Need help to check if nprotect GameGuard is still installed.

[JorgeBon]

Hello,

I've had a game installed which used GameGuard anti cheat, i've been struggling to figure out if it has been uninstalled successfully since its a rootkit.

I deleted 3 files and a few registries, I don't know how many registries it writes though and I bet I missed some. I also restored an older version of the system to be extra sure, but I've got no clue how effective that was.

Is there a way to be sure its gone? I used Farbar Recovery to check if that finds anything, but all it found was an old error message that GameGuard's Service is broken.

[nasdaq]

Hi,

 

Post the Farbar logs (FRST.TXT and addition.txt) for my review. 

[AdvancedSetup]

Hello @JorgeBon

Please post back both of the logs as requested so that we can review.

You should not need the following if you already have the program, but just in case.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

[JorgeBon]

Hello @AdvancedSetup,

I'd need to get new logs, but it seems that the Farbar Recovery tool has a lot of detections again, I suppose it does make me nervous even if its perfectly fine but I'd prefer to wait till its a reasonable number. I assume you can confirm that this version is also safe? It's almost like last time where the detection rate was abnormally high.

Sorry for the trouble.

Edited May 20, 2021 by JorgeBon

[AdvancedSetup]

No trouble on our end, we're simply wanting to help.

I'm sorry but there is nothing else I can do to ease your concerns. This program has been in use here on the forums for well over 5 years now and thousands of others running the tool around the globe.

If you don't want to run it then we have no way to know what is running on your system and how to help you.

Perhaps it's best you go ahead and call a local computer repair shop and have them look at the computer for you. That way you don't have to be concerned about the tool

Best wishes

 

 

[JorgeBon]

Just a wild paranoia from my side, I'd attempt to get logs if the detection rate wasnt at 14 on VT, a precaution just if something might actually be wrong. ( I know I took some logs before but thats where it was at 3 or 4 detections only.)

I'll take another look tomorrow, I'll let you know when I'm ready to take logs and send them here, had a lot of stuff today.

Cheers

[JorgeBon]

Windows Defender started to block the program.

[Maurice Naggar]

@JorgeBon Hi.

The Windows Microsoft Defender and or the Windows Smart screen block on FRST is a false one. The FRST is not a danger at all. You can Over-ride it's block as I list below.

Please have confidence in your helpers here. The FRST is widely used in many many security forums.

You can put the output reports if you wish, into a Zip file & then attach that in a reply.

The FRST does Not make any changes.

 

• Right-click on FRST64.exe and select Run as Administrator to start the tool , and reply YES to allow it to proceed and run.

 

• Windows 10 users will be prompted about Windows *SmartScreen protection* - click line More info information on that screen and click button Run anyway on next screen.

Click YES when prompted by Windows U A C prompt to allow it to run.

Note: If you are prompted by Windows SmartScreen, click More info & followup & choose Run anyway.

 Once FRST is started

• Click Yes when the *disclaimer* appears in FRST.

The tool may want to update itself - in that case you'll be prompted when the update is completed and ready to use.

 

• Make sure that Addition options is *checked* - the configuration should look exactly like on the screen below (do not mark additional things unless asked).
• Press Scan button and wait.

 

The tool will produce 2 logfiles on your desktop: FRST.txt , Addition.txt 

Click OK button when it shows up. Close the Notepad windows when they show on screen. The tool saves the files.

 

Please attach these 2 files to your next reply. or you can put the in a ZIP & then attach.

Cheers.

[JorgeBon]

Sorry for the delay.

Here are the logs.

FRST.txt Addition.txt

[JorgeBon]

May I also add that my Windows has problems with installing the latest update?

KB5003173 is the version.

[nasdaq]

Hi,

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Let me know what problem persists.

fixlist.txt

[JorgeBon]

@nasdaq

Used the fixlist.

Cheers

Fixlog.txt

[nasdaq]

Is the problem solved?

[JorgeBon]

Hello @nasdaq,

Yes, my windows updated correctly now. I assume GameGuard isn't installed? If it isn't, then my problem is solved.

Cheers

[nasdaq]

Glad we could help.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you