Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

FRST Recovery tool fixlist


  • This topic is locked This topic is locked
5 replies to this topic

#1 tc5440

tc5440

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:08 AM

Posted 02 October 2014 - 03:54 PM

Hi,

 

I'm running Windows Vista on a Dell Inspiron 1545. When it boots windows fails to start and and system repair can't find the problem. I read through another closed post and found the Farbar recovery tool and did as the post suggested and ran it. Clearly my problem is not the same as the post I read so having the log frst.txt file I need a fixlist to do the repair if possible. I would appreciate any help I can get.

 

Thanks in advance, here is the log...

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-10-2014 01
Ran by SYSTEM on MINWINPC on 02-10-2014 21:33:44
Running from f:\
Platform: Windows Vista ™ Home Premium Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [ECenter] => C:\Dell\E-Center\EULALauncher.exe
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [200704 2008-09-03] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Windows\system32\WLTRAY.exe [3563520 2008-08-05] (Dell Inc.)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [1662032 2008-08-26] (Dell Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712 2008-05-07] (Intel Corporation)
HKLM\...\Run: [PDVDDXSrv] => C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128296 2008-05-23] (CyberLink Corp.)
HKLM\...\Run: [dellsupportcenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-06-03] (SupportSoft, Inc.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [O2] => C:\Program Files\O2\bin\sprtcmd.exe [198184 2008-03-28] (SupportSoft, Inc.)
HKLM\...\Run: [FBSSA] => C:\Program Files\SGPSA\ie3sh.exe archAssistant.dll .†1D`F; ;   C:\Program Files\Fast Browser Searc
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-05] (Apple Inc.)
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\QuickCam\Quickcam.exe [2656528 2008-12-19] ()
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM\...\Run: [vProt] => C:\Program Files\AVG Secure Search\vprot.exe [2640408 2014-08-25] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [442460 2008-09-16] (IDT, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
HKU\Sweeney\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\Sweeney\...\Run: [Facebook Update] => C:\Users\Sweeney\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.)
HKU\Sweeney\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\Sweeney\...\Run: [KGShareApp] => C:\Program Files\Kodak\KODAK Share Button App\KGShare_App.exe [394752 2012-02-03] (Eastman Kodak Company)
HKU\Sweeney\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2008-11-18] (Google Inc.)
HKU\Sweeney\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation)
HKU\Sweeney\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-10-31] (Apple Inc.)
HKU\Sweeney\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-10-31] (Apple Inc.)
HKU\Sweeney\...\Run: [com.apple.dav.bookmarks.daemon] => C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [59720 2013-10-01] (Apple Inc.)
HKU\Sweeney\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\Sweeney\...\Run: [SkyDrive] => C:\Users\Sweeney\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [251040 2014-09-06] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll File Not Found
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Socialbox.lnk
ShortcutTarget: Socialbox.lnk -> C:\Program Files\Socialbox\Socialbox.exe ()
Startup: C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\aestsrv.exe [73728 2008-09-16] (Andrea Electronics Corporation)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.)
S2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [161048 2008-05-02] (Stardock Corporation)
S2 gupdate1c9b546b1d43b40; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-04-04] (Google Inc.)
S2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2008-08-26] (SupportSoft, Inc.)
S2 sprtsvc_O2; C:\Program Files\O2\bin\sprtsvc.exe [202280 2007-06-07] (SupportSoft, Inc.)
S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\STacSV.exe [225362 2008-09-16] (IDT, Inc.)
S2 SupportSoft RemoteAssist; C:\Program Files\Common Files\supportsoft\bin\ssrc.exe [329080 2010-09-24] (SupportSoft, Inc.)
S2 vToolbarUpdater18.1.9; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-17] (AVG Secure Search)
S2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2654208 2008-08-05] (Dell Inc.)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [X]
S2 CltMngSvc; C:\PROGRA~1\SearchProtect\Main\bin\CltMngSvc.exe [X]
S2 yksvc; RUNDLL32.EXE ykx32coinst,serviceStartProc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [200984 2014-07-21] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.)
S0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-08-06] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42784 2014-08-17] (AVG Technologies)
S3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-08-05] (Broadcom Corporation)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25624 2008-12-16] ()
S3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41752 2008-12-16] (Logitech Inc.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13024 2014-09-06] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MPFP; System32\Drivers\Mpfp.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-02 21:30 - 2014-10-02 21:30 - 00000000 ____D () C:\FRST
2014-09-14 06:03 - 2014-09-23 18:12 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1(95)
2014-09-14 06:03 - 2014-09-23 18:12 - 00000000 ____D () C:\Program Files\iTunes(86)
2014-09-14 06:03 - 2014-09-14 06:03 - 00000000 ____D () C:\Program Files\iPod(85)
2014-09-06 07:23 - 2014-09-23 18:41 - 00000000 ____D () C:\Users\Sweeney\AppData\Local\PasswordSafe
2014-09-06 07:23 - 2014-09-06 07:23 - 00000000 ____D () C:\Users\Sweeney\Documents\My Safes
2014-09-06 07:22 - 2014-09-23 18:41 - 00000000 ____D () C:\Program Files\Password Safe
2014-09-06 07:22 - 2014-09-06 07:22 - 00000829 _____ () C:\Users\Sweeney\Desktop\Password Safe.lnk
2014-09-06 07:08 - 2014-09-23 18:41 - 00000000 ___RD () C:\Users\Sweeney\Dropbox
2014-09-06 07:08 - 2014-09-06 07:08 - 00000945 _____ () C:\Users\Sweeney\Desktop\Dropbox.lnk
2014-09-06 07:07 - 2014-09-23 18:39 - 00000000 ____D () C:\Program Files\Dropbox
2014-09-06 07:06 - 2014-09-06 07:08 - 00000000 ____D () C:\Users\Sweeney\AppData\Roaming\Dropbox
2014-09-06 07:01 - 2014-09-06 07:01 - 00000000 ___HD () C:\OneDriveTemp
2014-09-06 06:58 - 2014-09-23 18:41 - 00000000 ___RD () C:\Users\Sweeney\OneDrive
2014-09-06 06:58 - 2014-09-06 06:58 - 00000000 ____D () C:\Program Files\Microsoft OneDrive
2014-09-06 06:57 - 2014-09-06 06:57 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-09-03 11:33 - 2014-09-23 18:42 - 00000000 ____D () C:\users\TEMP
2014-09-03 11:33 - 2014-09-23 18:39 - 00000000 ____D () C:\Users\TEMP\AppData\Roaming\Macromedia
2014-09-03 11:33 - 2012-10-12 23:25 - 00000000 ____D () C:\Users\TEMP\AppData\Roaming\TuneUp Software
2014-09-03 11:33 - 2009-02-05 16:12 - 00000000 ____D () C:\Users\TEMP\AppData\Local\Microsoft Help

