Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Something is eating my diskspace? [Closed]

Started by kingmax99 , May 27 2015 08:51 AM

  • This topic is locked This topic is locked

#1
kingmax99
Posted 27 May 2015 - 08:51 AM

kingmax99

    New Member

  • Member
  • Pip
  • 1 posts

Hello i think i have a virus that eats up my disk space on disk C and i only have like windows programs on disk C. but some programs and games i cant play cus i dont have enough disk space... and i cant use skype cus i dont have enough disk space... i dont know "computer language" very well ive tried to look up a few guides but i dont understand them.

Ive tried to delete some files i dont need but the space keeps get eaten up. I cant reinstall the pc either it says something weird and i belieave its because of the virus. please help me!!

Attached Files


  • 0

Advertisements

#2
Essexboy
Posted 28 May 2015 - 08:54 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi first could you uninstall the following programmes :

WinZipper
YAC(Yet Another Cleaner!)
cheapnenjoy
CleanMyPC version 1.6.0.0

NEXT

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.

1. If you have bookmarks, let's save them by exporting them - Export Bookmarks
2. Then I need you to go Google Sync and sign into your account
3. Scroll down until you see the "Stop and Clear" button and click on the button. At the prompt click on "Ok"
4. Now we need to uninstall chrome using control panel.
Note: When asked about user data or settings you must remove this also so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
6. Import your bookmarks back into Chrome
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.

FOLLOWED BY

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKU\S-1-5-21-575746788-697084064-849044779-1001\...\Run: [NextLive] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\Max\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-hom...0815AS_6RX3C40H
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-hom...0815AS_6RX3C40H
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis....q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis....q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-hom...0815AS_6RX3C40H
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-hom...0815AS_6RX3C40H
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis....q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis....q={searchTerms}
HKU\S-1-5-21-575746788-697084064-849044779-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-...q={searchTerms}
HKU\S-1-5-21-575746788-697084064-849044779-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-hom...0815AS_6RX3C40H
HKU\S-1-5-21-575746788-697084064-849044779-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-hom...0815AS_6RX3C40H
HKU\S-1-5-21-575746788-697084064-849044779-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-...q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.aartemis....q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.aartemis....q={searchTerms}
SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {15287178-3E82-4AE2-AC61-B9D2D89586E2} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://do-search.com...q={searchTerms}
SearchScopes: HKU\S-1-5-21-575746788-697084064-849044779-1001 -> {F82612A8-3B95-4DCA-BB38-A9BC18A3D1BC} URL = http://do-search.com...q={searchTerms}
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1428995620&from=ient04140&uid=ST380815AS_6RX3C40H
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml [2015-03-21]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\delta-homes.xml [2014-06-12]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\g6f6twa5.default\extensions\[email protected]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\g6f6twa5.default\extensions\[email protected]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\g6f6twa5.default\extensions\[email protected]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\g6f6twa5.default\extensions\[email protected]
CHR Extension: (DealsmarkeT) - C:\ProgramData\kebgjggpldecnedfdpbkciddegfbnnac\ []
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-03-03] (Elex do Brasil Participações Ltda)
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [426160 2015-05-04] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [249000 2015-03-03] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [45224 2015-03-03] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [99496 2015-03-03] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [42152 2015-03-03] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [93352 2015-03-03] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-02-15] (Elex do Brasil Participações Ltda)
R1 {5906ab0f-5417-45a6-a4f5-8bc38ae936d5}Gw64; C:\Windows\System32\drivers\{5906ab0f-5417-45a6-a4f5-8bc38ae936d5}Gw64.sys [61112 2014-06-18] (StdLib)
R2 CleanMyPCService; F:\CleanMyPC\CleanMyPCService.exe [90352 2014-08-11] (MacPaw Inc.)
2015-05-27 16:22 - 2015-05-27 16:22 - 00000000 ____D () C:\Users\Max\AppData\Roaming\CleanMyPC
2015-05-27 16:15 - 2015-05-27 16:15 - 00000563 _____ () C:\Users\Public\Desktop\CleanMyPC.lnk
2015-05-27 16:15 - 2015-05-27 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanMyPC
2015-05-27 16:14 - 2015-05-27 16:14 - 09812096 _____ (MacPaw, Inc. ) C:\Users\Max\Desktop\CleanMyPCSetup.exe
2015-05-27 15:59 - 2015-05-27 15:59 - 00000000 ____D () C:\Users\Guest.Speldator\AppData\Roaming\Elex-tech
2015-05-26 14:58 - 2015-05-26 14:58 - 00000000 ____D () C:\Users\Max\SupTab
2015-05-12 07:46 - 2015-05-12 07:46 - 00000000 ____D () C:\Users\TEMP\AppData\Roaming\Elex-tech
2015-05-27 16:29 - 2015-03-20 11:32 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-05-27 16:12 - 2014-01-16 16:41 - 00000000 ____D () C:\Users\Max\AppData\Roaming\newnext.me
C:\Program Files (x86)\Elex-tech
C:\Program Files (x86)\Mobogenie
C:\Users\Max\AppData\Roaming\newnext.me
C:\ProgramData\kebgjggpldecnedfdpbkciddegfbnnac
C:\Program Files (x86)\WinZipper
C:\Windows\System32\drivers\{5906ab0f-5417-45a6-a4f5-8bc38ae936d5}Gw64.sys
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers


Save this as fixlist.txt, in the same location as FRST.exe
FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that

FINALLY

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S0].txt as well.

  • 0

#3
Essexboy
Posted 31 May 2015 - 08:23 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP