Jump to content

Stuff that won't delete after scan


Recommended Posts

Do the following:

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

() C:\Program Files\WNEn\129637286ab1f486423795d47012b51e.exe
() C:\Program Files\WNEn\f5082a0192ab5a8cee5954e823a153e9.exe
() C:\Program Files\WNEn\129637286ab1f486423795d47012b51e.exe
HKLM-x32\...\Run: [UPS Assistant] => [X]
HKLM-x32\...\RunOnce: [GrpConv] => grpconv -o
HKLM\...\Policies\Explorer: [NoRecentDocsNetHood] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig]  <===== ATTENTION
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Run: [UPS Assistant] => [X]
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoPreviewPane] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoWinkeys] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [HideSCANetwork] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\...\Policies\Explorer: [HideSCAVolume] 0
HKU\S-1-5-21-3474383695-1841813542-1221837453-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
R2 WNEn Monitor; C:\Program Files\WNEn\129637286ab1f486423795d47012b51e.exe [2339328 2015-11-16] () [File not signed]
2015-11-27 16:24 - 2015-11-27 16:24 - 00000000 _____ C:\WINDOWS\SysWOW64\REN5F5C.tmp
2015-11-27 16:21 - 2015-11-27 16:21 - 00000000 _____ C:\WINDOWS\SysWOW64\REN95AD.tmp
2015-11-18 09:12 - 2015-11-18 09:12 - 00000000 ____D C:\Users\Marvin\AppData\Local\35787886
2015-11-18 09:12 - 2015-11-18 09:12 - 00000000 ____D C:\Users\Marvin\AppData\Local\30852275
2015-11-18 09:09 - 2015-11-18 14:48 - 00000000 ____D C:\Program Files (x86)\00412F4E-1447859364-0000-0000-0000FFFFFFFF
2015-11-18 09:02 - 2015-12-04 09:02 - 00002468 _____ C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user.job
2015-11-18 09:02 - 2015-12-04 09:02 - 00002132 _____ C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.job
2015-11-18 09:02 - 2015-11-18 09:02 - 00005654 _____ C:\WINDOWS\System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user
2015-11-18 09:02 - 2015-11-18 09:02 - 00005248 _____ C:\WINDOWS\System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5
2015-11-18 09:01 - 2015-11-18 09:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WNEn
2015-11-18 09:00 - 2015-11-18 09:01 - 00000000 ____D C:\Program Files\WNEn
2015-11-18 08:59 - 2015-11-18 08:59 - 00004320 _____ C:\WINDOWS\System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Pending Update
2015-11-18 08:59 - 2015-11-18 08:59 - 00004290 _____ C:\WINDOWS\System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Core
C:\ProgramData\fontcacheev1.dat
C:\Windows\Tasks\{6AEE5E74-B7FB-4443-B5EA-7C5A474FD4B7}.job
C:\Users\Marvin\AppData\Local\Temp\any.exe
C:\Users\Marvin\AppData\Local\Temp\AudioConverter.exe
C:\Users\Marvin\AppData\Local\Temp\FreemakeAudioConverterFull.exe
C:\Users\Marvin\AppData\Local\Temp\FreemakeMusicBoxFull.exe
C:\Users\Marvin\AppData\Local\Temp\FreemakeVideoDownloaderFull.exe
C:\Users\Marvin\AppData\Local\Temp\LMkRstPt.exe
C:\Users\Marvin\AppData\Local\Temp\MusicBox.exe
C:\Users\Marvin\AppData\Local\Temp\oksoft12.exe
C:\Users\Marvin\AppData\Local\Temp\setup.exe
C:\Users\Marvin\AppData\Local\Temp\speed.exe
C:\Users\Marvin\AppData\Local\Temp\unins000.exe
C:\Users\Marvin\AppData\Local\Temp\unins001.exe
C:\Users\Marvin\AppData\Local\Temp\VideoDownloader.exe
C:\Users\Marvin\AppData\Local\Temp\waj.exe
C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
C:\Users\Marvin\AppData\Roaming\VOPackage
C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\aspackage
C:\Users\Marvin\AppData\Roaming\aspackage
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPACKAGE" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ASPACKAGE" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\APPDATALOW\SOFTWARE\CROSSRIDER" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\ARENAHD" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\HIGHDEFACTION" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\YORKNEWCIN" /f
Reg: reg delete "HKEY_USERS\S-1-5-21-3474383695-1841813542-1221837453-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN" /v "FREE DOWNLOAD MANAGER" /f
Task: {36F6664D-C7CB-4CB3-82B5-98919A1BC72B} - System32\Tasks\FSSUpdaterService => C:\Users\Marvin\AppData\Roaming\UpdaterService\FSSUpdaterService.exe [2015-08-25] () <==== ATTENTION
Task: {6456B067-8749-467D-AEF9-03A0CB6B180D} - System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Pending Update => C:\Program Files (x86)\SwiftSearch_1.10.0.25\Update\SwiftSearchAutoUpdateClient.exe <==== ATTENTION
Task: {990CDA0A-6660-4F26-AD19-9A7F9A73489B} - System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION
Task: {AF112094-998B-49B5-81D0-16B36AF6C4E9} - System32\Tasks\SwiftSearch Auto Updater 1.10.0.25 Core => C:\Program Files (x86)\SwiftSearch_1.10.0.25\Update\SwiftSearchAutoUpdateClient.exe <==== ATTENTION
Task: {DB8A500B-F65E-4E1A-9EC6-359AA5080568} - System32\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5 => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.job => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5_user.job => C:\Program Files (x86)\CinemaPlus_1.3dV13.11\e6616742-9fe5-48df-8dcf-0c7021a3d9c4-5.exe <==== ATTENTION
2015-11-16 10:53 - 2015-11-16 10:53 - 01882624 _____ () c:\program files\wnen\f5082a0192ab5a8cee5954e823a153e9.exe
2015-11-16 10:55 - 2015-11-16 10:55 - 02339328 _____ () c:\program files\wnen\129637286ab1f486423795d47012b51e.exe
2015-12-03 19:47 - 2015-12-03 19:47 - 11972608 _____ () c:\program files\wnen\WNEnlibs\vyfukv.dll
c:\program files\wnen
c:\program files\wnen\WNEnlibs
AlternateDataStreams: C:\ArtMoney:Win32App_1
AlternateDataStreams: C:\Boot:Win32App_1
AlternateDataStreams: C:\Program Files\A Ruler for Windows:Win32App_1
AlternateDataStreams: C:\Program Files\AMD:Win32App_1
AlternateDataStreams: C:\Program Files\Andy:Win32App_1
AlternateDataStreams: C:\Program Files\ATI Technologies:Win32App_1
AlternateDataStreams: C:\Program Files\Bonjour:Win32App_1
AlternateDataStreams: C:\Program Files\Bug head:Win32App_1
AlternateDataStreams: C:\Program Files\CCleaner:Win32App_1
AlternateDataStreams: C:\Program Files\Circuit Diagram:Win32App_1
AlternateDataStreams: C:\Program Files\Cyberfox:Win32App_1
AlternateDataStreams: C:\Program Files\Epic Games:Win32App_1
AlternateDataStreams: C:\Program Files\Fort - Crypto Extension for Windows:Win32App_1