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-23 18:42 - 2009-02-05 11:00 - 00000000 ____D () C:\users\Sweeney
2014-09-23 18:42 - 2006-11-02 02:22 - 61079552 _____ () C:\Windows\System32\config\software_previous
2014-09-23 18:41 - 2014-08-19 11:54 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-09-23 18:41 - 2014-08-19 11:54 - 00000000 ____D () C:\Program Files\iTunes
2014-09-23 18:41 - 2014-06-11 07:32 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-09-23 18:41 - 2011-10-23 10:56 - 00000000 ____D () C:\Program Files\Common Files\AVG Secure Search
2014-09-23 18:41 - 2010-11-09 13:35 - 00000000 ____D () C:\ProgramData\MFAData
2014-09-23 18:41 - 2009-12-15 09:16 - 00000000 ___RD () C:\Program Files\Skype
2014-09-23 18:41 - 2009-02-05 13:27 - 00000000 ____D () C:\Users\Sweeney\AppData\Local\Microsoft Help
2014-09-23 18:41 - 2009-02-05 12:50 - 00000000 ____D () C:\Users\Sweeney\AppData\Roaming\Skype
2014-09-23 18:41 - 2009-02-05 11:44 - 00000000 ____D () C:\Users\Sweeney\AppData\Local\PowerDVD DX
2014-09-23 18:41 - 2006-11-02 03:18 - 00000000 __RSD () C:\Windows\Media
2014-09-23 18:41 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\System32\spool
2014-09-23 18:41 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\System32\Msdtc
2014-09-23 18:40 - 2009-12-06 12:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-09-23 18:40 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\registration
2014-09-23 18:28 - 2014-08-19 11:54 - 00000000 ____D () C:\Program Files\iPod
2014-09-23 18:26 - 2006-11-02 02:22 - 21757952 _____ () C:\Windows\System32\config\system_previous
2014-09-22 11:33 - 2008-11-18 05:52 - 01576736 _____ () C:\Windows\WindowsUpdate.log
2014-09-22 11:16 - 2006-11-02 04:52 - 00128228 _____ () C:\Windows\setupact.log
2014-09-17 07:33 - 2006-11-02 02:22 - 44564480 _____ () C:\Windows\System32\config\components_previous
2014-09-14 06:02 - 2006-11-02 02:22 - 00786432 _____ () C:\Windows\System32\config\default_previous
2014-09-10 11:14 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-10 10:27 - 2009-02-05 12:50 - 00000000 ____D () C:\ProgramData\Skype
2014-09-10 10:17 - 2006-11-02 02:22 - 00262144 _____ () C:\Windows\System32\config\security_previous
2014-09-10 10:17 - 2006-11-02 02:22 - 00262144 _____ () C:\Windows\System32\config\sam_previous
2014-09-10 10:16 - 2008-01-20 18:47 - 00272782 _____ () C:\Windows\PFRO.log
2014-09-09 13:23 - 2009-02-05 13:27 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-09 13:19 - 2013-08-13 13:13 - 00000000 ____D () C:\Windows\System32\MRT
2014-09-09 11:49 - 2012-04-02 06:55 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2014-09-09 11:49 - 2012-01-01 11:35 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2014-09-09 11:44 - 2006-11-02 04:47 - 00003616 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-09 11:44 - 2006-11-02 04:47 - 00003616 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-06 11:15 - 2014-08-19 11:39 - 00000000 ____D () C:\Users\Sweeney\AppData\Local\Adobe
2014-09-06 06:16 - 2008-11-18 12:10 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-09-06 06:14 - 2012-08-16 06:51 - 00013024 _____ () C:\Windows\System32\Drivers\SWDUMon.sys
2014-09-06 04:26 - 2013-10-23 08:04 - 00000844 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-09-03 11:32 - 2006-11-02 04:47 - 00381984 _____ () C:\Windows\System32\FNTCACHE.DAT

