Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cant boot in safemode, can't restore


  • This topic is locked This topic is locked
37 replies to this topic

#1 Richard Morris

Richard Morris

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 11 January 2013 - 05:21 AM

Hi All,

I've a 64 bit windows 7 machine which is causing a lot of problems. On a normal boot it trys to install update 3 of 10777 and hangs. On a safemode boot it runs for about a minute and hangs on a blue screen, looking at ntbtlog.txt it loads the first 30 drivers then starts failing

Service Pack 1 1 10 2013 13:33:04.500
Loaded driver \SystemRoot\system32\ntoskrnl.exe
Loaded driver \SystemRoot\system32\hal.dll
...
Loaded driver \SystemRoot\System32\DRIVERS\fvevol.sys
Loaded driver \SystemRoot\system32\DRIVERS\disk.sys
Loaded driver \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
Loaded driver \SystemRoot\system32\DRIVERS\AtiPcie.sys
Did not load driver @nettun.inf,%6to4mp.displayname%;Microsoft 6to4 Adapter
Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter
Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter
Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter
Did not load driver @nettun.inf,%teredo.displayname%;Microsoft Teredo Tunneling Adapter

it repeatedly trys loading the drivers
Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter is tried 156 times.

I can't do a system restore as its saying "you must enable system protection on this drive" for the C: drive.

Any ideas?

Richard

BC AdBot (Login to Remove)

 


#2 Richard Morris

Richard Morris
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 15 January 2013 - 10:49 AM

I've now run farbar and there seem to be some virus type problems, ZeroAccess is mentioned .exe associations and there seem to be some suspect drive letters x: y:. Should I move this to the virus forum?

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-01-2013
Ran by SYSTEM at 15-01-2013 15:28:50
Running from C:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [CLVirtualDrive] "C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" /R [485672 2011-10-31] (CyberLink Corp.)
HKLM\...\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [602168 2010-06-29] (Hewlett-Packard Company)
HKLM\...\Run: [] [x]
HKLM\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1391272 2012-01-03] (Ask)
HKLM\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE [1823672 2012-05-20] (Bandoo Media, inc)
HKLM\...\Run: [Babylon Client] C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe -AutoStart [3189360 2012-01-23] (Babylon Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKU\Default\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Default User\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\florence\...\Run: [Google Update] "C:\Users\florence\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-11-17] (Google Inc.)
HKU\florence\...\Run: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual [620376 2011-12-29] (IObit)
HKU\florence\...\Run: [Facebook Update] "C:\Users\florence\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-11] (Facebook Inc.)
HKU\florence\...\Run: [Media Finder] "C:\Program Files (x86)\Media Finder\Media Finder.exe" /opentotray [8630272 2012-05-25] (Media Finder)
HKU\florence\...\Run: [RegDefRun] C:\Program Files (x86)\Auslogics\AusLogics Registry Defrag\reginfo.exe /r [113152 2008-03-08] (Auslogics)
HKU\florence\...\Policies\system: [DisableLockWorkstation] 0
HKU\florence\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Winlogon: [Userinit] [x]
HKLM-x32\...\Winlogon: [Shell] [x ] ()
HKLM\...\InprocServer32: [Default-wbemess] ATTENTION! ====> ZeroAccess
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll

==================== Services (Whitelisted) ===================

2 AdvancedSystemCareService5; C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [497496 2011-12-29] (IObit)
2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [27192 2010-06-29] ()
2 McciCMService64; "C:\Program Files\Common Files\Motive\McciCMService.exe" [517632 2011-03-23] (Alcatel-Lucent)
2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [22072 2012-09-12] (Microsoft Corporation)
3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [368896 2012-09-12] (Microsoft Corporation)
2 RapportMgmtService; "C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe" [931640 2012-05-03] (Trusteer Ltd.)
2 WajamUpdater; "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [109064 2012-04-24] (Wajam)

==================== Drivers (Whitelisted) =====================

3 AX88772B; C:\Windows\System32\Drivers\AX88772B.sys [98816 2010-05-21] (ASIX Electronics Corp.)
1 CLVirtualDrive; C:\Windows\System32\Drivers\CLVirtualDrive.sys [90096 2011-09-08] (CyberLink)
0 MpFilter; C:\Windows\System32\Drivers\MpFilter.sys [228768 2012-08-30] (Microsoft Corporation)
2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [128456 2012-08-30] (Microsoft Corporation)
1 RapportCerberus_43926; \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\43926\RapportCerberus64_43926.sys [505720 2012-11-02] ()
1 RapportEI64; \??\C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [55056 2012-05-03] (Trusteer Ltd.)
0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [63760 2012-05-03] (Trusteer Ltd.)
3 hwdatacard; C:\Windows\System32\DRIVERS\ewusbmdm.sys [x]
3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [x]
3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [x]

==================== NetSvcs (Whitelisted) ====================


==================== One Month Created Files and Folders ========

2013-01-15 15:22 - 2013-01-15 15:22 - 00000000 ____D C:\FRST
2013-01-15 15:21 - 2013-01-15 15:04 - 01464233 ____A (Farbar) C:\FRST64.exe
2013-01-15 15:15 - 2012-05-30 12:39 - 00874278 ____A C:\FRST.exe

==================== One Month Modified Files and Folders =======

2013-01-15 15:22 - 2013-01-15 15:22 - 00000000 ____D C:\FRST
2013-01-15 15:12 - 2012-06-14 20:54 - 00000000 ____D C:\Users\All Users\Recovery
2013-01-15 15:04 - 2013-01-15 15:21 - 01464233 ____A (Farbar) C:\FRST64.exe
2013-01-10 01:58 - 2009-07-13 20:45 - 00037760 ____A C:\Windows\System32\FNTCACHE.DAT
2013-01-09 08:58 - 2012-04-02 00:10 - 00016294 ____A C:\Windows\PFRO.log

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon: <===== ATTENTION!
HKLM\...\exefile\open\command: <===== ATTENTION!

