Log Question ánd UI Question

[garack]

This is a driver attempt to load?`

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GPUZ (\??\C:\Windows\TEMP\GPUZ.sys) -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GPUZ (\??\C:\Windows\TEMP\GPUZ.sys) -> Found


There is nothing unter Temp, no GPUZ.sys not hidden. I dont ever installed GPU-Z; I do with cpu Z and msi afterburner...

Second Question: You have a new coloured UI; greens means good? orange is unclear?


Last one:

This:

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found

and some other HideDEsktops Entries come up every time. i deleted this specific CLSID (MyComputer) but it does nothing. Still no symbol on my desktop..So what are these HideDEsktop entries do?

[redwolfe_98]

This is a driver attempt to load?`

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GPUZ (\??\C:\Windows\TEMP\GPUZ.sys) -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GPUZ (\??\C:\Windows\TEMP\GPUZ.sys) -> Found

they are regkeys that were generated when "gpuz.sys" was loaded.. since you say that the "gpuz.sys" file is no longer in your "temp" folder, the regkeys are useless and can be removed..

i don't know how it was that "gpuz.sys" was "loaded" on your computer but i don't think that it is anything to worry about.. i am assuming that the "gpuz.sys" file was legitimate and so it is nothing to worry about..

You have a new coloured UI; greens means good? orange is unclear?

yes.. green means OK.. orange means possible issue..usually nothing to worry about..red means bad.. you can look over the orange items to see what they show..

Last one..this:

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found

and some other HideDEsktops Entries come up every time

here is what the roguekiller documentation says about that:

"PUM.DesktopIcons [Possible desktop icons hijack. Those lines when only PUMs are detected should be ignored, because they probably result of a user configuration]
Example: [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND

http://www.adlice.com/softwares/roguekiller/documentation/
-----------------------------------------------

in other words, if you are not experiencing any other problems with your computer, you probably can just ignore any PUM's that were flagged..

the "PUM's" supposedly are modified settings but i think "roguekiller" flags some things that shouldn't be flagged, like the item that you are asking about..

when something is flagged by an antimalware program, the best thing is to check things out and try to determine if the item that was flagged actually is a problem, or not, before allowing the antimalware program to remove it.. if you aren't sure, then i would leave it alone, meaning that i would not let "roguekiller" remove something unless i knew it was something that actually should be removed..

maybe you can restore the regkey that was removed, if you want to.. it shouldn't be too hard to do, if you are a little familiar with working with the registry.. just navigate to the regkey:

"(X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel"

..and, in the right-pane, create a "dword"-"regkey" with the name {20D04FE0-3AEA-1069-A2D8-08002B30309D}, and with a "value" of "1"..

that should work..

when you do a scan with "roguekiller", just look over the PUM's that are flagged to see if they look like they are OK, or not.. if you think they are OK, then don't let roguekiller remove them.. if you think they are bad, then let roguekiller remove them..

[Tigzy]

Thanks redwolfe

In a more general way, when RogueKiller shows something unchecked by default, this is 90% not malware. But in the last 10% it's either something unwanted or useless, or in a very few cases a malware. If you don't know what to do with unchecked items, let them unchecked when performing a removal.

[garack]

Thanks for helping with this!