Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser hijack and high disk usage


  • This topic is locked This topic is locked
6 replies to this topic

#1 renski2498

renski2498

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:25 AM

Posted 05 July 2016 - 08:34 AM

For some reason I checked my resource monitor and the network activity, the addressed were amaznaws, cloudfront, etc ads I guess causing me to go capcha in Google and the System process has a high disk usage.

Apparently, I ran a lot of scan tools including combofix already before I knew of this process. I'm very sorry for my lack of sense and i'm lucky my computer did not break. 

I properly read the Preparation guide this time. Hopefully, my laptop can be cleaned.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016
Ran by Ren (administrator) on REN-PC (05-07-2016 21:28:54)
Running from C:\Users\Ren\Downloads\Programs
Loaded Profiles: Ren (Available Profiles: Ren)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
() C:\Program Files (x86)\Garena Plus\ggdllhost.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
() C:\Riot Games\LolScreenSaver\service\service.exe
(Locktime Software) C:\Program Files\Locktime Software\NetLimiter 4\NLSvc.exe
(www.shadowexplorer.com) C:\Program Files (x86)\ShadowExplorer\sesvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\perfmon.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe
(Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16407296 2015-11-12] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-28] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-12-17] (Apple Inc.)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [937592 2015-10-09] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595992 2016-05-20] (Oracle Corporation)
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\Run: [Advanced SystemCare 8] => C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe [2429728 2015-04-08] (IObit)
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\Run: [GarenaPlus] => C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe [9862184 2016-03-17] ()
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\Run: [Spotify Web Helper] => C:\Users\Ren\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1554032 2016-06-01] (Spotify Ltd)
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\Run: [Spotify] => C:\Users\Ren\AppData\Roaming\Spotify\Spotify.exe [6859888 2016-06-01] (Spotify Ltd)
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3077712 2016-04-30] (Valve Corporation)
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3911248 2015-11-10] (Tonec Inc.)
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\SysWOW64\lol.scr [3721216 2016-03-31] ()
HKU\S-1-5-18\...\RunOnce: [Report] => \AdwCleaner\AdwCleaner[C1].txt
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [177416 2015-11-12] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [155976 2015-11-12] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [! IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2015-08-14] (Tonec Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{06B7F6A3-EE35-4DE0-9335-8DBF49C612DC}: [NameServer] 4.2.2.3,4.2.2.4
Tcpip\..\Interfaces\{06B7F6A3-EE35-4DE0-9335-8DBF49C612DC}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{35F4B348-82CE-4092-A7B9-27C3746D7EEF}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3395374877-1411387906-284835622-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2015-09-28] (Internet Download Manager, Tonec Inc.)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-05-26] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2016-05-26] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-05-26] (Microsoft Corporation)
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2015-09-28] (Internet Download Manager, Tonec Inc.)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-05-26] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-06-27] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2016-05-26] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-05-26] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-06-27] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-26] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-26] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-26] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-26] (Microsoft Corporation)
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2016-01-06] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2016-01-06] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-06-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-06-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-05-26] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-05-26] (Microsoft Corporation)
FF Plugin-x32: @t.garena.com/garenatalk -> C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll [2015-10-02] ( Garena)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi
FF Extension: IDM integration - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2015-11-09]
FF HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Ren\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Ren\AppData\Roaming\IDM\idmmzcc5 [2016-07-05] [not signed]
 
Chrome: 
=======
CHR Profile: C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-12]
CHR Extension: (YouTube) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-12]
CHR Extension: (Google Search) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-12]
CHR Extension: (Cloud SWF, Flash Player with Drive) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffhhaadihgfcgmlefioblaahpnglnkbk [2016-02-07]
CHR Extension: (Material for Chrome) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\gokahbgdhhcjfnjlfeiojfmgnoikpcco [2016-05-06]
CHR Extension: (IDM Integration Module) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2016-06-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Hola - Unlimited Proxy VPN) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\opalpjjboefohnelaemnhdhlceibbcgl [2016-04-01]
CHR Extension: (Gmail) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-12]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-11-09]
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2015-11-09]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AdvancedSystemCareService8; C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCService.exe [821024 2015-08-05] (IObit)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [441976 2015-10-09] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [421496 2015-10-09] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [867960 2015-10-09] (BlueStack Systems, Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2945792 2016-05-26] (Microsoft Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [354936 2016-03-14] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [625648 2015-06-08] (Lenovo)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-29] (IObit)
R2 LolScreenSaverService; C:\Riot Games\LolScreenSaver\service\service.exe [707072 2016-03-31] () [File not signed]
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 nlsvc; C:\Program Files\Locktime Software\NetLimiter 4\NLSvc.exe [323824 2016-03-16] (Locktime Software)
S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [200240 2016-05-25] (Microsoft Corporation) [File not signed]
R2 sesvc; C:\Program Files (x86)\ShadowExplorer\sesvc.exe [9216 2013-01-02] (www.shadowexplorer.com) [File not signed]
S3 ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [31192 2016-02-02] (SHAREit Technologies Co.Ltd)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6889232 2015-12-14] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [146040 2015-10-09] (BlueStack Systems)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-11-12] (REALiX™)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [31144 2015-11-12] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [180480 2016-03-27] (Intel Corporation)
R2 nldrv; C:\Program Files\Locktime Software\NetLimiter 4\nldrv.sys [128328 2016-03-16] (Locktime Software)
R3 Qcamain; C:\Windows\System32\DRIVERS\Qcamain7x64.sys [2311680 2015-11-12] (Qualcomm Atheros, Inc.)
R3 RTSUER; C:\Windows\System32\Drivers\RtsUer.sys [402136 2015-11-12] (Realsil Semiconductor Corporation)
S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2016-03-09] ()
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [33448 2015-11-12] (Synaptics Incorporated)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-07-05] ()
S3 wdm_usb; C:\Windows\System32\DRIVERS\usb2ser.sys [151184 2016-03-10] (MBB)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [X]
S3 gkernel; \??\C:\Users\Ren\AppData\Local\Temp\gkernel.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-07-05 20:02 - 2016-07-05 21:28 - 00000000 ____D C:\FRST
2016-07-05 19:56 - 2016-07-05 19:56 - 00025788 _____ C:\ComboFix.txt
2016-07-05 19:42 - 2016-07-05 19:56 - 00000000 ____D C:\Qoobox
2016-07-05 19:42 - 2016-07-05 19:55 - 00000000 ____D C:\Windows\erdnt
2016-07-05 19:42 - 2011-06-26 14:45 - 00256000 _____ C:\Windows\PEV.exe
2016-07-05 19:42 - 2010-11-08 01:20 - 00208896 _____ C:\Windows\MBR.exe
2016-07-05 19:42 - 2009-04-20 12:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-07-05 19:42 - 2000-08-31 08:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-07-05 19:42 - 2000-08-31 08:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-07-05 19:42 - 2000-08-31 08:00 - 00098816 _____ C:\Windows\sed.exe
2016-07-05 19:42 - 2000-08-31 08:00 - 00080412 _____ C:\Windows\grep.exe
2016-07-05 19:42 - 2000-08-31 08:00 - 00068096 _____ C:\Windows\zip.exe
2016-07-05 19:41 - 2016-07-05 19:42 - 00000000 ____D C:\Users\Ren\Downloads\Compressed
2016-07-05 19:33 - 2016-07-05 19:33 - 00000000 ____D C:\Users\Ren\AppData\Roaming\JAM Software
2016-07-05 19:33 - 2016-07-05 19:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize Free
2016-07-05 19:33 - 2016-07-05 19:33 - 00000000 ____D C:\Program Files (x86)\JAM Software
2016-07-05 19:13 - 2016-07-05 19:13 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-07-05 19:12 - 2016-07-05 19:12 - 00000000 ____D C:\ProgramData\RogueKiller
2016-07-05 19:09 - 2016-07-05 19:10 - 00002144 _____ C:\Users\Ren\Desktop\Rkill.txt
2016-07-05 19:01 - 2016-07-05 19:01 - 00460720 _____ C:\Windows\system32\FNTCACHE.DAT
2016-07-05 18:56 - 2016-07-05 19:06 - 00000000 ____D C:\AdwCleaner
2016-07-05 18:39 - 2016-07-05 18:39 - 00114984 _____ C:\Users\Ren\AppData\Local\GDIPFONTCACHEV1.DAT
2016-07-03 14:39 - 2016-07-05 18:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Social2Sea Browser Enhancer
2016-07-03 14:39 - 2016-07-03 14:39 - 00031411 _____ C:\Windows\ec983fd5cf0613b900ce51e6e4700abd.ps1
2016-07-03 14:39 - 2016-07-03 14:39 - 00003598 _____ C:\Windows\System32\Tasks\ec983fd5cf0613b900ce51e6e4700abd
2016-07-03 10:53 - 2016-07-03 10:53 - 00000000 ____D C:\Program Files\DIFX
2016-07-03 10:52 - 2016-07-03 10:52 - 00000000 ____D C:\adb
2016-07-03 09:30 - 2011-11-25 01:25 - 00015360 _____ (June Fabrics Technology Inc.) C:\Windows\system32\Drivers\pneteth.sys
2016-07-03 08:59 - 2016-07-03 08:59 - 00000000 ____D C:\Users\Ren\Desktop\New folder (3)
2016-07-03 08:51 - 2016-07-03 08:51 - 00003272 _____ C:\Windows\System32\Tasks\{6F3A2A0C-CD29-4EAB-BD26-CCFDB592A2B6}
2016-07-03 08:31 - 2016-07-03 08:31 - 00003392 _____ C:\Windows\System32\Tasks\{76C241A2-0A11-41A9-AAD6-64A4F25FAC0F}
2016-07-03 08:30 - 2016-07-03 08:30 - 00003394 _____ C:\Windows\System32\Tasks\{22989187-C922-4FCB-9069-364680074509}
2016-07-03 08:29 - 2010-02-19 07:00 - 01533512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFUpdate_01007.dll
2016-07-03 08:29 - 2010-02-19 07:00 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01007.dll
2016-07-03 08:29 - 2010-02-19 07:00 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WinUSBCoInstaller.dll
2016-07-03 05:37 - 2016-07-03 05:39 - 00019550 _____ C:\Users\Ren\Desktop\Show-Hidden.txt
2016-07-03 05:36 - 2016-07-05 19:53 - 00059776 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2016-07-03 04:45 - 2016-07-03 04:45 - 00000000 ____D C:\Users\Ren\AppData\Roaming\www.shadowexplorer.com
2016-07-03 04:43 - 2016-07-03 04:43 - 00001885 _____ C:\Users\Ren\Desktop\ShadowExplorer.lnk
2016-07-03 04:43 - 2016-07-03 04:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShadowExplorer
2016-07-03 04:43 - 2016-07-03 04:43 - 00000000 ____D C:\Program Files (x86)\ShadowExplorer
2016-07-03 00:20 - 2016-07-03 15:44 - 00000000 ____D C:\Windows\system32\SSL
2016-07-03 00:19 - 2016-07-03 14:49 - 00002104 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gооglе Сhrоmе.lnk
2016-07-03 00:19 - 2016-07-03 14:49 - 00002086 _____ C:\Users\Public\Desktop\Gооglе Сhrоmе.lnk
2016-07-03 00:19 - 2016-07-03 02:23 - 00001914 _____ C:\Users\Ren\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехрlоrеr.lnk
2016-07-02 23:12 - 2016-07-02 23:12 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2016-07-02 22:20 - 2010-02-19 07:00 - 01533512 _____ (Microsoft Corporation) C:\Windows\system32\wudfupdate_01007.dll
2016-07-02 22:20 - 2010-02-19 07:00 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\wdfcoinstaller01007.dll
2016-07-02 22:20 - 2010-02-19 07:00 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\winusbcoinstaller.dll
2016-07-02 22:02 - 2016-07-03 15:51 - 00000000 ____D C:\Users\Ren\AppData\Local\Mediatek
2016-07-02 21:23 - 2016-07-04 11:53 - 00000000 ____D C:\ProgramData\SP_FT_Logs
2016-07-02 21:23 - 2016-07-02 21:23 - 00000000 ____D C:\Users\Ren\AppData\Local\Trolltech
2016-07-02 21:22 - 2016-07-03 14:05 - 00000000 ____D C:\Users\Ren\Desktop\New folder (2)
2016-07-01 00:47 - 2016-07-01 01:11 - 00000000 ____D C:\Users\Ren\Downloads\Video
2016-06-30 23:44 - 2016-06-30 23:54 - 64546498 _____ C:\Users\Ren\Downloads\com.supercell.clashofclans_v8.332.14-773_Android-4.0.3.apk
2016-06-28 21:48 - 2016-06-28 21:48 - 00000000 _____ C:\Users\Ren\Downloads\form2WirelessTbl.cgi
2016-06-09 01:00 - 2016-06-09 01:00 - 00000000 _____ C:\Users\Ren\pslog.txt
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-07-05 21:14 - 2015-12-06 22:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-07-05 21:02 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\inf
2016-07-05 20:40 - 2015-11-12 18:57 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-05 20:01 - 2009-07-14 12:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-05 20:01 - 2009-07-14 12:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-05 19:53 - 2016-03-27 22:27 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-07-05 19:53 - 2015-12-06 22:04 - 00217328 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-05 19:53 - 2015-11-14 11:38 - 00003476 _____ C:\Windows\System32\Tasks\Garena+ Plugin Host Service
2016-07-05 19:53 - 2015-11-12 18:33 - 00000000 __SHD C:\Users\Ren\IntelGraphicsProfiles
2016-07-05 19:53 - 2009-07-14 10:34 - 00000215 _____ C:\Windows\system.ini
2016-07-05 19:52 - 2015-11-12 18:57 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-05 19:52 - 2009-07-14 13:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-05 19:50 - 2015-11-21 21:29 - 00000000 ____D C:\Users\Ren\AppData\Roaming\DMCache
2016-07-05 19:03 - 2015-11-12 16:21 - 00000000 ____D C:\ProgramData\ProductData
2016-07-05 18:55 - 2016-03-27 19:24 - 00000000 ____D C:\Users\Ren\AppData\Roaming\IDM
2016-07-05 18:38 - 2016-04-26 07:53 - 00000000 ____D C:\Users\Ren\Desktop\Warcraft III
2016-07-05 18:35 - 2016-02-06 08:27 - 00000000 ____D C:\Users\Ren\AppData\Roaming\TeamViewer
2016-07-05 18:35 - 2016-01-22 21:12 - 00000000 ____D C:\Program Files (x86)\Steam
2016-07-05 18:35 - 2015-11-20 14:55 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-07-05 18:35 - 2015-11-13 14:08 - 00000000 ____D C:\Users\Ren\AppData\Roaming\BitTorrent
2016-07-05 18:33 - 2015-12-06 21:59 - 00000000 ____D C:\Program Files\CCleaner
2016-07-05 18:32 - 2015-11-20 14:52 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-07-03 15:30 - 2015-11-12 19:13 - 00007598 _____ C:\Users\Ren\AppData\Local\Resmon.ResmonCfg
2016-07-03 08:44 - 2015-11-11 19:12 - 00000000 ____D C:\Users\Ren\AppData\Local\VirtualStore
2016-07-03 02:45 - 2016-03-06 22:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCWest
2016-07-03 02:45 - 2016-03-06 22:53 - 00000000 ____D C:\Program Files (x86)\NCWest
2016-07-01 03:13 - 2015-11-21 21:54 - 00000000 ____D C:\Users\Ren\AppData\Roaming\vlc
2016-06-30 23:56 - 2015-11-19 15:26 - 00000000 ____D C:\ProgramData\Oracle
2016-06-29 10:44 - 2015-11-12 18:51 - 00000000 ____D C:\Program Files (x86)\Garena Plus
2016-06-27 08:03 - 2015-11-19 15:26 - 00000000 ____D C:\Users\Ren\.oracle_jre_usage
2016-06-27 08:03 - 2015-11-19 15:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-06-27 08:03 - 2015-11-19 15:26 - 00000000 ____D C:\Program Files (x86)\Java
2016-06-27 08:02 - 2015-11-19 15:26 - 00097344 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2016-06-26 10:01 - 2015-11-20 15:09 - 00000000 ____D C:\ProgramData\KMSAutoS
2016-06-24 12:34 - 2015-11-12 18:56 - 00000000 ____D C:\Users\Ren\AppData\Roaming\GarenaPlus
2016-06-24 12:34 - 2015-11-12 18:51 - 00000000 ____D C:\ProgramData\GarenaMessenger
2016-06-23 18:19 - 2015-11-18 03:56 - 00000000 ____D C:\Users\Ren\AppData\Local\Spotify
2016-06-23 18:18 - 2015-11-17 18:20 - 00000000 ____D C:\Users\Ren\AppData\Roaming\Spotify
2016-06-15 11:39 - 2016-04-09 12:40 - 00000000 ____D C:\Users\Ren\AppData\Local\Chris_Pietschmann_(http__
2016-06-09 01:00 - 2015-11-11 19:12 - 00000000 ____D C:\Users\Ren
2016-06-06 22:08 - 2015-11-14 15:17 - 00000000 ____D C:\Users\Ren\AppData\Roaming\NVIDIA
2016-06-06 07:36 - 2016-04-09 11:11 - 00000000 ____D C:\Program Files (x86)\Virtual Router
2016-06-06 07:35 - 2016-04-25 18:36 - 00000375 _____ C:\Windows\system32\Drivers\etc\hosts.ics
 