==================== Restore Points =========================

Restore point made on: 2012-07-20 10:39:33
Restore point made on: 2012-07-23 01:02:51
Restore point made on: 2012-07-23 11:22:44
Restore point made on: 2012-07-31 00:41:44
Restore point made on: 2012-08-30 07:07:41
Restore point made on: 2012-09-01 09:56:30
Restore point made on: 2012-09-01 13:32:11
Restore point made on: 2012-09-02 00:19:03
Restore point made on: 2012-10-15 04:47:22
Restore point made on: 2012-10-28 10:28:42
Restore point made on: 2012-10-28 10:34:52
Restore point made on: 2012-11-02 04:21:37
Restore point made on: 2012-11-05 08:35:14
Restore point made on: 2012-11-09 09:24:01
Restore point made on: 2012-11-13 12:31:24
Restore point made on: 2012-11-21 06:07:16
Restore point made on: 2012-12-09 06:12:15

==================== Memory info ===========================

Percentage of memory in use: 24%
Total physical RAM: 1786.9 MB
Available physical RAM: 1344.23 MB
Total Pagefile: 1786.9 MB
Available Pagefile: 1339.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:217.2 GB) (Free:158.51 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive e: (RECOVERY) (Fixed) (Total:15.39 GB) (Free:1.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
4 Drive g: (GRMCHPXFRER_EN_DVD) (CDROM) (Total:3 GB) (Free:0 GB) UDF
5 Drive h: () (Removable) (Total:1.92 GB) (Free:0.07 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 232 GB 0 B
Disk 1 Online 1968 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 199 MB 1024 KB
Partition 2 Primary 217 GB 200 MB
Partition 3 Primary 15 GB 217 GB
Partition 4 Primary 103 MB 232 GB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM NTFS Partition 199 MB Healthy

=========================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 217 GB Healthy

=========================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E RECOVERY NTFS Partition 15 GB Healthy

=========================================================

Disk: 0
Partition 4
Type : 0C
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F HP_TOOLS FAT32 Partition 103 MB Healthy

=========================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1967 MB 31 KB

==================================================================================

Disk: 1
Partition 1
Type : 0C
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H FAT32 Removable 1967 MB Healthy

=========================================================

Last Boot: 2012-05-07 09:41

==================== End Of Log =============================

Edited by Orange Blossom, 15 January 2013 - 11:38 AM.
Moved to log forum. ~ OB


#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,732 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:55 AM

Posted 16 January 2013 - 05:25 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/481363 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:10:55 AM

Posted 17 January 2013 - 01:03 PM

Hi Richard,

We sincerely apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

My name is Jason and I'll be helping you with your computer problems. You can call me by my screename jntkwx or Jason is fine.

Some things to remember while we are working together:

  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. :)
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me about it.
  • When you post your reply, do not use the Posted Image button but use the Posted Image button instead.
  • In the upper right hand corner of the topic you will see the Posted Image button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
  • Now let's get started :thumbup2:


Note to others: The instructions here are intended for the person who began this topic. If you need help, please create your own topic in the appropriate forum.

 

Rerun FRST
Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt

HKLM-x32\...\Winlogon: [Userinit] [x]
HKLM-x32\...\Winlogon: [Shell] [x ] ()
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll
C:\PROGRA~2\SEARCH~1\Datamngr\
HKLM\...\.exe
HKLM\...\exefile\DefaultIcon
HKLM\...\exefile\open\command

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Download a new version of Farbar Recovery Scan Tool 64-bit and save it to a flash drive (replace the old version).

Boot back into System Recovery Options, as you've done previously.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Try starting your computer normally. If it does not boot normally, please describe in detail what error messages you see, etc.
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#5 Richard Morris

Richard Morris
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 18 January 2013 - 06:35 AM

Replying to the helperbot

1. Computer will not boot in safe mode or normal mode.
I've tried Startup repair - runs but does not fix problem
System Restore - Can't run message saying You must enable System Protection on this drive.
System Image Recovery - can't find an image, ( there appears to be recovery partition on the hard disk)
only AV program which I've been to run is farbar. Log above.
2. Tried running DDS but does not work in the recovery environment. "The subsytems needed to support the image type is not present"
I have a 64 bit windows 7 system : Windows 7 Home Premium (X64)

3. I have a windows 7 CD available, but not the one which came with the computer.

#6 Richard Morris

Richard Morris
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 19 January 2013 - 06:51 AM

Jason,

Sorry missed your reply earlier. I've run FRST with the fixlist

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-01-2013
Ran by SYSTEM at 2013-01-19 11:29:34 Run:1
Running from H:\

==============================================

HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit Value was restored successfully .
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value was restored successfully .
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs Value was restored successfully .
C:\PROGRA~2\SEARCH~1\Datamngr\ moved successfully.

==== End of Fixlog ====

The system still is not booting. For safemode it loads a few drivers, does something for 30 secs with no visible display then crashes with a blue screen, but its too quick to see.

For normal mode is still crashing during an update operation, with a blue screen:

A process or thread critical to system operation has unexpectedly exited or been terminated.
.....
STOP 0x000000F4 (0x0000000003, 0xFFFFFA8003A98730,0xFFFFFA8003a98a10,0xfffff80002f8a460)

Thanks Richard

#7 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:10:55 AM

Posted 19 January 2013 - 09:08 AM

Richard,

Okay, let's get another FRST log and see if that fix worked as expected.

Rerun FRST
  • Please download a new version of Farbar Recovery Scan Tool and save it to a flash drive (overwrite the old version).

    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

    Plug the flash drive into the infected PC.

    Boot into System Recovery Options, as you've done previously:

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.
    To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html


    To enter System Recovery Options by using Windows installation disc:
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.
  • On the System Recovery Options menu you will get the following options:
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt


    Select Command Prompt

    Once in the Command Prompt:
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
[/list]
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#8 Richard Morris

Richard Morris
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 19 January 2013 - 02:16 PM

Jason,

Heres the scan results. I downloaded a new version of FRST to do this.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-01-2013
Ran by SYSTEM at 19-01-2013 17:54:43
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [CLVirtualDrive] "C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" /R [485672 2011-10-31] (CyberLink Corp.)
HKLM\...\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [602168 2010-06-29] (Hewlett-Packard Company)
HKLM\...\Run: [] [x]
HKLM\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1391272 2012-01-03] (Ask)
HKLM\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE [x]
HKLM\...\Run: [Babylon Client] C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe -AutoStart [3189360 2012-01-23] (Babylon Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKU\Default\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Default User\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\florence\...\Run: [Google Update] "C:\Users\florence\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-11-17] (Google Inc.)
HKU\florence\...\Run: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual [620376 2011-12-29] (IObit)
HKU\florence\...\Run: [Facebook Update] "C:\Users\florence\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-11] (Facebook Inc.)
HKU\florence\...\Run: [Media Finder] "C:\Program Files (x86)\Media Finder\Media Finder.exe" /opentotray [8630272 2012-05-25] (Media Finder)
HKU\florence\...\Run: [RegDefRun] C:\Program Files (x86)\Auslogics\AusLogics Registry Defrag\reginfo.exe /r [113152 2008-03-08] (Auslogics)
HKU\florence\...\Policies\system: [DisableLockWorkstation] 0
HKU\florence\...\Policies\system: [DisableChangePassword] 0
HKLM\...\InprocServer32: [Default-wbemess] ATTENTION! ====> ZeroAccess
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

