Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

Assistance in finding/removing malware

  • Please log in to reply



    Malware Expert

  • Expert
  • 20,445 posts
  • MVP

I was concerned about this line in your FRST scan:

HKLM\...\Run: [UMonit64] => C:\Windows\SysWOW64\UMonit64.exe******************************************************************************************************************************* [40960 2013-03-14] ()



so I put in a line in the fixlist to look at the registry entry and it shows:



    RTHDVCPL    REG_SZ    "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
    RtHDVBg    REG_SZ    "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /MAXX4
    ETDCtrl    REG_EXPAND_SZ    %ProgramFiles%\Elantech\ETDCtrl.exe
    UMonit64    REG_SZ    C:\Windows\SysWOW64\UMonit64.exe
    NvBackend    REG_SZ    "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
    WindowsDefender    REG_EXPAND_SZ    "%ProgramFiles%\Windows Defender\MSASCuiL.exe"


Note that the ETDCtrl & UMonit64 entries are missing the quotes.  There may also be some unprintable characters after the path of the UMonit64 and that is why we get the line of stars.  Another possibility is that it has something to do with the fact that both entries are unchecked in msconfig as we can see from the addition.txt:



==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\StartupFolder: => "Bluetooth.lnk"
HKLM\...\StartupApproved\Run: => "ETDCtrl"
HKLM\...\StartupApproved\Run: => "UMonit64"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "ASUSWebStorage"
HKLM\...\StartupApproved\Run32: => "ROGNB"
HKLM\...\StartupApproved\Run32: => "CLMLServer"
HKU\S-1-5-21-1890713058-2806932541-3226652281-1002\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-1890713058-2806932541-3226652281-1002\...\StartupApproved\Run: => "Power2GoExpress"
HKU\S-1-5-21-1890713058-2806932541-3226652281-1002\...\StartupApproved\Run: => "Akamai NetSession Interface"
HKU\S-1-5-21-1890713058-2806932541-3226652281-1002\...\StartupApproved\Run: => "BitTorrent"
HKU\S-1-5-21-1890713058-2806932541-3226652281-1002\...\StartupApproved\Run: => "Gyazo"


I asked you in a previous post to go back into msconfig and recheck everything but you apparently missed that step.  Please do so now (reboot)  then post a new FRST scan so I can be sure before I try to fix it.


Also Speccy claims your PC is running hot.  Speccy is sometimes wrong so let's get another opinion:


Get  Speedfan to monitor your temps in real time:


Download, save and Install it (Win 7+ or Vista right click and Run As Admin.) then run it (Win 7+ or Vista right click and Run As Admin.).

It will tell you your temps in real time tho the default is to show the hard drive temp in the systray.  You can change it:  Hit Configure then click on the highest temp and check Show in tray.  With no other programs running what is the highest temp you see?  Run an anti-virus scan, play one of your games or watch a video for at least 5 minutes.  What is the highest temp now?

We don't really want it to go over about 65 under load.  If it does it usually means either the fan is defective (speedfan should tell you your fan speed so you can see if it is running) or (most likely) the interface between the fan and the heatsink is clogged with dust. The best fix for a clogged heatsink is to remove the fan (not the heatsink or heatpipe) and vacuum out the heatsink.  However on some PCs this is major surgery.  Sometimes you can blow air backwards through the exhaust vent while vacuuming at the input vent and if you are lucky it may clear the heatsink.  Don't do it too long as the fan may overrev.

  • 0


Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP