Clock drifts while PC on, High GPU temp running .exe apps

Hello,

In short -

I experience time drifts(time changes) while my PC is on,
each time I run certain .exe , .avi and "GOOGLE Chrome"
my Gpu temp jumps from 30 to 50.

on the other hand using Firefox remains at 30temp. (which means there's a virus)

I cleaned my PC, i have 5 working fans, there is no problem with my PC.

additional links to SEE detailed and more background info about my problem u can find in here+read comments. :
https://www.malwareremoval.com/forum/vi ... 11&t=65079

Logs attached.

thanks for your time, good will to help.

Hello JohnSmith11,

Welcome to the forum!

I am pgmigg and I'll be helping you with any malware problems.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.

1. The instructions being given are for YOUR computer and system only!
   Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
2. You must have Administrator rights, permissions for this computer.
3. DO NOT run any other fix or removal tools unless instructed to do so!
4. DO NOT install any other software (or hardware) during the cleaning process until we are done as well as
   DO NOT Remove, or Scan with anything on your system unless I ask. This adds more items to be researched.
   Extra Additions and Removals of files make the analysis more difficult.
5. Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
6. Print each set of instructions if possible - your Internet connection will not be available during some fix processes.
7. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
8. Only reply to this thread, do not start another one. Please, continue responding, until I give you the "All Clean!"
   Absence of symptoms does not mean that everything is clear.

I am currently reviewing your logs and will return, as soon as possible, with additional instructions. In the meantime...

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.

Please read all instructions carefully before executing and perform the steps, in the order given.
lf you have any questions or problems executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start


Failure to post replies within 72 hours will result in this thread being closed

Hello JohnSmith11,

Step 1.
WARNING!
Multiple Anti Virus programs detected

1. It looks like you are operating your computer with multiple Anti Virus programs installed at once:
   

   Microsoft Security Essentials
   AVG Antivirus
   

2. This is a recipe for disaster. More programs does not mean more security, in fact it means the very opposite. Running - more than one - antivirus program is not recommended because:
   
   1. They can conflict with each other.
   2. Report the other antivirus software as malicious.
   3. Antivirus programs use an enormous amount of computer's resources... actively scanning your computer.
   4. Can cause your computer to run slowly, become unstable and crash.
3. I strongly suggest you uninstall one of them. Which one is your decision, but if you asked me, I would recommend you to uninstall AVG Antivirus.
4. Please let me know which AV you decided to keep in the next reply and then I will give you recommendation how to remove it properly and completely.

Step 2.
Run CKScanner

1. Please download CKScanner from here
2. Important: - Save it to your Desktop.
3. Double-click CKScanner.exe and click Search For Files.
4. After a very short time, when the cursor hourglass disappears, click Save List To File.
5. A message box will verify the file saved.
6. Double-click the CKFiles.txt icon on your Desktop and copy/paste the contents in your next reply.

Step 3.
TSG - SysInfo utility

1. Please download SysInfo.exe and save it to your Desktop.
2. Right click SysInfo.exe and select "Run As Administrator" to run it... if UAC prompts, please allow it.
3. The small square window will be opened with already highlighted text - please right click on it, select Copy and then paste it in your next post.

Then:
Please tell me is this computer used for business or educational purposes and connected to a business or educational networks?
I need to know it - so I can provide the proper instructions.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...
Don't post anything as attachments unless I will ask you about it specifically!

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Your decision about Anti Virus which you would like to keep
3. Contents of CKFiles.txt log file
4. Contents of TSG - SysInfo utility
5. Answers to my question related to type of using of your computer

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

reading ur msg, will update my actions (posted 2 not get thread locked)

Do you have any problems executing the instructions?
1) No problem.
will follow as you say.
Your decision about Anti Virus which you would like to keep
2)If you suggest to stick to win Essentials I will do as you say, please tell me why AV is not as good as win essentials to improve my knowledge.
Waiting for your further guidance on how to completely remove AVG. besides before AVG I had avira, I click uninstall from Control panel to remove it.
Contents of CKFiles.txt log file
Contents of TSG - SysInfo utility
Answers to my question related to type of using of your computer
its my personal private PC, it was connected to a home-group but I think I left it (my father has created that home-group, and I have removed his permission from the drive menu's and left few minutes later.

