Search

Yes yes yes my PC clean now for 2 days from the infected key :)

But keep this topic alive for a some days for me please ?

OK,

I finally got to download and run it V5.112 and no BSOD, so thank you for looking into it and fixing it for me.

Here is the report:

# AdwCleaner v5.112 - Logfile created 19/04/2016 at 16:50:38
# Updated 17/04/2016 by Xplode
# Database : 2016-04-19.5 [Server]
# Operating system : Windows 10 Home  (X64)
# Username : Steve - STEVESPC
# Running from : C:\Users\Steve\Downloads\adwcleaner_...

I have done that and I have also run AdwCleaner to see if the acestream fle was definitely deleted. Everything seemds to be OK.

I was far from thinking that the Roxplayer application did use the Acestream technology. Maybe the Acestream software has no malware itself (although the Magicplayer Firefox plugin has got a malware) but the Roxplayer software does have a malware.

Anyway I will no lo...

Hello,

Great ! I reproduced the problem. It's due to Rox Player, which is really tendancious (showings random ads, not updated for a quite long time...).

I added the detections to AdwCleaner, and we'll remove it manually there.

Download the file fixlist.txt and save it as "fixlist.txt" to the Desktop or where FRST is located.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt...

I redacted the links to your logfiles in your precedent message since they contained some "sensitive"/"private" informations.

I analyze the logfile and come back to you with more informations.

OK, I started it, just so you know I got this message, going to run anyway and let you know the results, just wanted to post this in case of BSOD http://screencast.com/t/DZpUxbJv0EGY

OK BSOD again with the new version you provided, I uploaded the minidump https://up2sha.re/file?f=Bt0lHd36k7X6

Hello,

Thanks, the dump file was useful it was at least due to the PRSvc.exe process. Can you retry again ? (be sure the database has been updated..).

If you face another BSOD, can you redo the same thing as here ?

Thank you for your patience,

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

[-] File Deleted : C:\WINDOWS\SysWOW64\h@tkeysh@@k.dll

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}

***** [ Web browsers ] *****

*************...

The file which has been opened by Edge is the BlueScreenView report (you can see the path to the file in the adressbar on the top).

Can you copy this file to your Desktop : C:\WINDOWS\Minidump\041916-112203-01.dmp and create a zip archive from this file ?

Then, host it on https://up2sha.re, and paste here the generated link.

Best regards,

I don't think that is the correct file because the time isn't correct but I could be wrong so here it is:

2016-04-19 05:33:59 : [Notice]        Scan started 2016-04-19 05:33:59 : [Success]        Internet connection is UP 2016-04-19 05:34:01 : [Success]        Loaded C:\Users\Steve\AppData\Local\Temp\sqlite.dll 2016-04-19 05:34:01 : [Success]        Opened C:\AdwCleaner\adwcleaner.db 2016-04-1...