You speak French, too?!!!!
No, but google does. It is needed when dealing with these logs, people from all over the world post here.
-
Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.
Why not Click Here To Sign Up and start enjoying great FREE Tech Support.
This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Solved Constantly going into 'overdrive'
- Thread starter bernie lamb
- Start date
- Status
No, but google does. It is needed when dealing with these logs, people from all over the world post here.
Just had a flash from Avira!
C:\Documents and Settings\User\SupRestric.exe containing pattern of 'TR/Downloader.yagwm' was blocked
C:\Documents and Settings\User\SupRestric.exe containing pattern of 'TR/Downloader.yagwm' was blocked
This is a false positive, it is the file I had you use. The one with the french output. You can delete that file now, no problem.
Step 1: ClearLNK
Download ClearLNK save it to your desktop.
Drag the file Check_Browsers_LNK from your Collection log made earlier.
As per picture.
A report on the work as a file ClearLNK- <date> .log
Will be produced, post that log.
Step 2: AVZ Fix
Disable your antivirus prior to this fix.
Copy the content of the code box below.
Open the folder you unzipped Autologger in. Double click the AVZ4 folder Right click AVZ run as admin. (Xp users Double Click)
Go to file -- Custom Scripts.
Paste the content of your clipboard into the Custom Script Area.
Click the Run Button.
The program will reboot your machine.
Step 3: FRST Scan logs.
Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.
If you are unsure if your operating system is 32 or 64 Bit please go HERE.
Once downloaded right click the FRST desktop icon and select "Run as administrator" from the menu"
If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
FRST will open with two dialogue boxes, accept the disclaimer.
Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.
Please Copy and Paste the contents of these logs in your next post
Download ClearLNK save it to your desktop.
Drag the file Check_Browsers_LNK from your Collection log made earlier.
As per picture.
A report on the work as a file ClearLNK- <date> .log
Will be produced, post that log.
Step 2: AVZ Fix
Disable your antivirus prior to this fix.
Copy the content of the code box below.
Code:
begin
RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Control\Terminal Server','fAllowToGetHelp', 0);
RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Control\LSA','RestrictAnonymous', 2);
SetServiceStart('RDSessMgr', 4);
SetServiceStart('mnmsrvc', 4);
SetServiceStart('TermService', 4);
SetServiceStart('RemoteRegistry', 4);
SetAVZGuardStatus(True);
DeleteService('ZAM');
StopService('ZAM');
DeleteFile('C:\WINDOWS\System32\drivers\zam32.sys','32');
DeleteFile('C:\Program Files\Bonjour\mDNSResponder.exe','32');
DeleteFile('C:\Program Files\TuneUp','32');
DeleteFile('2014\TuneUpUtilitiesService32.exe','32');
DeleteFile('C:\WINDOWS\system32\MsSip1.dll','32');
DeleteFile('C:\WINDOWS\system32\MsSip2.dll','32');
DeleteFile('C:\WINDOWS\system32\MsSip3.dll','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 1','$DLL');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 2','$DLL');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\WinTrust\SubjectPackages\MS Subjects 3','$DLL');
DeleteFile('C:\WINDOWS\TEMP\0.del','32');
RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce','Del2110015');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce','Del2110015');
ClearHostsFile;
ExecuteSysClean;
RebootWindows(true);
end.Open the folder you unzipped Autologger in. Double click the AVZ4 folder Right click AVZ run as admin. (Xp users Double Click)
Go to file -- Custom Scripts.
Paste the content of your clipboard into the Custom Script Area.
Click the Run Button.
The program will reboot your machine.
Step 3: FRST Scan logs.
Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.
If you are unsure if your operating system is 32 or 64 Bit please go HERE.
Once downloaded right click the FRST desktop icon and select "Run as administrator" from the menu"
If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
FRST will open with two dialogue boxes, accept the disclaimer.
- Accept the default whitelist options,
- If the additions.txt options box is not checked please select it.
- Then select Scan
Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.
Please Copy and Paste the contents of these logs in your next post
Last edited:
Sorry (again!) Stupidly, I've been waiting to see you come back, but forgot that I wasn't logged in after the last exercise.