==================== Files in the root of some directories =======
 
2016-04-26 11:29 - 2016-04-30 14:54 - 0045270 _____ () C:\Users\Ren\AppData\Roaming\room_v3.dat
2015-11-12 19:13 - 2016-07-03 15:30 - 0007598 _____ () C:\Users\Ren\AppData\Local\Resmon.ResmonCfg
2015-11-12 18:29 - 2015-11-12 18:29 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-07-03 16:44
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Ren (2016-07-05 21:29:09)
Running from C:\Users\Ren\Downloads\Programs
Windows 7 Ultimate Service Pack 1 (X64) (2015-11-11 11:12:33)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-3395374877-1411387906-284835622-500 - Administrator - Disabled)
Guest (S-1-5-21-3395374877-1411387906-284835622-501 - Limited - Disabled)
Ren (S-1-5-21-3395374877-1411387906-284835622-1000 - Administrator - Enabled) => C:\Users\Ren
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Flash Player 20 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 20.0.0.286 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.0 - Adobe Systems Incorporated)
Advanced SystemCare 8 (HKLM-x32\...\Advanced SystemCare 8_is1) (Version: 8.4.0 - IObit)
Apple Application Support (64-bit) (HKLM\...\{691F30EB-9009-475A-B8A9-E1BF39598FD5}) (Version: 4.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
BitTorrent (HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\BitTorrent) (Version: 7.9.7.42331 - BitTorrent Inc.)
BlueStacks App Player (HKLM-x32\...\{D7E3588F-25E6-4A93-8B1C-596F7951CA38}) (Version: 1.1.11.8004 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.10 - Piriform)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Dev-C++ (HKLM-x32\...\Dev-C++) (Version: 5.11 - Bloodshed Software)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Garena - League of Legends (HKLM-x32\...\LoLPH) (Version:  - Garena Online Pte Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
IDM Patch 6.25 build 03 (HKLM-x32\...\IDM Patch 6.25 build 03) (Version: build 03 - SandySeedings Team)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4380 - Intel Corporation)
Intel® Product Improvement Program (x32 Version: 2.1.26 - Intel) Hidden
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version:  - Tonec Inc.)
iTunes (HKLM\...\{FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}) (Version: 12.3.2.35 - Apple Inc.)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.15 - Oracle Corporation)
League Screensaver (HKLM-x32\...\LolScreenSaver) (Version: W0.1.19-0.11.13-beta - Riot Games)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Metric Collection SDK 35 (x32 Version: 1.2.0010.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.6 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft Office Professional Plus 2016 - en-us (HKLM\...\ProPlusRetail - en-us) (Version: 16.0.6965.2053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
NetLimiter 4 (HKLM-x32\...\NetLimiter 4 4.0.19.0) (Version: 4.0.19.0 - Locktime Software)
NetLimiter 4 (Version: 4.0.19.0 - Locktime Software) Hidden
NVIDIA PhysX (HKLM-x32\...\{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}) (Version: 9.09.1112 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6925.1016 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6925.1016 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6925.1016 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.94.723.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7628 - Realtek Semiconductor Corp.)
ShadowExplorer 0.9 (HKLM-x32\...\ShadowExplorer_is1) (Version: 0.9.462.0 - ShadowExplorer.com)
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.3.0.658 - Lenovo)
Skype™ 7.17 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.17.105 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3395374877-1411387906-284835622-1000\...\Spotify) (Version: 1.0.29.92.g67727800 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.53254 - TeamViewer)
TreeSize Free V3.4.5 (HKLM-x32\...\TreeSize Free_is1) (Version: 3.4.5 - JAM Software)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WinRAR 5.30 beta 6 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.30.6 - win.rar GmbH)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {1871D9C5-1555-4F99-885D-95773BEDECAD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-09-17] (Piriform Ltd)
Task: {1C6B9827-0A0B-471F-89BF-495FD8B55165} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-05-26] (Microsoft Corporation)
Task: {1F02F08D-C794-49FC-BF7D-8B66B87F28C6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-12] (Google Inc.)
Task: {39004AAC-E3AC-4DD1-9914-912E4DC782DA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe
Task: {3D08B4D1-CC68-4FD0-A128-D2AB49779679} - System32\Tasks\Driver Booster SkipUAC (Ren) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: {7A408AEE-ED73-49F7-83B4-6B4A4355DFC4} - System32\Tasks\ASC8_SkipUac_Ren => C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASC.exe [2015-08-17] (IObit)
Task: {7F8A56FB-807C-459B-9A1E-49FB7F8A7A43} - System32\Tasks\{22989187-C922-4FCB-9069-364680074509} => pcalua.exe -a "C:\Users\Ren\Downloads\Software\SP_Flash_Tool_v3.1320.0.174_Secboot\Install package - Copy\DriverSetup.exe" -d "C:\Users\Ren\Downloads\Software\SP_Flash_Tool_v3.1320.0.174_Secboot\Install package - Copy"
Task: {8583A313-1DC5-4B6A-82DE-1EA912FFAB1E} - System32\Tasks\KMSAutoNet => C:\ProgramData\KMSAutoS\KMSAuto Net.exe [2015-08-10] (MSFree Inc.)
Task: {870C6794-AA1F-4AB2-9DBA-41E7058EF79B} - System32\Tasks\ec983fd5cf0613b900ce51e6e4700abd => powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File C:\Windows\ec983fd5cf0613b900ce51e6e4700abd.ps1
Task: {9AF606B6-BB3A-48FF-9507-3D18D30E2B7A} - System32\Tasks\{76C241A2-0A11-41A9-AAD6-64A4F25FAC0F} => pcalua.exe -a "C:\Users\Ren\Downloads\Software\SP_Flash_Tool_v3.1320.0.174_Secboot\Install package - Copy\devsetup32.exe" -d "C:\Users\Ren\Downloads\Software\SP_Flash_Tool_v3.1320.0.174_Secboot\Install package - Copy"
Task: {A479CFFC-7CE7-46AD-BF7E-807619A774DD} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-05-26] (Microsoft Corporation)
Task: {A6D9F2E3-5679-49C2-813B-BEF099AEAD88} - System32\Tasks\Garena+ Plugin Host Service => C:\Program Files (x86)\Garena Plus\ggdllhost.exe [2016-02-22] ()
Task: {C4E16CF1-4A4F-4960-888F-2DAD029CCCA9} - System32\Tasks\{6F3A2A0C-CD29-4EAB-BD26-CCFDB592A2B6} => pcalua.exe -a "C:\Program Files (x86)\Handset WinDriver\Driver\X64\Driver\install_driver.exe" -d "C:\Program Files (x86)\Handset WinDriver\Driver\X64\Driver"
Task: {C9E29602-6010-4E12-8C41-1A87A69CCF4E} - System32\Tasks\Intel\Intel Telemetry 2 (x86) => C:\Program Files (x86)\Intel\Telemetry 2.0\lrio.exe [2016-03-17] (Intel Corporation)
Task: {EEC64551-7101-4614-863D-1C8F5D2CA1F8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-05-26] (Microsoft Corporation)
Task: {F3A31C04-EE5A-43E9-B659-D5DC448CF18D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-05-26] (Microsoft Corporation)
Task: {FC3A4EDA-2487-4D13-892E-92A4F41F59B4} - System32\Tasks\{79A475C1-7E71-41D0-8CAB-20CBCF4A940C} => C:\Users\Ren\Desktop\Warcraft III\Mineskeys+.exe [2011-04-01] ()
Task: {FF0369C4-7648-46C6-A3FD-73615F2C7080} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-12] (Google Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
ShortcutWithArgument: C:\Users\Ren\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-11-12 18:28 - 2015-10-03 10:49 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-12-17 18:38 - 2015-12-17 18:38 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-12-17 18:38 - 2015-12-17 18:38 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-12-20 18:42 - 2016-02-22 19:24 - 00174632 _____ () C:\Program Files (x86)\Garena Plus\ggdllhost.exe
2016-03-31 02:25 - 2016-03-31 02:25 - 00707072 _____ () C:\Riot Games\LolScreenSaver\service\service.exe
2016-03-14 17:59 - 2016-03-14 17:59 - 00384120 _____ () C:\Windows\system32\igfxTray.exe
2016-03-03 21:47 - 2016-05-26 17:13 - 08919752 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2015-12-20 18:42 - 2016-03-30 15:33 - 03310632 _____ () C:\Program Files (x86)\Garena Plus\ggspawn.dll
2015-11-12 18:27 - 2015-11-12 18:27 - 00012080 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2016-03-03 21:43 - 2016-05-26 16:08 - 08919744 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\1033\GrooveIntlResource.dll
2016-06-22 12:52 - 2016-06-15 17:15 - 01745560 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libglesv2.dll
2016-06-22 12:52 - 2016-06-15 17:15 - 00091288 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libegl.dll
2016-06-22 12:52 - 2016-06-15 17:15 - 17599640 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2016-07-05 19:50 - 2016-07-05 19:53 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
 