Files to move or delete:
====================
C:\Users\Public\RemoveSGP.exe


Some content of TEMP:
====================
C:\Users\Sweeney\AppData\Local\Temp\8.2.30.1-EasyShrx.Dll
C:\Users\Sweeney\AppData\Local\Temp\8.3.30.1-EasyShrx.Dll
C:\Users\Sweeney\AppData\Local\Temp\AVGTBProductUpgrade.exe
C:\Users\Sweeney\AppData\Local\Temp\avguidx.dll
C:\Users\Sweeney\AppData\Local\Temp\CommonInstaller.exe
C:\Users\Sweeney\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjeeywx.dll
C:\Users\Sweeney\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Sweeney\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Sweeney\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Sweeney\AppData\Local\Temp\GLF34B3.tmp.ConduitEngineSetup.exe
C:\Users\Sweeney\AppData\Local\Temp\GLF53D6.tmp.tbSear.dll
C:\Users\Sweeney\AppData\Local\Temp\GoogleChromeInstaller.exe
C:\Users\Sweeney\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\Sweeney\AppData\Local\Temp\g_xhvm-h.dll
C:\Users\Sweeney\AppData\Local\Temp\iGearedHelper.dll
C:\Users\Sweeney\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\Sweeney\AppData\Local\Temp\MSNB155.exe
C:\Users\Sweeney\AppData\Local\Temp\nsa3B7B.exe
C:\Users\Sweeney\AppData\Local\Temp\nsaB02E.exe
C:\Users\Sweeney\AppData\Local\Temp\nsaC313.exe
C:\Users\Sweeney\AppData\Local\Temp\nsk2E02.exe
C:\Users\Sweeney\AppData\Local\Temp\oi_{832E5707-7ED6-4F1A-A7CF-5A21E195E039}.exe
C:\Users\Sweeney\AppData\Local\Temp\omrvf9kk.dll
C:\Users\Sweeney\AppData\Local\Temp\ose00000.exe
C:\Users\Sweeney\AppData\Local\Temp\qc_quickcam.exe
C:\Users\Sweeney\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Sweeney\AppData\Local\Temp\setup.exe
C:\Users\Sweeney\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sweeney\AppData\Local\Temp\t6an3su2.dll
C:\Users\Sweeney\AppData\Local\Temp\tbTran.dll
C:\Users\Sweeney\AppData\Local\Temp\ToolbarInstaller.exe
C:\Users\Sweeney\AppData\Local\Temp\VistaLib32_1.dll
C:\Users\Sweeney\AppData\Local\Temp\wlsetup-cvr.exe
C:\Users\Sweeney\AppData\Local\Temp\xswday0y.dll
C:\Users\Sweeney\AppData\Local\Temp\Zynga.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-07-23 12:46:09
Restore point made on: 2014-07-29 07:59:37
Restore point made on: 2014-08-17 13:05:11
Restore point made on: 2014-08-17 13:06:43
Restore point made on: 2014-08-17 13:16:33
Restore point made on: 2014-08-22 12:13:03
Restore point made on: 2014-08-24 11:27:40
Restore point made on: 2014-08-25 03:08:44
Restore point made on: 2014-09-01 13:05:38
Restore point made on: 2014-09-06 05:15:41
Restore point made on: 2014-09-07 11:32:00
Restore point made on: 2014-09-09 12:44:49
Restore point made on: 2014-09-09 13:08:05
Restore point made on: 2014-09-12 11:39:00
Restore point made on: 2014-09-14 05:57:15
Restore point made on: 2014-09-17 08:09:09