Check Browser link won't let me drag it into the ClearLNK window!
Check Browser link won't let me drag it into the ClearLNK window!
Yep, from the log --- Cure ran per today: 4 times.
You are good, move onto the next step.
VirusTotal Scan.
C:\WINDOWS\system32\Drivers\ujqxmtm2.sys
- Please go to VirusTotal.
- Click the Choose File button.
- Navigate to >>>>>>>> C:\WINDOWS\system32\Drivers\utqxmtm2.sys
- or simply copy and paste it.
- Click the Scan it! button.
- You might see a message saying File already analysed, if you do click Reanalyse.
- Wait for all the scans to finish then copy and paste the web address from your broswer's address bar.
Example of web address :
- Include the link in your next reply.
C:\WINDOWS\system32\Drivers\ujqxmtm2.sys
FRST Fix.
Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Also, these drivers are installed by AVZ tool, so there is nothing to worry about as far as that is concerned. We will remove these when done with AVZ....
http://www.malwareremoval.com/forum/viewtopic.php?f=26&t=48936
S3 ujqxmtm2; C:\WINDOWS\system32\Drivers\ujqxmtm2.sys [10240 2017-02-16] (Zaitsev Oleg, 2006) [File not signed]
S3 utqxmtm2; C:\WINDOWS\system32\Drivers\utqxmtm2.sys [7168 2017-02-16] () [File not signed]
Lets do a final check for malware.
Full Virus Scan AVZ
Disable your antivirus prior to these steps!!
Download AVZ if you have deleted it.
Right click on AVZ Run as Admin. (Xp Users Double click to run.)
Update the program by pressing the
Make sure all settings are the same in the pic below.
Next:
Under File Types Make sure the settings are the same as below.
Next:
Under Search Parameters Make sure the settings are the same as below.
Now click the Start Button.
When the scan is complete then click on Save Log.
Save the log to the desktop -- Copy it and paste it here in your next reply.
Fixlog.txt below. During the fix, another flash from Alvira 'Host file blocked'
Fix result of Farbar Recovery Scan Tool (x86) Version: 15-02-2017 02
Ran by User (16-02-2017 14:29:17) Run:1
Running from C:\Documents and Settings\User\My Documents\Downloads
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================
fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\WGASetup.job => C:\WINDOWS\system32\KB905474\wgasetup.exe <==== ATTENTION
MSCONFIG\startupfolder: C:^Documents and Settings^User^Start Menu^Programs^Startup^Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnk => C:\WINDOWS\pss\Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnkStartup
MSCONFIG\startupreg: avgnt => "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
MSCONFIG\startupreg: CCleaner => "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
MSCONFIG\startupreg: ctfmon.exe => C:\WINDOWS\system32\ctfmon.exe
MSCONFIG\startupreg: SoundMAX => C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
MSCONFIG\startupreg: SoundMAXPnP => C:\Program Files\Analog Devices\Core\smax4pnp.exe
AlternateDataStreams: C:\WINDOWS\system32\csrss.exe:SummaryInformation [43]
AlternateDataStreams: C:\WINDOWS\system32\csrss.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
HKU\S-1-5-21-329068152-606747145-1417001333-1003\...\ChromeHTML: -> <==== ATTENTION
C:\Documents and Settings\User\Application Data\Anvsoft
C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
C:\Program Files\Driver Wizard
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\Tasks\WGASetup.job
C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
2017-02-16 01:49 - 2017-02-16 01:34 - 00024064 _____ C:\WINDOWS\zoek-delete.exe
2017-02-16 01:32 - 2017-02-16 01:47 - 00000000 ____D C:\zoek_backup
2017-02-16 00:10 - 2017-02-16 01:14 - 00012103 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-02-16 00:10 - 2017-02-16 00:43 - 00027059 _____ C:\WINDOWS\ZAM.krnl.trace
2017-02-16 00:10 - 2017-02-16 00:10 - 00000000 ____D C:\Documents and Settings\User\Local Settings\Application Data\Zemana
2017-02-16 00:10 - 2017-02-16 00:10 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana
U1 WS2IFSL; no ImagePath
S1 ZAM_Guard; \??\C:\WINDOWS\System32\drivers\zamguard32.sys [X]
S3 BTKRNL; system32\DRIVERS\btkrnl.sys [X]
S3 BTWUSB; System32\Drivers\btwusb.sys [X]
S0 ffpupehd; System32\drivers\lyuws.sys [X]
S1 gstpxojq; \??\C:\WINDOWS\system32\drivers\gstpxojq.sys [X]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\49.0.2623.112\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\49.0.2623.112\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\49.0.2623.112\gcswf32.dll => No File
FF Plugin HKU\S-1-5-21-329068152-606747145-1417001333-1003: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-329068152-606747145-1417001333-1003 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
HKU\S-1-5-21-329068152-606747145-1417001333-1003\...\MountPoints2: {b0d127e7-5823-11e3-86e5-0017a4e7b8b3} - E:\FlashDiskUtility.exe
RemoveProxy:
hosts:
CMD: ipconfig /flushdns
EmptyTemp:
reboot:
end
*****************
Restore point was successfully created.