127.0.0.1       localhost
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 4.2.2.3 - 4.2.2.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{33562566-0DBE-46E1-B4A6-EBBA833D8129}] => (Allow) C:\Program Files (x86)\Garena Plus\ggdllhost.exe
FirewallRules: [TCP Query User{8B1576CD-4301-4128-BE62-DFD7E0AF5068}C:\program files (x86)\garena plus\garenamessenger.exe] => (Allow) C:\program files (x86)\garena plus\garenamessenger.exe
FirewallRules: [UDP Query User{D14D54DA-104B-4563-A246-991EC54BFB92}C:\program files (x86)\garena plus\garenamessenger.exe] => (Allow) C:\program files (x86)\garena plus\garenamessenger.exe
FirewallRules: [{29B58245-975D-4A92-943E-CEDF008793DD}] => (Allow) LPort=8370
FirewallRules: [{23E8E7BA-B369-4BD4-9721-8FAEA848B9E6}] => (Allow) LPort=8370
FirewallRules: [{30B978B0-DF34-4FF6-BF67-F1AB7FB17534}] => (Allow) C:\Users\Ren\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{6A399981-BF0F-437A-856B-22F94A8A174F}] => (Allow) C:\Users\Ren\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{97109FD1-C90E-486E-B91B-912FEF1D6D74}] => (Allow) C:\Users\Ren\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{9678B6E5-39AB-47BA-A383-800AAD992173}] => (Allow) C:\Users\Ren\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{68266591-2844-47E1-8B32-10200F61AEAA}] => (Allow) C:\Users\Ren\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{466FB6D4-C367-42EC-BCA6-F0E87ABE2436}] => (Allow) C:\Users\Ren\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [TCP Query User{3BFE43F9-7682-4D13-863E-DA0AB93CBB11}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe] => (Allow) C:\program files (x86)\garena plus\bbtalk\bbtalk.exe
FirewallRules: [UDP Query User{D3A1D986-580D-4E89-8420-F2F2A312D2A0}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe] => (Allow) C:\program files (x86)\garena plus\bbtalk\bbtalk.exe
FirewallRules: [TCP Query User{17E9D0EE-75A8-4BAE-90B3-8E1DF380CE04}C:\users\ren\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ren\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{CD745FAF-F99C-4B6F-A59D-D52EF7334707}C:\users\ren\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ren\appdata\roaming\spotify\spotify.exe
FirewallRules: [{6433C29E-F2C7-43F0-847D-1C483DA48E51}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{9DBE02F2-1A04-415F-B0A3-5E08B3B55052}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{B722FFFD-9A5C-4A03-97B9-A8717C4EE86F}] => (Allow) LPort=6897
FirewallRules: [{0078F1C2-7015-4F71-A05A-7B8968457A8C}] => (Allow) LPort=6897
FirewallRules: [TCP Query User{DD951F5E-31EB-4C1A-A170-D1C08C111594}C:\users\ren\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ren\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{0BD00A6B-99BB-4D87-9FC8-D88E21ADB082}C:\users\ren\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ren\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{C82E4C24-5A9C-4568-863D-2094B03FEEB0}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe] => (Allow) C:\program files (x86)\garena plus\bbtalk\bbtalk.exe
FirewallRules: [UDP Query User{8390BBE2-19DD-4FBC-97FD-EBA228C29FD0}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe] => (Allow) C:\program files (x86)\garena plus\bbtalk\bbtalk.exe
FirewallRules: [{16663F54-8A3B-4FD6-B19F-0F7699522C73}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{B9564AFD-0E21-4373-A7BB-A5897A64D775}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{065A5F9B-BFE0-4A4A-A840-3E2EB65CAD15}] => (Allow) C:\GarenaDownload\Games\lolph\LoLInstaller.exe
FirewallRules: [{DA69943B-4C94-447C-A98D-178E2F9AA675}] => (Allow) C:\GarenaDownload\Games\lolph\LoLInstaller.exe
FirewallRules: [{077CC00C-CB8E-44CF-AE04-FF3037DCEE70}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{3701B2FC-0EB4-4974-98D6-3AB70D369F36}] => (Allow) LPort=6926
FirewallRules: [{47119733-310D-47A1-B009-838E3DF59093}] => (Allow) LPort=6926
FirewallRules: [{8C3B441F-030F-4F9E-9C6B-4E75D6C2D7D4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{288196DA-CFEF-488B-9F57-DFE055182247}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C8955329-FDBA-4025-9009-96390472141F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{66DA5CCF-43F9-4C0B-9CE7-75E90B574482}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{32FDD519-BCC1-4893-8CDA-15C8519C47BB}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{1F106DDC-534A-4AEE-B0B0-B04FECFC8F21}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7BF0B44C-B7C3-403A-BB5E-BE9D9CFAF6FF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{1AC0AE78-75AC-4804-99F8-C7D3F8418A53}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{92A21BB7-6368-462A-9359-BCA9611E56E6}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{E5061716-D2B8-48A1-B31A-BC48016AF9CF}] => (Allow) LPort=6943
FirewallRules: [{F6A67168-9000-40C0-90C1-DFB2D6ED241D}] => (Allow) LPort=6943
FirewallRules: [{59004226-000F-49F2-814D-03BC1FA5EF64}] => (Allow) LPort=6909
FirewallRules: [{BE53C668-EAB6-41FA-9E37-215AE1954531}] => (Allow) LPort=6909
FirewallRules: [{9DB68BCF-6A71-4007-87BD-293B0684FB97}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{AC96E008-B48E-41CE-9CFC-50330C9DF209}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{E4478CA5-9EBA-400B-945F-085416F344EF}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{EAB6C27E-1778-423A-AD56-8D19CD7DB5F3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{305EBEF9-CEE6-4CED-80FA-B5C62A3B216C}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Air\LolClient.exe
FirewallRules: [{547C72D9-3D4B-4F55-89A9-6916EAA11995}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Air\LolClient.exe
FirewallRules: [{C6DCDB7F-2524-48D8-B3E7-1D108075C79B}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Game\League of Legends.exe
FirewallRules: [{A5FFA5F3-1EA1-413D-8AB1-8EA9EB07FDA7}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Game\League of Legends.exe
FirewallRules: [{5619ADE2-9E6A-4751-851E-570455E4260F}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{867F3D3F-C9F3-4EB2-BD24-5C64564BA81A}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{3FD7F3CF-A8D1-45A2-A116-971E88855D76}] => (Allow) LPort=6931
FirewallRules: [{B64652E2-2B06-4073-9948-8516E9ACDD06}] => (Allow) LPort=6931