==================== Services (Whitelisted) ===================

2 AdvancedSystemCareService5; C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [497496 2011-12-29] (IObit)
2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [27192 2010-06-29] ()
2 McciCMService64; "C:\Program Files\Common Files\Motive\McciCMService.exe" [517632 2011-03-23] (Alcatel-Lucent)
2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [22072 2012-09-12] (Microsoft Corporation)
3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [368896 2012-09-12] (Microsoft Corporation)
2 RapportMgmtService; "C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe" [931640 2012-05-03] (Trusteer Ltd.)
2 WajamUpdater; "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [109064 2012-04-24] (Wajam)

==================== Drivers (Whitelisted) =====================

3 AX88772B; C:\Windows\System32\Drivers\AX88772B.sys [98816 2010-05-21] (ASIX Electronics Corp.)
1 CLVirtualDrive; C:\Windows\System32\Drivers\CLVirtualDrive.sys [90096 2011-09-08] (CyberLink)
0 MpFilter; C:\Windows\System32\Drivers\MpFilter.sys [228768 2012-08-30] (Microsoft Corporation)
2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [128456 2012-08-30] (Microsoft Corporation)
1 RapportCerberus_43926; \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\43926\RapportCerberus64_43926.sys [505720 2012-11-02] ()
1 RapportEI64; \??\C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [55056 2012-05-03] (Trusteer Ltd.)
3 hwdatacard; C:\Windows\System32\DRIVERS\ewusbmdm.sys [x]
3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [x]
3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [x]
0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [x]

==================== NetSvcs (Whitelisted) ====================


==================== One Month Created Files and Folders ========

2013-01-17 11:56 - 2013-01-17 11:46 - 00207394 ____A C:\PK250DOS.EXE
2013-01-17 11:43 - 2013-01-17 11:55 - 00000000 ___AD C:\EmsisoftEmergencyKit
2013-01-17 11:43 - 2013-01-17 11:43 - 00000000 ___AD C:\$WIN_NT$.~LS
2013-01-15 16:43 - 2013-01-15 16:43 - 00000816 ____A C:\reg1.reg
2013-01-15 15:29 - 2013-01-15 15:29 - 00011212 ____A C:\FRST.txt
2013-01-15 15:22 - 2013-01-15 15:22 - 00000000 ____D C:\FRST
2013-01-15 15:21 - 2013-01-15 15:04 - 01464233 ____A (Farbar) C:\FRST64.exe
2013-01-15 15:15 - 2012-05-30 12:39 - 00874278 ____A C:\FRST.exe

==================== One Month Modified Files and Folders =======

2013-01-19 17:47 - 2012-06-14 20:54 - 00000000 ____D C:\Users\All Users\Recovery
2013-01-19 11:29 - 2012-05-26 08:05 - 00000000 ____D C:\Program Files (x86)\Searchqu Toolbar
2013-01-17 11:55 - 2013-01-17 11:43 - 00000000 ___AD C:\EmsisoftEmergencyKit
2013-01-17 11:46 - 2013-01-17 11:56 - 00207394 ____A C:\PK250DOS.EXE
2013-01-17 11:43 - 2013-01-17 11:43 - 00000000 ___AD C:\$WIN_NT$.~LS
2013-01-15 16:43 - 2013-01-15 16:43 - 00000816 ____A C:\reg1.reg
2013-01-15 15:29 - 2013-01-15 15:29 - 00011212 ____A C:\FRST.txt
2013-01-15 15:22 - 2013-01-15 15:22 - 00000000 ____D C:\FRST
2013-01-15 15:04 - 2013-01-15 15:21 - 01464233 ____A (Farbar) C:\FRST64.exe
2013-01-10 01:58 - 2009-07-13 20:45 - 00037760 ____A C:\Windows\System32\FNTCACHE.DAT
2013-01-09 08:58 - 2012-04-02 00:10 - 00016294 ____A C:\Windows\PFRO.log

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon: <===== ATTENTION!
HKLM\...\exefile\open\command: <===== ATTENTION!

==================== Restore Points =========================

Restore point made on: 2012-07-20 10:39:33
Restore point made on: 2012-07-23 01:02:51
Restore point made on: 2012-07-23 11:22:44
Restore point made on: 2012-07-31 00:41:44
Restore point made on: 2012-08-30 07:07:41
Restore point made on: 2012-09-01 09:56:30
Restore point made on: 2012-09-01 13:32:11
Restore point made on: 2012-09-02 00:19:03
Restore point made on: 2012-10-15 04:47:22
Restore point made on: 2012-10-28 10:28:42
Restore point made on: 2012-10-28 10:34:52
Restore point made on: 2012-11-02 04:21:37
Restore point made on: 2012-11-05 08:35:14
Restore point made on: 2012-11-09 09:24:01
Restore point made on: 2012-11-13 12:31:24
Restore point made on: 2012-11-21 06:07:16
Restore point made on: 2012-12-09 06:12:15

==================== Memory info ===========================

Percentage of memory in use: 24%
Total physical RAM: 1786.9 MB
Available physical RAM: 1348.28 MB
Total Pagefile: 1786.9 MB
Available Pagefile: 1332.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:217.2 GB) (Free:158.51 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive e: (RECOVERY) (Fixed) (Total:15.39 GB) (Free:1.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
4 Drive g: (GRMCHPXFRER_EN_DVD) (CDROM) (Total:3 GB) (Free:0 GB) UDF
5 Drive h: () (Removable) (Total:1.92 GB) (Free:0.49 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 232 GB 0 B
Disk 1 Online 1968 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 199 MB 1024 KB
Partition 2 Primary 217 GB 200 MB
Partition 3 Primary 15 GB 217 GB
Partition 4 Primary 103 MB 232 GB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM NTFS Partition 199 MB Healthy

=========================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 217 GB Healthy

=========================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E RECOVERY NTFS Partition 15 GB Healthy

=========================================================

Disk: 0
Partition 4
Type : 0C
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F HP_TOOLS FAT32 Partition 103 MB Healthy

=========================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1967 MB 31 KB

==================================================================================

Disk: 1
Partition 1
Type : 0C
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H FAT32 Removable 1967 MB Healthy

=========================================================

Last Boot: 2012-05-07 09:41

==================== End Of Log =============================

#9 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:10:55 AM

Posted 19 January 2013 - 03:19 PM

Okay, follow these instructions exactly. If you run into problems or have any questions, please ask before continuing.

Please do the following. You will need a USB drive with no less than 64 mb of space.