Processes closed successfully.
C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => moved successfully
C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => moved successfully
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => moved successfully
C:\WINDOWS\Tasks\WGASetup.job => moved successfully
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnk => key removed successfully.
C:\WINDOWS\pss\Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnkStartup => moved successfully
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\avgnt => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CCleaner => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ctfmon.exe => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SoundMAX => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SoundMAXPnP => key removed successfully.
C:\WINDOWS\system32\csrss.exe => ":SummaryInformation" ADS could not remove.
C:\WINDOWS\system32\csrss.exe => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully..
HKU\S-1-5-21-329068152-606747145-1417001333-1003_Classes\ChromeHTML => key removed successfully.
C:\Documents and Settings\User\Application Data\Anvsoft => moved successfully
"C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job" => not found.
C:\Program Files\Driver Wizard => moved successfully
"C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job" => not found.
"C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job" => not found.
"C:\WINDOWS\Tasks\WGASetup.job" => not found.
"C:\WINDOWS\Tasks\Adobe Flash Player Updater.job" => not found.
"C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job" => not found.
"C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job" => not found.
C:\WINDOWS\zoek-delete.exe => moved successfully
C:\zoek_backup => moved successfully
C:\WINDOWS\ZAM_Guard.krnl.trace => moved successfully
C:\WINDOWS\ZAM.krnl.trace => moved successfully
C:\Documents and Settings\User\Local Settings\Application Data\Zemana => moved successfully
C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana => moved successfully
HKLM\System\CurrentControlSet\Services\WS2IFSL => key removed successfully.
WS2IFSL => service removed successfully.
HKLM\System\CurrentControlSet\Services\ZAM_Guard => key removed successfully.
ZAM_Guard => service removed successfully.
HKLM\System\CurrentControlSet\Services\BTKRNL => key removed successfully.
BTKRNL => service removed successfully.
HKLM\System\CurrentControlSet\Services\BTWUSB => key removed successfully.
BTWUSB => service removed successfully.
HKLM\System\CurrentControlSet\Services\ffpupehd => key removed successfully.
ffpupehd => service removed successfully.
HKLM\System\CurrentControlSet\Services\gstpxojq => key removed successfully.
gstpxojq => service removed successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => key removed successfully.
C:\Program Files\Google\Chrome\Application\49.0.2623.112\ppGoogleNaClPluginChrome.dll => not found.
C:\Program Files\Google\Chrome\Application\49.0.2623.112\pdf.dll => not found.
C:\Program Files\Google\Chrome\Application\49.0.2623.112\gcswf32.dll => not found.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\Software\MozillaPlugins\@lightspark.github.com/Lightspark;version=1 => key removed successfully.
C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll => not found.
HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3 => key removed successfully.
C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll => moved successfully
HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9 => key removed successfully.
"C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll" => not found.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => value restored successfully
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} => key removed successfully.
HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66} => key not found.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} => key removed successfully.
HKCR\CLSID\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} => key not found.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0d127e7-5823-11e3-86e5-0017a4e7b8b3} => key removed successfully.