FirewallRules: [{D50F8806-5309-4251-84F5-610C5B078CF2}] => (Allow) LPort=6886
FirewallRules: [{6BF42CE5-E4BC-489A-A031-AFB5BB5DA260}] => (Allow) LPort=6886
FirewallRules: [{8A458214-FFA7-417C-8FD7-48921B510F16}] => (Allow) LPort=6988
FirewallRules: [{72E65055-2E06-444E-AC57-24C58ACD4291}] => (Allow) LPort=6988
FirewallRules: [TCP Query User{9A72483D-06F4-493C-B80D-A64F59BC612B}C:\program files (x86)\garena plus\garenamessenger.exe] => (Allow) C:\program files (x86)\garena plus\garenamessenger.exe
FirewallRules: [UDP Query User{C05DBFA9-74CE-4CE5-AFB7-37EDF1E6E1CB}C:\program files (x86)\garena plus\garenamessenger.exe] => (Allow) C:\program files (x86)\garena plus\garenamessenger.exe
FirewallRules: [{0BE6D3FA-846D-4858-95EC-BD2C07FFFC97}] => (Allow) LPort=6989
FirewallRules: [{0B3D1810-A170-4206-AC42-864934DA1216}] => (Allow) LPort=6989
FirewallRules: [{206F6AEC-8074-4090-BBC9-13E2D3806222}] => (Allow) LPort=6980
FirewallRules: [{30AB936A-BBE2-4177-AC37-1752D66C4865}] => (Allow) LPort=6980
FirewallRules: [{21071896-3DBE-44FF-9A85-5CF14ADB92D8}] => (Allow) LPort=6906
FirewallRules: [{159B42AC-1A96-4F75-9EA4-F23E7E7012E6}] => (Allow) LPort=6906
FirewallRules: [{A6C3E15A-CE8E-4C78-B0B1-B4562C8A46E2}] => (Allow) LPort=8370
FirewallRules: [{02324A82-4BA7-4161-BA49-CFAE800C0A71}] => (Allow) LPort=8370
FirewallRules: [{07465861-F210-4144-B030-49E8FB893CD8}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Air\LolClient.exe
FirewallRules: [{DB143847-F186-46EB-B1F3-C4C99FBD0221}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Air\LolClient.exe
FirewallRules: [{AE76F839-1086-4AA3-9C8B-45610CFE5E8F}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Game\League of Legends.exe
FirewallRules: [{AE157F65-B30B-4152-9BF5-A7C69927CC1A}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\Game\League of Legends.exe
FirewallRules: [{072B00D4-B532-4462-B47F-0404F7057C44}] => (Allow) LPort=6994
FirewallRules: [{D90D522B-5F0A-4870-8C09-BCB21E1F4B95}] => (Allow) LPort=6994
FirewallRules: [{7C3D6D1F-8B90-43F4-AB35-8E89FE203479}] => (Allow) LPort=6948
FirewallRules: [{F4316F40-7432-4ACB-88FB-C892D74F845B}] => (Allow) LPort=6948
FirewallRules: [{5398C519-443C-4F58-B3E2-D56FCDF7F4E7}] => (Allow) LPort=6971
FirewallRules: [{00FF300B-4926-41B7-B16A-8A08C1352D40}] => (Allow) LPort=6971
FirewallRules: [{027B156F-83A3-40FE-8FCB-099A7B4F7347}] => (Allow) LPort=6913
FirewallRules: [{486A596F-072E-45C3-9710-48A079220862}] => (Allow) LPort=6913
FirewallRules: [{3A67D20E-53DC-4A0A-8241-2B82B538A09B}] => (Allow) LPort=6992
FirewallRules: [{400D917F-390D-427A-8C54-E2C8F8A039A5}] => (Allow) LPort=6992
FirewallRules: [{25B34BAD-C021-4B41-8C62-10477A815113}] => (Allow) LPort=6967
FirewallRules: [{DB661265-CE7F-43B5-9E22-A3461C9B1D91}] => (Allow) LPort=6967
FirewallRules: [{39D446B0-3EA9-4AD7-8AFB-D2213C5313C0}] => (Allow) LPort=6990
FirewallRules: [{256DA799-B955-4111-979A-76799B0D572D}] => (Allow) LPort=6990
FirewallRules: [{CE0EB289-198F-4D01-98CC-B1B113F98945}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\lol.exe
FirewallRules: [{25D9979A-F50C-41DD-A4E6-6776AD5E846E}] => (Allow) C:\GarenaLoL\GameData\Apps\LoLPH\lol.exe
FirewallRules: [{D66E9988-1F74-4D56-A8D0-CFFADC4176AD}] => (Allow) LPort=8393
FirewallRules: [{68240EFF-D0E8-4C39-9F65-0820FC52506F}] => (Allow) LPort=8393
FirewallRules: [{39BE8072-B84B-4349-9390-DF6D7095C41F}] => (Allow) LPort=8390
FirewallRules: [{A019472F-F6C1-457D-9384-F3D619ED47E9}] => (Allow) LPort=8390
FirewallRules: [{BC871996-6FE2-40CC-B211-7A920E3D5E13}] => (Allow) LPort=6885
FirewallRules: [{B7851B9C-B15D-4446-9963-E108629EB9B9}] => (Allow) LPort=6885
FirewallRules: [{2F793765-A5D5-4ECA-9E35-8CB7E8428E42}] => (Allow) LPort=6985
FirewallRules: [{5D8F4A5E-1D80-40C4-8EDA-6E5F11818C80}] => (Allow) LPort=6985
FirewallRules: [{9F70638D-31FA-40AA-AA7D-60FF7D62D93E}] => (Allow) LPort=6911
FirewallRules: [{F9F9ACD6-7857-412C-A610-FA551656DBD7}] => (Allow) LPort=6911
FirewallRules: [{A291A215-70D8-44B5-A71C-13DB73F32FDA}] => (Allow) C:\Program Files (x86)\Garena Plus\Room\garena_room.exe
FirewallRules: [TCP Query User{5F9CEBB0-BAB4-4687-83DA-1B7A5AB733D8}C:\users\ren\desktop\warcraft iii\war3.exe] => (Allow) C:\users\ren\desktop\warcraft iii\war3.exe
FirewallRules: [UDP Query User{7224EC5F-F17B-4786-8220-30AD7D62183B}C:\users\ren\desktop\warcraft iii\war3.exe] => (Allow) C:\users\ren\desktop\warcraft iii\war3.exe
FirewallRules: [{BC0CB8BF-2415-4F44-B304-3371EE357574}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4D1D8ABB-E6B6-4188-AB16-90C187997965}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{06971CD0-3F05-416C-B2C1-048E0BB06CFC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{6DF0EB89-87A7-4AAE-9E3B-90D5038044CF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{C9B77422-5C31-4BE5-BC6B-93854AF37568}] => (Allow) C:\GarenaDownload\Games\lolph\LoLInstaller.exe
FirewallRules: [{114604DE-78D6-4A8D-B86B-BEAAAD50B354}] => (Allow) C:\GarenaDownload\Games\lolph\LoLInstaller.exe
FirewallRules: [TCP Query User{B50B458F-B08E-4AAC-944C-587CEC7362B8}C:\program files (x86)\garena plus\updatemanager.exe] => (Allow) C:\program files (x86)\garena plus\updatemanager.exe
FirewallRules: [UDP Query User{92845C5A-A1D2-42A9-B683-E69F93C2DE50}C:\program files (x86)\garena plus\updatemanager.exe] => (Allow) C:\program files (x86)\garena plus\updatemanager.exe
FirewallRules: [{42E12BE1-BCFD-4A80-BAB4-96125D854DEA}] => (Allow) LPort=6987
FirewallRules: [{0096956A-D7D7-4D37-915B-33F9CE015B3C}] => (Allow) LPort=6987
FirewallRules: [{EE94AABD-03E8-4C75-8CD2-B8AA356B87F5}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{18C4F8E9-FF5C-44F4-891D-26CCF7FA9840}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
27-04-2016 12:43:45 Installed DirectX
27-04-2016 12:47:03 Installed DirectX
09-05-2016 06:43:26 Scheduled Checkpoint
16-05-2016 14:19:34 Scheduled Checkpoint
25-05-2016 01:09:08 Scheduled Checkpoint
01-06-2016 04:54:05 Scheduled Checkpoint
06-06-2016 07:35:21 Removed Virtual Router v1.0
14-06-2016 16:43:41 Scheduled Checkpoint
03-07-2016 10:52:40 Device Driver Package Install: Google, Inc. Android Phone
05-07-2016 19:42:55 ComboFix created restore point
 