  • Insert your USB drive.
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format (Note that this will erase any files you have on your flashdrive. Please move any files you want to keep to your computer before completing this step.)
  • Download xPUD 0.9.2 iso, saving the file to your Desktop.
  • Download UNetbootin and save it to your Desktop as well.
  • Double click the unetbootin-windows-latest.exe that you just downloaded.
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded
  • Verify the correct drive letter is selected for your USB device then click OK
  • It will write files to your USB device and make it bootable
  • Once the files have been written to the device you will be prompted to reboot ~ do NOT reboot and instead just Exit the UNetbootin interface
  • Next, download dumpit and save it to the same flash drive where you installed xPUD. (Right click on this link and click on Save Target As... to save the file.)
  • Remove the USB and insert it in the ailing computer
  • Power on the computer and press F12 then choose to boot from the USB
  • After selecting a language and readying the system, a Welcome to xPUD screen will appear
  • Click the File tab
  • Expand mnt by clicking the plus sign to it's left
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Double click dumpit.
  • It will create some MBR copies on the USB drive.
  • When it completes press Enter to exit the Terminal window.
  • Remove the USB drive, then locate on it an mbr.zip file, and upload that here as an attachment please.
mbr.zip should be created on your flash drive, please attach it to your next reply.
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#10 Richard Morris

Richard Morris
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 20 January 2013 - 01:05 PM

Jason

Heres the boot record

Attached File  mbr.zip   2.34KB   1 downloads

Rich

#11 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:10:55 AM

Posted 20 January 2013 - 04:34 PM

Richard,

That file shows everything is fine with the MBRs. Do you remember what date you started noticing problems with this computer?

We Need to Diagnose Your BlueScreen
  • When you boot your machine, press F8 to list the startup options, exactly as you would if you were trying to enter Safe Mode
  • Select "Disable Automatic Restart on System Failure", as shown here:
    Posted Image
  • Startup your computer in normal mode, and when it Blue Screens, write down the STOP error code, as well as any written out error message back here. The STOP error will always appear, but the message may not. You are looking for this:
    Posted Image
Please post me the error(s).
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#12 Richard Morris

Richard Morris
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 21 January 2013 - 06:51 AM

Jason,

The blue screen message:

A process or thread critical to system operation has unexpectedly exited or been terminated.
.....
STOP 0x000000F4 (0x0000000003, 0xFFFFFA8003B2C920,0xFFFFFA8003B2CC00,0xfffff80002FD8460)


Slightly different hex digits in the part in brackets to previously.

Richard

#13 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:10:55 AM

Posted 21 January 2013 - 05:32 PM

Richard,

I think there's either a critical Windows file that's corrupt or missing, and that's causing these blue screens.

On your clean computer, download driver.sh by noahdfear to your USB drive (right click this link, and select Save File As)

Rerun xPUD
  • Boot the infected computer back into xPUD, and plug your USB drive in
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your hard drive
  • sdb1 is likely your USB drive
  • Click on the folder that represents your USB drive
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Plug the USB back into the clean computer post the contents of the report.txt,in your next reply.

Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#14 Richard Morris

Richard Morris
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:55 PM

Posted 22 January 2013 - 07:36 AM

Jason,

Content of report.txt


Richard


Tue Jan 22 10:27:52 UTC 2013
Driver report for /mnt/sda2/Windows/System32/drivers

64edd3f59db321947969fdf1dd747323 1394bus.sys
Microsoft Corporation

a87d604aea360176311474c87a63bb88 1394ohci.sys
Microsoft Corporation

99f8e788246d495ce3794d7e7821d2ca acpipmi.sys
Microsoft Corporation

d81d9e70b8a6dd14d42d7b4efa65d5f2 acpi.sys
Microsoft Corporation

2f6b34b83843f0c5118b63ac634f5bf4 adp94xx.sys
Adaptec

597f78224ee9224ea1a13d6350ced962 adpahci.sys
Adaptec

e109549c90f62fb570b9540c4b148e54 adpu320.sys
Adaptec

1c7857b62de5994a75b054a9fd4c3825 afd.sys
Microsoft Corporation

7ecff9b22276b73f43a99a15a6094e90 agilevpn.sys
Microsoft Corporation

608c14dba7299d8cb6ed035a68a15799 AGP440.sys
Microsoft Corporation

5812713a477a3ad7363c7438ca2ee038 aliide.sys
Acer Laboratories

1ff8b4431c353ce385c875f194924c0c amdide.sys
Microsoft Corporation

7024f087cff1833a806193ef9d22cda9 amdk8.sys
Microsoft Corporation

1e56388b3fe0d031c44144eb8c4d6217 amdppm.sys
Microsoft Corporation

53d8d46d51d390abdb54eca623165cb7 amdsata.sys
Advanced Micro Devices

f67f933e79241ed32ff46a4f29b5120b amdsbs.sys
AMD Technologies

75c51148154e34eb3d7bb84749a758d5 amdxata.sys
Advanced Micro Devices

89a69c3f2f319b43379399547526d952 appid.sys
Microsoft Corporation

019af6924aefe7839f61c830227fe79c arcsas.sys
Adaptec

c484f8ceb1717c540242531db7845c4e arc.sys
Adaptec

769765ce2cc62867468cea93969b2242 asyncmac.sys
Microsoft Corporation

02062c0b390b7729edc9e69c680a6f3c atapi.sys
Microsoft Corporation

a34fe1e025e88798e746f484956c0720 ataport.sys
Microsoft Corporation

f8633cdd09647a64ee8db550630427ff athrx.sys
Atheros Communications

2c9c4824664c61351ff1e0169262d026 atikmdag.sys
ATI Technologies

ef7382689d3b17ac2983202e7a40ab45 atikmpag.sys
Advanced Micro Devices

c07a040d6b5a42dd41ee386cf90974c8 AtiPcie.sys
Advanced Micro Devices

4bffead896affbc80c86f62cd18f17c9 atipmdag.sys
ATI Technologies

f02e18efa6cea4378d3f95cb6f9a3de4 ax88772b.sys
ASIX Electronics

b5ace6968304a3900eeb1ebfd9622df2 b57nd60a.sys
Broadcom Corporation

f4de2ae7a9e1badac70bc71ea2c17612 battc.sys
Microsoft Corporation

16a47ce2decc9b099349a5f840654746 beep.sys
Microsoft Corporation

61583ee3c3a17003c4acd0475646b4d3 blbdrive.sys
Microsoft Corporation

6c02a83164f5cc0a262f4199f0871cf5 bowser.sys
Microsoft Corporation

f09eee9edc320b5e1501f749fde686c8 BrFiltLo.sys
Brother Industries

b114d3098e9bdb8bea8b053685831be6 BrFiltUp.sys
Brother Industries

5c2f352a4e961d72518261257aae204b bridge.sys
Microsoft Corporation

43bea8d483bf1870f018e2d02e06a5bd BrSerId.sys
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries

a6eca2151b08a09caceca35c07f05b42 BrSerWdm.sys
Brother Industries

b79968002c277e869cf38bd22cd61524 BrUsbMdm.sys
Brother Industries

a87528880231c54e75ea7a44943b38bf BrUsbSer.sys
Brother Industries

9da669f11d1f894ab4eb69bf546a42e8 bthmodem.sys
Microsoft Corporation

3e5b191307609f7514148c6832bb0842 bxvbda.sys
Broadcom Corporation

b8bd2bb284668c84865658c77574381a cdfs.sys
Microsoft Corporation

f036ce71586e93d94dab220d7bdf4416 cdrom.sys
Microsoft Corporation

d7cd5c4e1b71fa62050515314cfb52cf circlass.sys
Microsoft Corporation

acfad0b512226c7a83c7cb09fd55a9ad Classpnp.sys
Microsoft Corporation

1cce5f4dd276b4b877650437bc5cb31b CLVirtualDrive.sys
HXVS_VERSION_INFO?aStringFileInfobnCompanyNameCyberLinkaFileDescriptionItisavirtualdevicedriverwhichcouldcreatemultiplevirtualdevicesandmountimagefiles.vFileVersion...FInternalNameCLVirtualDrive.sys^LegalCopyrightCopyright©CyberLinkFOriginalFilenameCLVirtualDrive`ProductNameCyberLinkVirtualDeviceDriver:vProductVersion...DVarFileInfo$TranslationPADDINGX