HKCR\CLSID\{b0d127e7-5823-11e3-86e5-0017a4e7b8b3} => key not found.
========= RemoveProxy: =========
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
========= End of RemoveProxy: =========
Could not move "C:\Windows\System32\Drivers\etc\hosts" => Scheduled to move on reboot.
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
=========== EmptyTemp: ==========
BITS transfer queue => 10978 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache => 1845017 B
Java, Flash, Steam htmlcache => 8487 B
Windows/system/dllcache/drivers => 3430 B
Edge => 0 B
Chrome => 380670817 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Documents and Settings => 0 B
Default User => 32994 B
All Users => 0 B
systemprofile => 114914 B
LocalService => 363682 B
NetworkService => 586955 B
User => 6454574 B
RecycleBin => 0 B
EmptyTemp: => 372 MB temporary data Removed.
================================
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 16-02-2017 14:32:03)
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
==== End of Fixlog 14:32:03 ====
Fix result of Farbar Recovery Scan Tool (x86) Version: 15-02-2017 02
Ran by User (16-02-2017 14:29:17) Run:1
Running from C:\Documents and Settings\User\My Documents\Downloads
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================
fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\WGASetup.job => C:\WINDOWS\system32\KB905474\wgasetup.exe <==== ATTENTION
MSCONFIG\startupfolder: C:^Documents and Settings^User^Start Menu^Programs^Startup^Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnk => C:\WINDOWS\pss\Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnkStartup
MSCONFIG\startupreg: avgnt => "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
MSCONFIG\startupreg: CCleaner => "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
MSCONFIG\startupreg: ctfmon.exe => C:\WINDOWS\system32\ctfmon.exe
MSCONFIG\startupreg: SoundMAX => C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
MSCONFIG\startupreg: SoundMAXPnP => C:\Program Files\Analog Devices\Core\smax4pnp.exe
AlternateDataStreams: C:\WINDOWS\system32\csrss.exe:SummaryInformation [43]
AlternateDataStreams: C:\WINDOWS\system32\csrss.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
HKU\S-1-5-21-329068152-606747145-1417001333-1003\...\ChromeHTML: -> <==== ATTENTION
C:\Documents and Settings\User\Application Data\Anvsoft
C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
C:\Program Files\Driver Wizard
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\Tasks\WGASetup.job
C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
2017-02-16 01:49 - 2017-02-16 01:34 - 00024064 _____ C:\WINDOWS\zoek-delete.exe
2017-02-16 01:32 - 2017-02-16 01:47 - 00000000 ____D C:\zoek_backup
2017-02-16 00:10 - 2017-02-16 01:14 - 00012103 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-02-16 00:10 - 2017-02-16 00:43 - 00027059 _____ C:\WINDOWS\ZAM.krnl.trace
2017-02-16 00:10 - 2017-02-16 00:10 - 00000000 ____D C:\Documents and Settings\User\Local Settings\Application Data\Zemana
2017-02-16 00:10 - 2017-02-16 00:10 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana
U1 WS2IFSL; no ImagePath
S1 ZAM_Guard; \??\C:\WINDOWS\System32\drivers\zamguard32.sys [X]
S3 BTKRNL; system32\DRIVERS\btkrnl.sys [X]
S3 BTWUSB; System32\Drivers\btwusb.sys [X]
S0 ffpupehd; System32\drivers\lyuws.sys [X]
S1 gstpxojq; \??\C:\WINDOWS\system32\drivers\gstpxojq.sys [X]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\49.0.2623.112\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\49.0.2623.112\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\49.0.2623.112\gcswf32.dll => No File
FF Plugin HKU\S-1-5-21-329068152-606747145-1417001333-1003: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-329068152-606747145-1417001333-1003 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
HKU\S-1-5-21-329068152-606747145-1417001333-1003\...\MountPoints2: {b0d127e7-5823-11e3-86e5-0017a4e7b8b3} - E:\FlashDiskUtility.exe
RemoveProxy:
hosts:
CMD: ipconfig /flushdns
EmptyTemp:
reboot:
end
*****************
Restore point was successfully created.
Processes closed successfully.
C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => moved successfully
C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => moved successfully
C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => moved successfully
C:\WINDOWS\Tasks\WGASetup.job => moved successfully
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnk => key removed successfully.
C:\WINDOWS\pss\Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnkStartup => moved successfully
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\avgnt => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CCleaner => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ctfmon.exe => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SoundMAX => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SoundMAXPnP => key removed successfully.
C:\WINDOWS\system32\csrss.exe => ":SummaryInformation" ADS could not remove.
C:\WINDOWS\system32\csrss.exe => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully..
HKU\S-1-5-21-329068152-606747145-1417001333-1003_Classes\ChromeHTML => key removed successfully.
C:\Documents and Settings\User\Application Data\Anvsoft => moved successfully
"C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job" => not found.
C:\Program Files\Driver Wizard => moved successfully
"C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job" => not found.
"C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job" => not found.
"C:\WINDOWS\Tasks\WGASetup.job" => not found.
"C:\WINDOWS\Tasks\Adobe Flash Player Updater.job" => not found.
"C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job" => not found.
"C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job" => not found.
C:\WINDOWS\zoek-delete.exe => moved successfully
C:\zoek_backup => moved successfully
C:\WINDOWS\ZAM_Guard.krnl.trace => moved successfully
C:\WINDOWS\ZAM.krnl.trace => moved successfully
C:\Documents and Settings\User\Local Settings\Application Data\Zemana => moved successfully
C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana => moved successfully
HKLM\System\CurrentControlSet\Services\WS2IFSL => key removed successfully.
WS2IFSL => service removed successfully.
HKLM\System\CurrentControlSet\Services\ZAM_Guard => key removed successfully.
ZAM_Guard => service removed successfully.
HKLM\System\CurrentControlSet\Services\BTKRNL => key removed successfully.
BTKRNL => service removed successfully.
HKLM\System\CurrentControlSet\Services\BTWUSB => key removed successfully.
BTWUSB => service removed successfully.
HKLM\System\CurrentControlSet\Services\ffpupehd => key removed successfully.
ffpupehd => service removed successfully.
HKLM\System\CurrentControlSet\Services\gstpxojq => key removed successfully.
gstpxojq => service removed successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => key removed successfully.
C:\Program Files\Google\Chrome\Application\49.0.2623.112\ppGoogleNaClPluginChrome.dll => not found.
C:\Program Files\Google\Chrome\Application\49.0.2623.112\pdf.dll => not found.
C:\Program Files\Google\Chrome\Application\49.0.2623.112\gcswf32.dll => not found.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\Software\MozillaPlugins\@lightspark.github.com/Lightspark;version=1 => key removed successfully.
C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll => not found.
HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3 => key removed successfully.
C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll => moved successfully
HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9 => key removed successfully.
"C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll" => not found.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => value restored successfully
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} => key removed successfully.
HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66} => key not found.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} => key removed successfully.
HKCR\CLSID\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} => key not found.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0d127e7-5823-11e3-86e5-0017a4e7b8b3} => key removed successfully.
HKCR\CLSID\{b0d127e7-5823-11e3-86e5-0017a4e7b8b3} => key not found.
========= RemoveProxy: =========
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-329068152-606747145-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
========= End of RemoveProxy: =========
Could not move "C:\Windows\System32\Drivers\etc\hosts" => Scheduled to move on reboot.
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
=========== EmptyTemp: ==========
BITS transfer queue => 10978 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache => 1845017 B
Java, Flash, Steam htmlcache => 8487 B
Windows/system/dllcache/drivers => 3430 B
Edge => 0 B
Chrome => 380670817 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Documents and Settings => 0 B
Default User => 32994 B
All Users => 0 B
systemprofile => 114914 B
LocalService => 363682 B
NetworkService => 586955 B
User => 6454574 B
RecycleBin => 0 B
EmptyTemp: => 372 MB temporary data Removed.
================================
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 16-02-2017 14:32:03)
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
==== End of Fixlog 14:32:03 ====
- Status