==================== Faulty Device Manager Devices =============
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: MediaTek PreLoader USB VCOM Port (COM6)
Description: MediaTek PreLoader USB VCOM Port
Class Guid: {4d36e978-e325-11ce-bfc1-08002be10318}
Manufacturer: MediaTek Inc.
Service: usbser
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: MTK USB Port (COM8)
Description: MTK USB Port
Class Guid: {4d36e978-e325-11ce-bfc1-08002be10318}
Manufacturer: MediaTek Inc.
Service: usbser
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: Android ADB Interface
Description: Android ADB Interface
Class Guid: {3f966bd9-fa04-4ec5-991c-d326973b5128}
Manufacturer: Google, Inc.
Service: WinUSB
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: Android Bootloader Interface
Description: Android Bootloader Interface
Class Guid: {3f966bd9-fa04-4ec5-991c-d326973b5128}
Manufacturer: Google, Inc.
Service: WinUSB
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: Android ADB Interface
Description: Android ADB Interface
Class Guid: {3f966bd9-fa04-4ec5-991c-d326973b5128}
Manufacturer: Huawei Incorporated
Service: WinUSB
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: Android Composite ADB Interface
Description: Android Composite ADB Interface
Class Guid: {3f966bd9-fa04-4ec5-991c-d326973b5128}
Manufacturer: Google, Inc.
Service: WinUSB
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Android Bootloader Interface
Description: Android Bootloader Interface
Class Guid: {3f966bd9-fa04-4ec5-991c-d326973b5128}
Manufacturer: Huawei Incorporated
Service: WinUSB
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Android Sooner Single ADB Interface
Description: Android Sooner Single ADB Interface
Class Guid: {3f966bd9-fa04-4ec5-991c-d326973b5128}
Manufacturer: Huawei Incorporated
Service: WinUSB
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Universal Serial Bus (USB) Controller
Description: Universal Serial Bus (USB) Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (07/05/2016 07:53:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (07/05/2016 07:50:50 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: The handle is invalid
 