0840155d0bddf1190f84a663c284bd33 CmBatt.sys
Microsoft Corporation

e19d3f095812725d88f9001985b94edd cmdide.sys
CMD Technology

9ac4f97c2d3e93367e2148ea940cd2cd cng.sys
Microsoft Corporation

102de219c3f61415f964c88e9085ad14 compbatt.sys
Microsoft Corporation

03edb043586cceba243d689bdda370a8 CompositeBus.sys
Microsoft Corporation

3e588b60ec061686ba05d33574a344c6 crashdmp.sys
Microsoft Corporation

1c827878a998c18847245fe1f34ee597 crcdisk.sys
Microsoft Corporation

9bb2ef44eaa163b29c4a4587887a0fe4 dfsc.sys
Microsoft Corporation

13096b05847ec78f0977f2c0f79e9ab3 discache.sys
Microsoft Corporation

9bbd8b5855bc6578957f82341f9cde5a Diskdump.sys
Microsoft Corporation

9819eee8b5ea3784ec4af3b137a5244c disk.sys
Microsoft Corporation

9b19f34400d24df84c858a421c205754 drmkaud.sys
Microsoft Corporation

21d26064aedb4988f785bb4a3a2c051e drmk.sys
Microsoft Corporation

839b5fe3d48e9f35b22c21a3d5103f6c Dumpata.sys
Microsoft Corporation

814db88f2641691575a455cf25354098 dumpfve.sys
Microsoft Corporation

bf24d6f2ed97fe830bfd52b246f98e67 dxapi.sys
Microsoft Corporation

f5bee30450e18e6b83a5012c100616fd dxgkrnl.sys
Microsoft Corporation

9cd68bddf322535c02adc8331013d13d dxgmms1.sys
Microsoft Corporation

fede0629ecb23650d48989517d4914da dxg.sys
Microsoft Corporation

0e5da5369a0fcaea12456dd852545184 elxstor.sys
Emulex

34a3c54752046e79a126e15c51db409b errdev.sys
Microsoft Corporation

dc5d737f51be844d8c82c695eb17372f evbda.sys
Broadcom Corporation

a510c654ec00c1e9bdd91eeb3a59823b exfat.sys
Microsoft Corporation

0adc83218b66a6db380c330836f3e36d fastfat.sys
Microsoft Corporation

d765d19cd8ef61f650c384f62fac00ab fdc.sys
Microsoft Corporation

655661be46b5f5f3fd454e2c3095b930 fileinfo.sys
Microsoft Corporation

5f671ab5bc87eea04ec38a6cd5962a47 filetrace.sys
Microsoft Corporation

c172a0f53008eaeb8ea33fe10e177af5 flpydisk.sys
Microsoft Corporation

da6b67270fd9db3697b20fce94950741 fltMgr.sys
Microsoft Corporation

d43703496149971890703b4b1b723eac fsdepends.sys
Microsoft Corporation

6bd9295cc032dd3077c671fccf579a7b fs_rec.sys
Microsoft Corporation

1f7b25b858fa27015169fe95e54108ed fvevol.sys
Microsoft Corporation

910dd6694848872fd3b8f42baf801d0a FWPKCLNT.SYS
Microsoft Corporation

8c778d335c9d272cfd3298ab02abe3b6 GAGP30KX.SYS
Microsoft Corporation

f2523ef6460fc42405b12248338ab2f0 hcw85cir.sys
Hauppauge Computer Works

97bfed39b6b79eb12cddbfeed51f56bb hdaudbus.sys
Microsoft Corporation

975761c778e33cd22498059b91e7373a HdAudio.sys
Microsoft Corporation

78e86380454a7b10a5eb255dc44a355f hidbatt.sys
Microsoft Corporation

7fd2a313f7afe5c4dab14798c48dd104 hidbth.sys
Microsoft Corporation

8b0e40e7e8bbf5acf390465609d89ff1 hidclass.sys
Microsoft Corporation

0a77d29f311b88cfae3b13f9c1a73825 hidir.sys
Microsoft Corporation

49ee2e52e6cd03947dad72f65367be06 hidparse.sys
Microsoft Corporation

9592090a7e2b61cd582b612b6df70536 hidusb.sys
Microsoft Corporation

39d2abcd392f3d8a6dce7b60ae7b8efc HpSAMD.sys
Hewlett-Packard

0ea7de1acb728dd5a369fd742d6eee28 http.sys
Microsoft Corporation

a5462bd6884960c9dc85ed49d34ff392 hwpolicy.sys
Microsoft Corporation

fa55c73d4affa7ee23ac4be53b4592d3 i8042prt.sys
Microsoft Corporation

aaaf44db3bd0b9d1fb6969b23ecc8366 iaStorV.sys
Intel Corporation

a87261ef1546325b559374f5689cf5bc igdkmd64.sys
Intel Corporation

5c18831c61933628f5bb0ea2675b9d21 iirsp.sys
Intel Corp

f00f20e70c6ec3aa366910083a0518aa intelide.sys
Microsoft Corporation

ada036632c664caa754079041cf1f8c1 intelppm.sys
Microsoft Corporation

c9f0e1bd74365a8771590e9008d22ab6 ipfltdrv.sys
Microsoft Corporation

0fc1aea580957aa8817b8f305d18ca3a IPMIDrv.sys
Microsoft Corporation

af9b39a7e7b6caa203b3862582e9f2d0 ipnat.sys
Microsoft Corporation

05360b1ea5a2abf620d1d96ebd8bd8f1 irda.sys
Microsoft Corporation

3abf5e7213eb28966d55d58b515d5ce9 irenum.sys
Microsoft Corporation

2f7b28dc3e1183e5eb418df55c204f38 isapnp.sys
Microsoft Corporation

bc02336f1cba7dcc7d1213bb588a68a5 kbdclass.sys
Microsoft Corporation

0705eff5b42a9db58548eec3b26bb484 kbdhid.sys
Microsoft Corporation

97a7070aea4c058b6418519e869a63b4 ksecdd.sys
Microsoft Corporation

26c43a7c2862447ec59deda188d1da07 ksecpkg.sys
Microsoft Corporation

24fbf5cc5c04150073c315a7c83521ee ks.sys
Microsoft Corporation

6869281e78cb31a43e969f06b57347c4 ksthunk.sys
Microsoft Corporation

1538831cf8ad2979a04c423779465827 lltdio.sys
Microsoft Corporation

1a93e54eb0ece102495a51266dcdb6a6 lsi_fc.sys
LSI Corporation

30f5c0de1ee8b5bc9306c1f0e4a75f93 lsi_sas2.sys
LSI Corporation

1047184a9fdc8bdbff857175875ee810 lsi_sas.sys
LSI Corporation

0504eacaff0d3c8aed161c4b0d369d4a lsi_scsi.sys
LSI Corporation

43d0f98e1d56ccddb0d5254cff7b356e luafv.sys
Microsoft Corporation

3c9f072f9dca856b9fb7a20cbd4281ac mcd.sys
Microsoft Corporation

a55805f747c6edb6a9080d7c633bd0f4 megasas.sys
LSI Corporation

baf74ce0072480c3b6b7c13b2a94d6b3 MegaSR.sys
LSI Corporation

800ba92f7010378b09f9ed9270f07137 modem.sys
Microsoft Corporation

b03d591dc7da45ece20b3b467e6aadaa monitor.sys
Microsoft Corporation

7d27ea49f3c1f687d357e77a470aea99 mouclass.sys
Microsoft Corporation