AlternateDataStreams: C:\Program Files\fxCalc:Win32App_1
AlternateDataStreams: C:\Program Files\GIMP 2:Win32App_1
AlternateDataStreams: C:\Program Files\LibreOffice 5:Win32App_1
AlternateDataStreams: C:\Program Files\Microsoft Mouse and Keyboard Center:Win32App_1
AlternateDataStreams: C:\Program Files\My Family Tree:Win32App_1
AlternateDataStreams: C:\Program Files\OpenMPT:Win32App_1
AlternateDataStreams: C:\Program Files\Psycle Modular Music Studio:Win32App_1
AlternateDataStreams: C:\Program Files\Send To Toys:Win32App_1
AlternateDataStreams: C:\Program Files\Sigil:Win32App_1
AlternateDataStreams: C:\Program Files\Stellarium:Win32App_1
AlternateDataStreams: C:\Program Files\WinRAR:Win32App_1
AlternateDataStreams: C:\Program Files\WNEn:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\7-Zip:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Adguard:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Agat:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\AMD:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\AnyToISO:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\AOMEI Backupper:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\AOMEI OneKey Recovery 1.2:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\AOMEI Partition Assistant Standard Edition 5.8:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Artweaver Free 5:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\AtHome Camera:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\ATI Technologies:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Attribute Changer:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Audacity:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\BlueJ:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Bonjour:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\BS FAG:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Bubble Bobble Legacy BETA:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Calibre2:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\ConstEdit:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\ConvertAll:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\CoolSoft NSISDialogDesigner:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Coupons:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\CreateInstall Free:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\D-Fend Reloaded:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\DeepSound 2.0:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Doomsday:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\DoroPDFWriter:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\DPLS Scientific Calculator 2.4:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\DVDStyler:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\e-Sword:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\EMDB:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Emsisoft Anti-Malware:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\FontForgeBuilds:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Free Download Manager:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Freemake:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Frogger Reloaded:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\GeoGebra 5.0:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\GoOllie:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Greenfoot:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Icecream Ebook Reader:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Icecream Image Resizer:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Icecream Media Converter:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Icecream PDF Converter:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Icecream PDF Split and Merge:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Icecream Slideshow Maker:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Icons from File:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\ImBatch:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Inkscape:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Instagiffer:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\K-Lite Codec Pack:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Kalender:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\KaraFun Player 2:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Labography:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\LibreCAD:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Lyrik:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Mono:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\MSBuild:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\NSIS:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\ordrumbox:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\PDF24:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Pixia ver. 6:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\PrintMaster 6.0 Platinum:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\PySol Fan Club edition:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\RedNotebook:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\rpCalc:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\ScreenshotCaptor:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Sicyon calculator:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Sicyon Unit Converter:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Spybot Anti-Beacon:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\SSuiteInvoice:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\TeamViewer:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\TheSage:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Unchecky:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\WOLFCODERS ScreenSnag:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\XnView:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Zaz:Win32App_1
AlternateDataStreams: C:\WINDOWS\SysWOW64\Adobe:Win32App_1
AlternateDataStreams: C:\WINDOWS\SysWOW64\VirtualMIDISynth:Win32App_1
AlternateDataStreams: C:\ProgramData\eSellerate:Win32App_1
AlternateDataStreams: C:\ProgramData\Monodoc:Win32App_1
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm
AlternateDataStreams: C:\ProgramData\VMware:Win32App_1
Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system to restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...