Error: (07/05/2016 07:50:50 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: The handle is invalid
 
Error: (07/05/2016 07:02:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (07/05/2016 07:01:50 PM) (Source: ESENT) (EventID: 455) (User: )
Description: taskhost (1844) WebCacheLocal: Error -1811 occurred while opening logfile C:\Users\Ren\AppData\Local\Microsoft\Windows\WebCache\V0100047.log.
 
Error: (07/05/2016 06:35:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (07/05/2016 06:33:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CCleaner64.exe, version: 5.10.0.5373, time stamp: 0x55f9cece
Faulting module name: CCleaner64.exe, version: 5.10.0.5373, time stamp: 0x55f9cece
Exception code: 0xc0000005
Fault offset: 0x00000000002b841e
Faulting process id: 0x1a40
Faulting application start time: 0xCCleaner64.exe0
Faulting application path: CCleaner64.exe1
Faulting module path: CCleaner64.exe2
Report Id: CCleaner64.exe3
 
Error: (07/04/2016 02:24:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9298
 
Error: (07/04/2016 02:24:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9298
 
Error: (07/04/2016 02:24:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
 
System errors:
=============
Error: (07/05/2016 08:12:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Microsoft Office Click-to-Run Service service terminated unexpectedly.  It has done this 3 time(s).
 
Error: (07/05/2016 08:09:50 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Microsoft Office Click-to-Run Service service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.
 
Error: (07/05/2016 08:09:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Microsoft Office Click-to-Run Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.
 
Error: (07/05/2016 07:50:36 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
 
Error: (07/05/2016 07:50:07 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (07/05/2016 07:49:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The League Screensaver service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 2000 milliseconds: Restart the service.
 
Error: (07/05/2016 07:48:42 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The League Screensaver service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 2000 milliseconds: Restart the service.
 
Error: (07/05/2016 07:47:59 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
 
Error: (07/05/2016 07:45:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The League Screensaver service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 2000 milliseconds: Restart the service.
 
Error: (07/05/2016 07:45:31 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)
Description: There was an error while attempting to read the local hosts file.
 
 
CodeIntegrity:
===================================
  Date: 2016-07-05 19:50:07.784
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2016-07-05 19:50:07.769
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-5200U CPU @ 2.20GHz
Percentage of memory in use: 56%
Total physical RAM: 4015.8 MB
Available physical RAM: 1760.47 MB
Total Virtual: 8029.8 MB
Available Virtual: 5461.4 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:487.79 GB) (Free:297.95 GB) NTFS
Drive d: () (Fixed) (Total:443.23 GB) (Free:405.44 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C34EEB3B)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=487.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=443.2 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
 

 

 

 

Attached Files



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,936 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:25 PM

Posted 05 July 2016 - 10:25 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.
 
Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
CHR Extension: (Chrome Web Store Payments) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Hola - Unlimited Proxy VPN) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\opalpjjboefohnelaemnhdhlceibbcgl [2016-04-01]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
Task: {8583A313-1DC5-4B6A-82DE-1EA912FFAB1E} - System32\Tasks\KMSAutoNet => C:\ProgramData\KMSAutoS\KMSAuto Net.exe
C:\ProgramData\KMSAutoS
C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.

Please let me know what problem persists with this computer.

#3 renski2498

renski2498
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:25 AM

Posted 05 July 2016 - 12:05 PM

Thank you for the respond nasdaq

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Ren (2016-07-06 00:20:39) Run:1
Running from C:\Users\Ren\Downloads\Programs
Loaded Profiles: Ren (Available Profiles: Ren)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3395374877-1411387906-284835622-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
CHR Extension: (Chrome Web Store Payments) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Hola - Unlimited Proxy VPN) - C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\opalpjjboefohnelaemnhdhlceibbcgl [2016-04-01]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
Task: {8583A313-1DC5-4B6A-82DE-1EA912FFAB1E} - System32\Tasks\KMSAutoNet => C:\ProgramData\KMSAutoS\KMSAuto Net.exe
C:\ProgramData\KMSAutoS
C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => key removed successfully
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
HKLM\SOFTWARE\Policies\Google => key not found. 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key not found. 
"HKU\S-1-5-21-3395374877-1411387906-284835622-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully
C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\opalpjjboefohnelaemnhdhlceibbcgl => not found
catchme => service removed successfully
GGSAFERDriver => service removed successfully
VGPU => service removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8583A313-1DC5-4B6A-82DE-1EA912FFAB1E}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8583A313-1DC5-4B6A-82DE-1EA912FFAB1E}" => key removed successfully
C:\Windows\System32\Tasks\KMSAutoNet => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\KMSAutoNet" => key removed successfully
C:\ProgramData\KMSAutoS => moved successfully
"C:\Users\Ren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda" => not found.
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 20554095 B
Java, Flash, Steam htmlcache => 360593938 B
Windows/system/drivers => 42872358 B
Edge => 0 B
Chrome => 20995935 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 16802 B
systemprofile32 => 33186 B
LocalService => 0 B
NetworkService => 0 B
Ren => 30811298 B
 
RecycleBin => 3601945 B
EmptyTemp: => 457.3 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 00:21:32 ====
 
 
I don't think the problem persist anymore. It is just that System process doesn't have a high disk usage but still continues to use.
I have here a 66gb system volume information, this is what System process has been on when it has a high disk usage
 
Edit : Sad to say System process still has a high disk usage

Edited by renski2498, 05 July 2016 - 12:46 PM.


#4 nasdaq

nasdaq

  • Malware Response Team
  • 38,936 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:25 PM

Posted 06 July 2016 - 06:47 AM


high disk usage

Try the fix on this topic.


#5 renski2498

renski2498
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:25 AM

Posted 06 July 2016 - 06:58 AM

Problem still persist

Can I ask if "gkernel; \??\C:\Users\Ren\AppData\Local\Temp\gkernel.sys" is safe since it's from the temp folder



#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,936 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:25 PM

Posted 07 July 2016 - 07:34 AM


It look OK to me. Can you relate to HOA BINH INFORMATICS .,JSC
https://www.reasoncoresecurity.com/gkernel.sys-831df365cf8ce9d95ca7d29002ea1a840bcda1c0.aspx

===

Update all the drivers that are outdated.

How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector (PSI)
Follow the instructions on this page.


http://www.bleepingcomputer.com/tutorials/detect-vulnerable-programs-with-secunia-psi/

Keep me posted.

#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,936 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:25 PM

Posted 13 July 2016 - 12:06 PM

Are you still with me?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users