0

(No malicious items detected)

 

(end)

 

 

 


Malwarebytes Anti-Rootkit BETA 1.08.3.1004

www.malwarebytes.org

 

Database version:

  main:    v2015.02.03.07

  rootkit: v2015.02.03.01

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.17501

Commander :: BMP-2B [administrator]

 

2/3/2015 3:17:02 PM

mbar-log-2015-02-03 (15-17-02).txt

 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: 

Objects scanned: 379389

Time elapsed: 14 minute(s), 46 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 0

(No malicious items detected)

 

Physical Sectors Detected: 0

(No malicious items detected)

 

(end)

 

 

 

 


Malwarebytes Anti-Rootkit BETA 1.08.3.1004

www.malwarebytes.org

 

Database version:

  main:    v2015.02.03.07

  rootkit: v2015.02.03.01

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.17501

Commander :: BMP-2B [administrator]

 

2/3/2015 3:17:02 PM

mbar-log-2015-02-03 (15-17-02).txt

 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: 

Objects scanned: 379389

Time elapsed: 14 minute(s), 46 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 0

(No malicious items detected)

 

Physical Sectors Detected: 0

(No malicious items detected)

 

(end)

 

 

 


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015

Ran by Commander at 2015-02-03 15:35:30

Running from C:\Users\Commander\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.03) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)

Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)

ATT Management Agent (HKLM-x32\...\ATT-AT&T Troubleshoot & Resolve) (Version: 8.4.1.12 - AT&T)

Awesomium Redistributable (HKLM-x32\...\{5BCB064B-9F65-4E15-BAFB-669E72E54FD9}) (Version: 1.7.4.2 - SIX Networks GmbH)

AwesomiumSetup (HKLM-x32\...\{19EF99D1-7EE6-4B5E-ABEE-0B3825F703B0}) (Version: 1.00.0000 - SIX Networks GmbH)

Banished (HKLM-x32\...\1207660783_is1) (Version: 2.3.0.7 - GOG.com)

BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )

Blue Sun Mod 2.1 (12.02.2014) (HKLM-x32\...\{1258D48E-9101-417B-B3DD-79EF1B1F70D4}_is1) (Version: 2.1 - Sprut)

Build and Shoot Launcher 1.2 (HKLM-x32\...\Build and Shoot Launcher) (Version: 1.2 - Buld Then Snip, LLC)

BYOND (HKLM-x32\...\BYOND) (Version: 504.1234 - BYOND) <==== ATTENTION!

CamStudio 2.7.2 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source)

CCV Patch 501a (HKLM-x32\...\CCV Patch 501a) (Version:  - Atomic (Unsupported))

Chivalry: Medieval Warfare (HKLM-x32\...\Steam App 219640) (Version:  - Torn Banner Studios)

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)

Close Combat Cross of Iron (HKLM-x32\...\Close Combat Cross of Iron1.00) (Version: 1.00 - Matrix Games)

Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)

DAEMON Tools Ultra (HKLM-x32\...\DAEMON Tools Ultra) (Version: 1.1.0.0103 - Disc Soft Ltd)

DCS World (HKLM-x32\...\Steam App 223750) (Version:  - Eagle Dynamics)

DEFCON (HKLM-x32\...\Steam App 1520) (Version:  - Introversion Software)

Deus Ex: Game of the Year Edition (HKLM-x32\...\Steam App 6910) (Version:  - Ion Storm)

Deus Ex: Human Revolution (HKLM-x32\...\Steam App 28050) (Version:  - Eidos Montreal)

DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)

Easy Auto Clicker (HKLM-x32\...\Easy Auto Clicker_is1) (Version: V2.0 - easyautoclicker.com)

Edimax Wireless LAN Driver and Utility (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0165 - Edimax Technology Co.)