Techsupport -
Tech Support Guy System Info Utility version 1.0.0.4
OS Version: Microsoft Windows 7 Professional, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz, Intel64 Family 6 Model 60 Stepping 3
Processor Count: 8
RAM: 8134 Mb
Graphics Card: NVIDIA GeForce GTX 770, -2048 Mb
Hard Drives: C: 119 GB (63 GB Free); E: 0 GB (0 GB Free); F: 931 GB (118 GB Free);
Motherboard: ASUSTeK COMPUTER INC., Z97-A
Antivirus: Microsoft Security Essentials, Enabled and Updated



CKs log file -

CKScanner 2.5 - Additional Security Risks - These are not necessarily bad
scanner sequence 3.MN.11.QWAPNZ
----- EOF -----

Thanks pgmigg, Teacher at MalWare Removal University
For welcoming me, sorry for the many replies I do not know how to Edit my own post on this forum, perhaps you could teach me that ^^

I've noticed something VERY STRANGE, I had GPU-Z installed
and checked again and these pictures shows of
high GPU ram usage while idleare very suspicious, I hope it may help us find a solution asap,
I uploaded 2 pictures one of the GPU before I start the "infected" program and one after

Hello JhonSmith11,

Step 1.
How To Uninstall AVG AntiVirus?

1. Uninstall AVG via Windows Control Panel
   
   1. Click on Start, then click the Start Search box on the Start Menu.
   2. Copy and paste the value below without into the open text entry box:
      (Click the Select all button next to Code: to select the entire script).
      

       appwiz.cpl 

      and press Enter - the Unistall or change a program list will be opened.
   3. Click each Entry, as follows, one by one, if it exists, choose Uninstall, and give permission to Continue:
      AVG
      
   4. Click on the Change/Remove button to uninstall it.
   5. When the program have been uninstalled, please close Control Panel
   6. Reboot (restart) your computer.
2. If the uninstallation fails, please use the AVG Remover tool
   
   1. Please save any work and close all open windows... you have to REBOOT your machine during in this step.
   2. Please download AVG Remover and save it to your Desktop.
   3. Double click on AVG_Remover.exe to start the process. A black command window will open... and you will receive a "removal and rebooting" warning prompt...
   4. Reply Yes to the "Do you want to continue?" prompt. The remover will begin searching for and removing AVG entries...
   5. When completed, a text file will appear on your desktop "avgremover.log"... (it may be named differently for the 64bit version)
   6. Please reboot your computer at this time. (You may receive a prompt to do so...)
   7. Please copy and paste the contents of avgremover.log in your next reply.

Step 2.
Create a Backup With Tweaking.com Registry Backup (TCRB)
There is also a tutorial with pictures available HERE.

1. Please download TCRB from HERE and save it to your Desktop.
2. Double-click on tweaking.com_registry_backup_setup.exe and follow the prompts to install TCRB.
3. Launch TCRB.
4. Click the Backup Registry tab and make sure all the boxes are checked.
5. Click on Backup Now.
6. Once the backup is finished you can now exit the program.

< STOP > Do not proceed any further if you were not able to create a registry backup. Post back with what happened so we can determine why it was unsuccessful.

Step 3.
FRST Fix

1. Close all your programs.
2. You should still have FRST64.exe on your Desktop. If not please download it HERE and save it on your Desktop.
3. Click Start and type notepad.exe in the search programs and files box and click Enter - a blank Notepad page should open.
   
   • Copy and Paste the following script into Notepad, but do not include the words Code: Select all.
   • (Click the Select all button next to Code: to select the entire script).
   
   

   
   
   CreateRestorePoint:
   
   
   
   HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
   
   HKLM\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-09-14] (AVG Technologies CZ, s.r.o.)
   
   HKLM\...\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [289248 2017-09-20] (AVG Technologies CZ, s.r.o.)
   