d3bf052c40b0c4166d9fd86a4288c1e6 mouhid.sys
Microsoft Corporation

32e7a3d591d671a6df2db515a5cbe0fa mountmgr.sys
Microsoft Corporation

05bf204ec0e82cc4a054db189c8a3d84 MpFilter.sys
Microsoft Corporation

a44b420d30bd56e145d6a2bc8768ec58 mpio.sys
Microsoft Corporation

6c38c9e45ae0ea2fa5e551f2ed5e978f mpsdrv.sys
Microsoft Corporation

dc722758b8261e1abafd31a3c0a66380 mrxdav.sys
Microsoft Corporation

d711b3c1d5f42c0c2415687be09fc163 mrxsmb10.sys
Microsoft Corporation

9423e9d355c8d303e76b8cfbd8a5c30c mrxsmb20.sys
Microsoft Corporation

a5d9106a73dc88564c825d317cac68ac mrxsmb.sys
Microsoft Corporation

c25f0bafa182cbca2dd3c851c2e75796 msahci.sys
Microsoft Corporation

db801a638d011b9633829eb6f663c900 msdsm.sys
Microsoft Corporation

aa3fb40e17ce1388fa1bedab50ea8f96 msfs.sys
Microsoft Corporation

f9d215a46a8b9753f61767fa72a20326 mshidkmdf.sys
Microsoft Corporation

d916874bbd4f8b07bfb7fa9b3ccae29d msisadrv.sys
Microsoft Corporation

d931d7309deb2317035b07c9f9e6b0bd msiscsi.sys
Microsoft Corporation

49ccf2c4fea34ffad8b1b59d49439366 mskssrv.sys
Microsoft Corporation

bdd71ace35a232104ddd349ee70e1ab3 mspclock.sys
Microsoft Corporation

4ed981241db27c3383d72092b618a1d0 mspqm.sys
Microsoft Corporation

759a9eeb0fa9ed79da1fb7d4ef78866d msrpc.sys
Microsoft Corporation

0eed230e37515a0eaee3c2e1bc97b288 mssmbios.sys
Microsoft Corporation

2e66f9ecb30b4221a318c92ac2250779 mstee.sys
Microsoft Corporation

7ea404308934e675bffde8edf0757bcd MTConfig.sys
Microsoft Corporation

f9a18612fd3526fe473c1bda678d61c8 mup.sys
Microsoft Corporation

9f9a1f53aad7da4d6fef5bb73ab811ac ndiscap.sys
Microsoft Corporation

760e38053bf56e501d562b70ad796b88 ndis.sys
Microsoft Corporation

30639c932d9fef22b31268fe25a1b6e5 ndistapi.sys
Microsoft Corporation

136185f9fb2cc61e573e676aa5402356 ndisuio.sys
Microsoft Corporation

53f7305169863f0a2bddc49e116c2e11 ndiswan.sys
Microsoft Corporation

015c0d8e0e0421b4cfd48cffe2825879 ndproxy.sys
Microsoft Corporation

86743d9f5d2b1048062b14b1d84501c4 netbios.sys
Microsoft Corporation

09594d1089c523423b32a4229263f068 netbt.sys
Microsoft Corporation

7942b7ac3ff598f8a1736d51adaf04e8 netio.sys
Microsoft Corporation

64428dfdaf6e88366cb51f45a79c5f69 netw5v64.sys
Intel Corporation

77889813be4d166cdab78ddba990da92 nfrd960.sys
IBM Corp

5ff89f20317309d28ac1edeb0cd1ba72 NisDrvWFP.sys
Microsoft Corporation

1e4c4ab5c9b8dd13179bbdc75a2a01f7 npfs.sys
Microsoft Corporation

e7f5ae18af4168178a642a9247c63001 nsiproxy.sys
Microsoft Corporation

e453acf4e7d44e5530b5d5f2b9ca8563 ntfs.sys
Microsoft Corporation

9899284589f75fa8724ff3d16aed75c1 null.sys
Microsoft Corporation

270d7cd42d6e3979f6dd0146650f0e05 NV_AGP.SYS
Microsoft Corporation

0a92cb65770442ed0dc44834632f66ad nvraid.sys
NVIDIA Corporation

dab0e87525c10052bf65f06152f37e4a nvstor.sys
NVIDIA Corporation

1ea3749c4114db3e3161156ffffa6b33 nwifi.sys
Microsoft Corporation

3589478e4b22ce21b41fa1bfc0b8b8a0 ohci1394.sys
Microsoft Corporation

0557cf5a2556bd58e26384169d72438d pacer.sys
Microsoft Corporation

0086431c29c35be1dbc43f52cc273887 parport.sys
Microsoft Corporation

e9766131eeade40a27dc27d2d68fba9c partmgr.sys
Microsoft Corporation

b5b8b5ef2e5cb34df8dcf8831e3534fa pciide.sys
Microsoft Corporation

144497daa145ba0f7be896064146c058 pciidex.sys
Microsoft Corporation

94575c0571d1462a0f70bde6bd6ee6b3 pci.sys
Microsoft Corporation

b2e81d4e87ce48589f98cb8c05b01f2f pcmcia.sys
Microsoft Corporation

d6b9c2e1a11a3a4b26a182ffef18f603 pcw.sys
Microsoft Corporation

68769c3356b3be5d1c732c97b9a80d6e PEAuth.sys
Microsoft Corporation

32e11315b5126921ffd9074840ef13d3 portcls.sys
Microsoft Corporation

0d922e23c041efb1c3fac2a6f943c9bf processr.sys
Microsoft Corporation

a53a15a11ebfd21077463ee2c7afeef0 ql2300.sys
QLogic Corporation

4f6d12b51de1aaeff7dc58c4d75423c8 ql40xx.sys
QLogic Corporation

76707bb36430888d9ce9d705398adb6c qwavedrv.sys
Microsoft Corporation

5a0da8ad5762fa2d91678a8a01311704 rasacd.sys
Microsoft Corporation

471815800ae33e6f1c32fb1b97c490ca rasl2tp.sys
Microsoft Corporation

855c9b1cd4756c5e9a2aa58a15f58c25 raspppoe.sys
Microsoft Corporation

f92a2c41117a11a00be01ca01a7fcde9 raspptp.sys
Microsoft Corporation

e8b1e447b008d07ff47d016c2b0eeecb rassstp.sys
Microsoft Corporation

77f665941019a1594d887a74f301fa2f rdbss.sys
Microsoft Corporation

302da2a0539f2cf54d7c6cc30c1f2d8d rdpbus.sys
Microsoft Corporation

cea6cc257fc9b7715f1c2b4849286d24 RDPCDD.sys
Microsoft Corporation

bb5971a4f00659529a5c44831af22365 RDPENCDD.sys
Microsoft Corporation

216f3fa57533d98e1f74ded70113177a RDPREFMP.sys
Microsoft Corporation

e61608aa35e98999af9aaeeea6114b0a rdpwd.sys
Microsoft Corporation

34ed295fa0121c241bfef24764fc4520 rdyboost.sys
Microsoft Corporation

caf88d6573d21cd2aa27001ddbfdc74d rmcast.sys
Microsoft Corporation

0e01641d96889bdeb22de12d30575b08 RNDISMP.sys
Microsoft Corporation

388d3dd1a6457280f3badba9f3acd6b1 rootmdm.sys
Microsoft Corporation

ddc86e4f8e7456261e637e3552e804ff rspndr.sys
Microsoft Corporation

4fbda07ef0a3097ce14c5cabf723b278 Rt64win7.sys
?bStringFileInfoBCompanyNameRealtek*