Elder Kings CK2 Total Conversion (HKU\S-1-5-21-3025731626-3237982839-744267471-1001\...\Elder Kings CK2 Total Conversion 0.1.5) (Version: 0.1.5 - Elder Kings Team)

EVGA Precision X 4.0.0 (HKLM-x32\...\PrecisionX) (Version: 4.0.0 - EVGA Corporation)

FileZilla Client 3.7.3 (HKU\S-1-5-21-3025731626-3237982839-744267471-1001\...\FileZilla Client) (Version: 3.7.3 - Tim Kosse)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.94 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Heroes & Generals (HKLM-x32\...\Steam App 227940) (Version:  - Reto-Moto)

Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Kerbal Space Program (HKLM-x32\...\Steam App 220200) (Version:  - Squad)

Life is Feudal: Your Own (HKLM-x32\...\Steam App 290080) (Version:  - Bitbox Ltd.)

LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.291 - LogMeIn, Inc.)

LogMeIn Hamachi (x32 Version: 2.2.0.291 - LogMeIn, Inc.) Hidden

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Men of War: Assault Squad 2 (HKLM-x32\...\Steam App 244450) (Version:  - Digitalmindsoft)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Close Combat III (HKLM-x32\...\Close Combat 3.00) (Version:  - )

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Word 2010 (HKLM\...\Office14.WORD) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Mount & Blade: Warband (HKLM-x32\...\Steam App 48700) (Version:  - Tale Worlds)

NaturalPoint USB Drivers x64 (HKLM\...\{B408139D-04D6-4464-A979-D335E48F7063}) (Version: 2.50.0000 - NaturalPoint)

Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.46.0 - Black Tree Gaming)

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.1 - Notepad++ Team)

NVIDIA 3D Vision Controller Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)

NVIDIA Graphics Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)

OpenOffice 4.0.1 (HKLM-x32\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)

OpenTTD 1.4.0 (HKLM-x32\...\OpenTTD) (Version: 1.4.0 - OpenTTD)

PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)

Prison Architect (HKLM-x32\...\Steam App 233450) (Version:  - Introversion Software)

PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.992 - Even Balance, Inc.)

Quake Live (HKLM-x32\...\Steam App 282440) (Version:  - id Software)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5859 - Realtek Semiconductor Corp.)

Rising Storm/Red Orchestra 2 Multiplayer (HKLM-x32\...\Steam App 35450) (Version:  - Tripwire Interactive)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001B-0000-1000-0000000FF1CE}_Office14.WORD_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden

SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden

Silent Hunter 5 (HKLM-x32\...\{AC61C594-5F86-4BE9-ABAF-763C6A8E2302}) (Version: 1.2.0 - Ubisoft)

Six Updater (HKLM-x32\...\{AD42165D-FF3C-4975-A130-7AA2801AB5DD}) (Version: 2.09.7042 - Six Projects)

Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)

Space Engineers (HKLM-x32\...\Steam App 244850) (Version:  - )

Starbound (HKLM-x32\...\Steam App 211820) (Version:  - )

Starsiege TRIBES 1.8 (HKLM-x32\...\Starsiege TRIBES) (Version:  - )

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)

Total War: ROME II (HKLM-x32\...\Steam App 214950) (Version:  - Creative Assembly)

TrackIR 5 (HKLM-x32\...\{2f2e6053-043c-4d69-94d0-4d42304ea4ee}) (Version: 5.2.0200 - NaturalPoint)

Tribes 2 (HKLM-x32\...\Tribes 2) (Version: 1.0.0.0 - Sierra On-Line)

Tropico 5 (HKLM-x32\...\Steam App 245620) (Version:  - Haemimont Games)

Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)

Unity Web Player (HKU\S-1-5-21-3025731626-3237982839-744267471-1001\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)

Unturned (HKLM-x32\...\Steam App 304930) (Version:  - Nelson Sexton)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

Ventrilo Client for Windows x64 (HKLM\...\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.8.0 - Flagship Industries, Inc.)