   CHR DefaultSearchKeyword: Default -> Avira
   
   CHR DefaultSuggestURL: Default -> hxxps://search.avira.com/suggestions?q={searchTerms}&li=ff&hl=en
   
   
   
   EmptyTemp:
   
   CMD: ipconfig /flushdns

4. Save it next to FRST64.exe as fixlist.txt.
   Important! fixlist.txt must be saved in the same directory as FRST64.exe to work.
5. Right click on FRST64.exe and select Run as administrator.
6. Press the Fix button one time only and wait.
7. When FRST finishes you will be prompted to reboot your computer. Click OK.
8. Your computer should now restart. On reboot navigate to your Desktop where you should find Fixlog.txt. Copy and paste the contents in your reply.

Step 4.
AdwCleaner - Scan Only

1. Please download AdwCleaner (today it is version 7.0.2.1) and save it to your Desktop.
2. Close all open programs and windows so that you are at your Desktop.
3. Right click on adwcleaner.exee and click Run as administrator...
4. Click on I agree button.
5. Click on the ---> Scan button.
6. When the scan finishes, the new Notepad window with the log will be opened. Do not attempt to clean anything at this point!
7. Please copy and paste the contents of AdwCleaner[Sn].txt log file in your reply.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections....

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of avgremover.log if you run AVG_Remover.
3. Contents of the fixlog.txt log file
4. Contents of the ESET.txt log file
5. Do you see any changes in computer behavior?

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

Do you have any problems executing the instructions?
No
Contents of avgremover.log if you run AVG_Remover.
I uninstalled directly from control panel as you asked, logs will be presented in the next post.
Contents of the fixlog.txt log file
will be presented in the next post after avg.
Contents of the ESET.txt log file
if this is adw, it will be presented.
Do you see any changes in computer behavior?
firefox didn't remember i was a member of this forum,
when i open skype the temp still jumps high to constant 48c while skype is on.

besides,

i have found a fix to my windows clock while searching the net.
this Fix is not 100% good. it only works AFTER the windows update the clock, still means something is preventing the clock to fix itself like a normal PC would do.
the fix :
adjust time, internet tab.
change the internet from windows.com to
pool.ntp.org

it seems to work very well, the clock is not 100% as my real life clock it only updates when the program tells it to do so the problem is like 10% still there.
when i open my pc , the clock isnt updated and until the windows server updates there is no update to it. i still suspect its not fixed.

Fix result of Farbar Recovery Scan Tool (x64) Version: 01-10-2017
Ran by [removed] (02-10-2017 12:28:31) Run:1
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-09-14] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [289248 2017-09-20] (AVG Technologies CZ, s.r.o.)
CHR DefaultSearchKeyword: Default -> Avira
CHR DefaultSuggestURL: Default -> hxxps://search.avira.com/suggestions?q={searchTerms}&li=ff&hl=en

EmptyTemp:
CMD: ipconfig /flushdns
*****************

Restore point was successfully created.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AvgUi => value not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AVGUI.exe => value not found.
Chrome DefaultSearchKeyword => removed successfully
Chrome DefaultSuggestURL => removed successfully

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 92491052 B
Java, Flash, Steam htmlcache => 361311632 B
Windows/system/drivers => 26363279 B
Edge => 0 B
Chrome => 305338683 B
Firefox => 385290284 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 66228 B
Public => 0 B
ProgramData => 0 B
systemprofile => 66356 B
systemprofile32 => 66356 B
LocalService => 66228 B
NetworkService => 157872 B
iTzHDz => 504210193 B

RecycleBin => 0 B
EmptyTemp: => 1.6 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 12:28:54 ====

# AdwCleaner 7.0.3.1 - Logfile created on Mon Oct 02 09:35:36 2017
# Updated on 2017/29/09 by Malwarebytes
# Database: 09-29-2017.1
# Running on Windows 7 Professional (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************



########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

for some reason windows defender is off and it wont open

the windows defender from services.msc, was changed to manual.
after i changed it to automatic, it kept changing the start and stop nonestop.
i probably have a virus in the svchost.exe how can i know which one is the virus and which one is real?
windows defender is off now and it wont be turned on.

ok, srry for multi messaging, but this is essential posts.
after checking the problem again - i can only get win defender to work when PC starts, but when the infected programs are launched they automaticlly shuts him down, the scans were showing i dont have any virus because the virus is smart and knows how to hide.
please guide me what to do next, i hope this picture will help you understand better .

picture of currnet problem..