b88e24bd77a0ce2cffee2facf1151be0 RTKVHD64.sys
Realtek Semiconductor

ac03af3329579fffb455aa2daabbe22b sbp2port.sys
Microsoft Corporation

253f38d0d7074c02ff8deb9836c97d2b scfilter.sys
Microsoft Corporation

1b1e264203d4ef9d3da1987ad70355ab scsiport.sys
Microsoft Corporation

111e0ebc0ad79cb0fa014b907b231cf0 sdbus.sys
Microsoft Corporation

3ea8a16169c26afbeb544e0e48421186 secdrv.sys
Macrovision Corporation

cb624c0035412af0debec78c41f5ca1b serenum.sys
Microsoft Corporation

c1d8e28b2c2adfaec4ba89e9fda69bd6 serial.sys
Microsoft Corporation

1c545a7d0691cc4a027396535691c3e3 sermouse.sys
Microsoft Corporation

a554811bcd09279536440c964ae35bbf sffdisk.sys
Microsoft Corporation

ff414f0baefeba59bc6c04b3db0b87bf sffp_mmc.sys
Microsoft Corporation

dd85b78243a19b59f0637dcf284da63c sffp_sd.sys
Microsoft Corporation

a9d601643a1647211a1ee2ec4e433ff4 sfloppy.sys
Microsoft Corporation

843caf1e5fde1ffd5ff768f23a51e2e1 sisraid2.sys
Silicon Integrated Systems

6a6c106d42e9ffff8b9fcb4f754f6da4 sisraid4.sys
Silicon Integrated Systems

548260a7b8654e024dc30bf8a7c5baa4 smb.sys
Microsoft Corporation

a80348ba03e96c70852959655ca3e084 smclib.sys
Microsoft Corporation

b9e31e5cacdfe584f34f730a677803f9 spldr.sys
Microsoft Corporation

fff95479c7ab1550f0750a5d01744211 spsys.sys
Microsoft Corporation

b4adebbf5e3677cce9651e0f01f7cc28 srv2.sys
Microsoft Corporation

27e461f0be5bff5fc737328f749538c3 srvnet.sys
Microsoft Corporation

441fba48bff01fdb9d5969ebc1838f0b srv.sys
Microsoft Corporation

f3817967ed533d08327dc73bc4d5542a stexstor.sys
Promise Technology

19cb37ac38b802be9c441d094521a29a storport.sys
Microsoft Corporation

001cc10fa5e71ae1119115e126c8750d stream.sys
Microsoft Corporation

d01ec09b6711a5f8e7e6564a4d0fbc90 swenum.sys
Microsoft Corporation

ac3cc98b1bdb6540021d3ffb105ac2b9 SynTP.sys
Synaptics

6e316c01cba8b785fe495f5cc4f48c6f tape.sys
Microsoft Corporation

1b16d0bd9841794a6e0cde0cef744abc tcpipreg.sys
Microsoft Corporation

37608401dfdb388caf66917f6b2d6fb0 tcpip.sys
Microsoft Corporation

6f020a220388eca0ab6062dc27bd16b6 tdi.sys
Microsoft Corporation

3371d21011695b16333a3934340c4e7c tdpipe.sys
Microsoft Corporation

51c5eceb1cdee2468a1748be550cfbc8 tdtcp.sys
Microsoft Corporation

ddad5a7ab24d8b65f8d724f5c20fd806 tdx.sys
Microsoft Corporation

561e7e1f06895d78de991e01dd0fb6e5 termdd.sys
Microsoft Corporation

ce18b2cdfc837c99e5fae9ca6cba5d30 tssecsrv.sys
Microsoft Corporation

d11c783e3ef9a3c52c0ebe83cc5000e9 TsUsbFlt.sys
Microsoft Corporation

3566a8daafa27af944f5d705eaa64894 tunnel.sys
Microsoft Corporation

b4dd609bd7e282bfc683cec7eaaaad67 UAGP35.SYS
Microsoft Corporation

ff4232a1a64012baa1fd97c7b67df593 udfs.sys
Microsoft Corporation

4bfe1bc28391222894cbf1e7d0e42320 ULIAGPKX.SYS
Microsoft Corporation

dc54a574663a895c8763af0fa1ff7561 umbus.sys
Microsoft Corporation

b2e8e8cb557b156da5493bbddcc1474d umpass.sys
Microsoft Corporation

d0fe8cb5f84303e73ff0754437fad3d1 usb8023.sys
Microsoft Corporation

82e8f44688e6fac57b5b7c6fc7adbc2a USBAUDIO.sys
Microsoft Corporation

292a8e03b3fce04e39b5be9b14132030 USBCAMD2.sys
Microsoft Corporation

6f1a3157a1c89435352ceb543cdb359c usbccgp.sys
Microsoft Corporation

af0892a803fdda7492f595368e3b68e7 usbcir.sys
Microsoft Corporation

cca2ab1752a61f29c3c941cd79d78cea usbd.sys
Microsoft Corporation

c025055fe7b87701eb042095df1a2d7b usbehci.sys
Microsoft Corporation

2c780746dc44a28fe67004dc58173f05 usbfilter.sys
Advanced Micro Devices

287c6c9410b111b68b52ca298f7b8c24 usbhub.sys
Microsoft Corporation

9840fc418b4cbd632d3d0a667a725c31 usbohci.sys
Microsoft Corporation

ae259c75f9a0b057b6bf9e9695632b09 usbport.sys
Microsoft Corporation

73188f58fb384e75c4063d29413cee3d usbprint.sys
Microsoft Corporation

c3ec945dec43c00e2ad4c98dddd064c7 usbrpm.sys
Microsoft Corporation

fed648b01349a3c8395a5169db5fb7d6 USBSTOR.SYS
Microsoft Corporation

62069a34518bcf9c1fd9e74b3f6db7cd usbuhci.sys
Microsoft Corporation

454800c2bc7f3927ce030141ee4f4c50 usbvideo.sys
Microsoft Corporation

c5c876ccfc083ff3b128f933823e87bd vdrvroot.sys
Microsoft Corporation

da4da3f5e02943c2dc8c6ed875de68dd vgapnp.sys
Microsoft Corporation

53e92a310193cb3c03bea963de7d9cfc vga.sys
Microsoft Corporation

2ce2df28c83aeaf30084e1b1eb253cbb vhdmp.sys
Microsoft Corporation

e5689d93ffe4e5d66c0178761240dd54 viaide.sys
VIA Technologies

e7353d59c9842bc7299faeb7e7e09340 videoprt.sys
Microsoft Corporation

d2aafd421940f640b407aefaaebd91b0 volmgr.sys
Microsoft Corporation

a255814907c89be58b79ef2f189b843b volmgrx.sys
Microsoft Corporation

0d08d2f3b3ff84e433346669b5e0f639 volsnap.sys
Microsoft Corporation

5e2016ea6ebaca03c04feac5f330d997 vsmraid.sys
VIA Technologies

0c4540311e11664b245a263e1154cef8 VSTAZL6.SYS
Conexant

18e40c245dbfaf36fd0134a7ef2df396 VSTCNXT6.SYS
Conexant

02071d207a9858fbe3a48cbfd59c4a04 VSTDPV6.SYS
Conexant

36d4720b72b5c5d9cb2b9c29e9df67a1 vwifibus.sys
Microsoft Corporation

6a3d66263414ff0d6fa754c646612f3f vwififlt.sys
Microsoft Corporation

6a638fc4bfddc4d9b186c28c91bd1a01 vwifimp.sys
Microsoft Corporation

4e9440f4f152a7b944cb1663d3935a3e wacompen.sys
Microsoft Corporation

356afd78a6ed4457169241ac3965230c wanarp.sys
Microsoft Corporation

fc438d1430b28618e2d0c7c332a710ad watchdog.sys
Microsoft Corporation

442783e2cb0da19873b7a63833ff4cb4 Wdf01000.sys
Microsoft Corporation

aea0a67275cfba0e463e00c6e9a1ddae WdfLdr.sys
Microsoft Corporation

72889e16ff12ba0f235467d6091b17dc wd.sys
Microsoft Corporation

611b23304bf067451a9fdee01fbdd725 wfplwf.sys
Microsoft Corporation

05ecaec3e4529a7153b3136ceb49f0ec wimmount.sys
Microsoft Corporation

fe88b288356e7b47b74b13372add906d winusb.sys
Microsoft Corporation

f6ff8944478594d0e414d3f048f0d778 wmiacpi.sys
Microsoft Corporation

fc146f46872d4c5b529b89a5131fd1e6 wmilib.sys
Microsoft Corporation

6bcc1d7d2fd2453957c5479a32364e52 ws2ifsl.sys
Microsoft Corporation

ab886378eeb55c6c75b4f2d14b6c869f WUDFPf.sys
Microsoft Corporation

dda4caf29d8c0a297f886bfe561e6659 WUDFRd.sys
Microsoft Corporation

b3eeacf62445e24fbb2cd4b0fb4db026 yk62x64.sys
Marvell

#15 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:10:55 AM

Posted 23 January 2013 - 09:50 AM

Richard,

:step1: Check Disk
Please boot back into System Recovery Options, as we've done previously.
Click on Command Prompt
In the command prompt window that opens, type in:
chkdsk /r d:
(replace d with the drive letter of your hard drive, using notepad as described previously in the FRST instructions).
This will verify/repair the filesystem and mark any bad sectors on the disk so that they are not used again. It may take a while to complete.

:step2: sfc /scannow
This will verify/replace any files that Windows detects as corrupt.
Type the following into the Command Prompt (in the System Recovery Options).
sfc /scannow /offbootdir=d:\  /offwindir=d:\windows
(as before, replace d with the drive letter of your hard drive).
Please let me know if you get any error messages.

After completing these two steps, try starting your computer normally.
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users