Vizzed Retro Game Room (HKLM-x32\...\{6D9F35D2-1D6F-4E17-A79F-991A7BD24AAD}) (Version: 2.0.0 - Vizzed)

War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)

Wargame: Red Dragon (HKLM-x32\...\Steam App 251060) (Version:  - Eugen Systems)

WinRAR 5.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

 

==================== Restore Points  =========================

 

03-02-2015 14:02:12 Removed puush

03-02-2015 14:12:43 Windows Update

03-02-2015 14:33:32 Removed The Sims 3

03-02-2015 14:37:30 Removed DayZ Commander

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {0C8AFD29-DECC-46A5-BC62-BDF05EBCDB94} - System32\Tasks\{3657C380-1B80-4A29-A34E-72DF1EFA5229} => pcalua.exe -a D:\Tools\VirtualCloneDrive\ExecuteWithUAC.exe -d D:\Tools\VirtualCloneDrive

Task: {1D3E3A1F-6706-481A-AC4B-0A93653BA56A} - System32\Tasks\Hybrid => C:\IORRT\IORRT.bat [2014-01-03] ()

Task: {3CB915B1-825D-4EDF-928D-1C23A67CB564} - System32\Tasks\{C372A853-CAD1-493C-BACB-555E1298ABA6} => pcalua.exe -a K:\Setup.exe -d K:\

Task: {49049013-9076-4FFF-B8C0-78C7D431F2A0} - System32\Tasks\{CACE2A28-11D7-4F7B-949A-F42C6122114F} => pcalua.exe -a D:\Tools\GameRangerSetup.exe -d D:\Tools

Task: {5537768D-DB8C-4280-89BA-8884A8FD441A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.)

Task: {5CF8BF48-2F8E-44C4-812E-A18B3C0BA7F5} - System32\Tasks\{4E7C5B3B-B6F5-46AB-B03D-5746A6921326} => pcalua.exe -a "E:\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\uninstall.exe"

Task: {8CECDC30-9590-4C70-8F18-7E939C8B7114} - System32\Tasks\{B9EB60E6-E1DF-486C-A924-D47012DEB72A} => pcalua.exe -a E:\Games\OperationFlashpoint\UnInstall.exe -d E:\Games\OperationFlashpoint

Task: {B1CF4C1C-573A-41A3-82F4-8A0577FDC11D} - System32\Tasks\{3D47E152-CAE7-45B3-983F-93781C8B2F4E} => O:\Sims3Setup.exe

Task: {B1F622D1-725A-4257-9683-D38F85020F1D} - System32\Tasks\{7D39927D-9F62-43BC-9E9A-56298B31751B} => pcalua.exe -a "C:\Windows\Close Combat Cross of Iron\uninstall.exe" -c "/U:D:\Program Files\Close Combat\Uninstall\uninstall.xml"

Task: {B2FCB520-57E0-4A9F-A99C-BB7F3C8DEC2D} - System32\Tasks\IORRT => C:\IORRT\IORRT.bat [2014-01-03] ()

Task: {B5F277B3-DE0E-490C-BF24-479C266DC94B} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {C044F092-9097-41B0-9C6B-BC5D138D0820} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2013-07-02] ()

Task: {C6AD7C4A-5DAB-413C-8C96-99061FFC8B07} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (whitelisted) =============

 

2014-06-05 17:40 - 2014-09-13 16:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2013-07-05 16:37 - 2013-07-05 16:52 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2010-01-02 09:42 - 2010-01-02 09:42 - 00098304 _____ () E:\Tools\FileZilla FTP Client\fzshellext_64.dll

2012-06-18 10:24 - 2012-06-18 10:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll

2014-01-10 00:26 - 2014-01-10 00:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

2014-04-01 18:08 - 2014-04-01 18:08 - 00244736 _____ () C:\Program Files (x86)\ATT\8.4.1.12\ma\node_modules\motive-activex-wrapper\build\Release\NodeActiveXWrapper.node

2014-04-01 18:08 - 2014-04-01 18:08 - 00271360 _____ () C:\Program Files (x86)\ATT\8.4.1.12\ma\node_modules\motive-osbridge\build\Release\MotiveOSBridgeNodeModule.node

2014-04-01 18:08 - 2014-04-01 18:08 - 00237056 _____ () C:\Program Files (x86)\ATT\8.4.1.12\ma\node_modules\motive-xmpps\build\Release\MotiveXMPPSNode.node

2013-04-24 08:55 - 2013-04-24 08:55 - 01581056 _____ () C:\Program Files (x86)\ATT\8.4.1.12\ma\node_modules\libxmljs\build\Release\xmljs.node

2013-04-18 17:55 - 2013-04-18 17:55 - 00068608 _____ () C:\Program Files (x86)\ATT\8.4.1.12\ma\node_modules\dnode\node_modules\weak\build\Release\weakref.node

2013-09-04 16:30 - 2009-12-09 21:20 - 00126976 _____ () C:\Program Files (x86)\Edimax\11n USB Wireless LAN Utility\EnumDevLib.dll

2014-08-28 19:22 - 2014-12-01 16:31 - 02396672 _____ () E:\Games\Steam\libavcodec-56.dll

2014-08-28 19:22 - 2014-12-01 16:31 - 00442880 _____ () E:\Games\Steam\libavutil-54.dll

2014-08-28 19:22 - 2014-12-01 16:31 - 00479744 _____ () E:\Games\Steam\libavformat-56.dll

2014-08-28 19:22 - 2014-12-01 16:31 - 00332800 _____ () E:\Games\Steam\libavresample-2.dll

2013-05-06 17:05 - 2014-11-11 13:47 - 00774656 _____ () E:\Games\Steam\SDL2.dll

2015-01-20 18:57 - 2014-12-01 19:29 - 05002752 _____ () E:\Games\Steam\v8.dll

2015-01-20 18:57 - 2014-12-01 19:29 - 01612800 _____ () E:\Games\Steam\icui18n.dll

2015-01-20 18:57 - 2014-12-01 19:29 - 01210368 _____ () E:\Games\Steam\icuuc.dll

2014-05-21 17:48 - 2015-01-23 17:34 - 02227904 _____ () E:\Games\Steam\video.dll

2014-08-28 19:22 - 2014-12-01 16:31 - 00485888 _____ () E:\Games\Steam\libswscale-3.dll

2013-06-06 14:06 - 2015-01-23 17:33 - 00696512 _____ () E:\Games\Steam\bin\chromehtml.DLL

2014-01-10 00:28 - 2014-01-10 00:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

2013-03-26 16:16 - 2015-01-15 18:42 - 34641288 _____ () E:\Games\Steam\bin\libcef.dll

2013-08-07 14:25 - 2013-08-07 14:25 - 00093696 _____ () E:\Tools\FileZilla FTP Client\fzshellext.dll

2015-02-02 19:11 - 2015-01-26 22:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libglesv2.dll

2015-02-02 19:11 - 2015-01-26 22:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libegl.dll

2015-02-02 19:11 - 2015-01-26 22:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\pdf.dll

2015-02-02 19:11 - 2015-01-26 22:44 - 14913864 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\PepperFlash\pepflashplayer.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

 

==================== EXE Association (whitelisted) =============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== MSCONFIG/TASK MANAGER disabled items =========

 

(Currently there is no automatic fix for this section.)

 

 

========================= Accounts: ==========================

 

Administrator (S-1-5-21-3025731626-3237982839-744267471-500 - Administrator - Disabled)

Amanda (S-1-5-21-3025731626-3237982839-744267471-1006 - Limited - Enabled) => C:\Users\Amanda

Commander (S-1-5-21-3025731626-3237982839-744267471-1001 - Administrator - Enabled) => C:\Users\Commander

Guest (S-1-5-21-3025731626-3237982839-744267471-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3025731626-3237982839-744267471-1005 - Limited - Enabled)

 

==================== Faulty Device Manager Devices =============

 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft Teredo Tunneling Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (02/03/2015 03:06:43 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Windows license activation failed. Error 0x80070005.

 

Error: (02/03/2015 02:37:30 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

.

 

Error: (02/03/2015 02:37:30 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

.

 

Error: (02/03/2015 02:33:32 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

.

 

Error: (02/03/2015 02:12:43 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

.

 

Error: (02/03/2015 02:12:42 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

.

 

Error: (02/03/2015 02:02:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

.

 

Error: (02/03/2015 02:02:10 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

.

 

Error: (02/03/2015 01:46:35 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Windows license activation failed. Error 0x80070005.

 

Error: (02/03/2015 00:54:29 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Windows license activation failed. Error 0x80070005.

 

 

System errors:

=============

Error: (02/03/2015 01:45:19 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

 

Error: (02/03/2015 00:47:22 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 40. The internal error state is 252.

 

Error: (02/03/2015 00:47:22 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 40. The internal error state is 252.

 

Error: (02/03/2015 00:42:32 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 40. The internal error state is 252.

 

Error: (02/03/2015 00:42:32 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 40. The internal error state is 252.

 

Error: (02/03/2015 00:37:47 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 40. The internal error state is 252.

 

Error: (02/03/2015 00:37:46 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 40. The internal error state is 252.

 

Error: (02/03/2015 09:11:03 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 70. The internal error state is 105.

 

Error: (02/03/2015 09:06:48 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 1:55:39 AM on ‎2/‎3/‎2015 was unexpected.

 

Error: (02/03/2015 00:40:12 AM) (Source: volsnap) (EventID: 36) (User: )

Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

 

 

Microsoft Office Sessions:

=========================

Error: (02/03/2015 03:06:43 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000

 

Error: (02/03/2015 02:37:30 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

 

Error: (02/03/2015 02:37:30 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

 

Error: (02/03/2015 02:33:32 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

 

Error: (02/03/2015 02:12:43 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

 

Error: (02/03/2015 02:12:42 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

 

Error: (02/03/2015 02:02:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

 

Error: (02/03/2015 02:02:10 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddCoreCsiFiles : BeginFileEnumeration() failed.

 

System Error:

The parameter is incorrect.

 

Error: (02/03/2015 01:46:35 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000

 

Error: (02/03/2015 00:54:29 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000

 

 

CodeIntegrity Errors:

===================================

  Date: 2013-12-05 23:30:15.030

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:14.970

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:13.880

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:13.830

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:12.780

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:12.730

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:11.680

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:11.630

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:09.250

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-12-05 23:30:09.200

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Tools\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core2 Quad CPU Q9505 @ 2.83GHz

Percentage of memory in use: 23%

Total physical RAM: 8191.05 MB

Available physical RAM: 6248.43 MB

Total Pagefile: 16380.29 MB

Available Pagefile: 14279.37 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:99.55 GB) (Free:13.49 GB) NTFS

Drive d: (Storage) (Fixed) (Total:198.44 GB) (Free:127.59 GB) NTFS

Drive e: (Performance) (Fixed) (Total:298.09 GB) (Free:21.14 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: DBB03481)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=99.6 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=198.4 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (Size: 298.1 GB) (Disk ID: 6E697373)

No partition Table on disk 1.

 

==================== End Of Log ============================

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

FRST.gif Fix with Farbar Recovery Scan Tool
 


icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif
icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 

adwcleaner_new.png Fix with AdwCleaner
 
Please download AdwCleaner by Xplode and save the file to your Desktop.

  • Right-click on adwcleaner_new.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait until the database is updated.
  • Accept the Terms of use and click Scan.
  • When finished, please click Clean.
  • Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please upload report in your reply.
 
Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

fixlist.txt

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself :)
 
 

Recommended reading:

 
 
icon_exclaim.gifMUST READ - security tips:

icon_exclaim.gifMUST READ - general maintenance:

The Importance of Software Updating:

 

 
In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.
 
Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

Recommended additional software:

 
 
icon_arrow.gifTFC - to clean unneeded temporary files.
icon_arrow.gifMalwarebytes' Anti-Malware - to scan your system from time to time in search for malware.
icon_arrow.gifMalwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.
icon_arrow.gifMcShield - to prevent infections spread by removable media.
icon_arrow.gifUnchecky - to prevent from installing additional foistware, implemented in legitimate installations.
icon_arrow.gifAdblock - to surf the web without annoying ads! 
 
 

Post-cleanup procedures:

 

 
Download DelFix by Xplode and save it to your desktop.

  • Run the tool by right click on the 51a5ce45263de-delfix.png icon and Run as administrator option.
  • Make sure that these ones are checked:
    • Remove disinfection tools
    • Purge system restore
    • Reset system settings
  • Push Run.
  • The program will run for a few seconds and display a notepad report. You do not need to attach it.

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning. 
 
 
 


My help is free for everybody.

If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation: 
btn_donateCC_LG.gif

 

Thank you!

 
 
Stay safe,
TwinHeadedEagle   :)

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.