==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 3033.64 MB
Available physical RAM: 2709.96 MB
Total Pagefile: 2932.32 MB
Available Pagefile: 2789.45 MB
Total Virtual: 2047.88 MB
Available Virtual: 1977.39 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:223.08 GB) (Free:110.38 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive f: () (Removable) (Total:3.74 GB) (Free:3.74 GB) FAT32
Drive x: (RECOVERY) (Fixed) (Total:9.77 GB) (Free:4.77 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: 00000080)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=9.8 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=223.1 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 3.8 GB) (Disk ID: 00473FFD)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0B)


LastRegBack: 2014-09-10 10:29

==================== End Of Log ============================


Edited by Orange Blossom, 02 October 2014 - 03:56 PM.
Moved to log forum. ~ OB


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:08 PM

Posted 07 October 2014 - 09:55 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===



You have a or malforme process(es) reported on this line in bold.
It may be that the filenames are corrupted or there is a bad entry in the registry,
HKLM\...\Run: [FBSSA] => C:\Program Files\SGPSA\ie3sh.exe archAssistant.dll .1D`F; ; C:\Program Files\Fast Browser Searc
===

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.

In Windows 7 and 8.
Press the [Windows Icon + R] and enter "notepad" in the box to open Notepad
 
start
HKLM\...\Run: [FBSSA] => C:\Program Files\SGPSA\ie3sh.exe archAssistant.dll .1D`F; ;   C:\Program Files\Fast Browser Searc
HKLM\...\Run: [vProt] => C:\Program Files\AVG Secure Search\vprot.exe [2640408 2014-08-25] ()
AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll File Not Found
ShortcutTarget: Dropbox.lnk ->  (No File)
S2 vToolbarUpdater18.1.9; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-17] (AVG Secure Search)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [X]
S2 CltMngSvc; C:\PROGRA~1\SearchProtect\Main\bin\CltMngSvc.exe [X]
S2 yksvc; RUNDLL32.EXE ykx32coinst,serviceStartProc [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MPFP; System32\Drivers\Mpfp.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
C:\Program Files\Fast Browser Search
C:\Program Files\SGPSA

end

Save the files as fixlist.txt in to the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.

====

Run the Farbar tool normally and post a fresh FRST log for my review.

Let me know if you now can start the computer in normal mode.

#3 tc5440

tc5440
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:08 AM

Posted 07 October 2014 - 06:44 PM

nasdaq,

 

thanks for your help. I have done as asked and the results are below. One question... from the original scan, is the section

 

Files to move or delete:
====================
C:\Users\Public\RemoveSGP.exe

 

not part of the problem?

 

Thanks again in advance.

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 01-10-2014 01
Ran by SYSTEM at 2014-10-08 00:35:10 Run:1
Running from f:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
start
HKLM\...\Run: [FBSSA] => C:\Program Files\SGPSA\ie3sh.exe archAssistant.dll .1D`F; ;   C:\Program Files\Fast Browser Searc
HKLM\...\Run: [vProt] => C:\Program Files\AVG Secure Search\vprot.exe [2640408 2014-08-25] ()
AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll File Not Found
ShortcutTarget: Dropbox.lnk ->  (No File)
S2 vToolbarUpdater18.1.9; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-17] (AVG
Secure Search)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [X]
S2 CltMngSvc; C:\PROGRA~1\SearchProtect\Main\bin\CltMngSvc.exe [X]
S2 yksvc; RUNDLL32.EXE ykx32coinst,serviceStartProc [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MPFP; System32\Drivers\Mpfp.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
C:\Program Files\Fast Browser Search
C:\Program Files\SGPSA

end
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\FBSSA => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\vProt => value deleted successfully.
"C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" => Value Data removed successfully.
ShortcutTarget: Dropbox.lnk ->  (No File) not found.
vToolbarUpdater18.1.9 => Service deleted successfully.
Secure Search) => Error: No automatic fix found for this entry.
ACDaemon => Service deleted successfully.
CltMngSvc => Service deleted successfully.
yksvc => Service deleted successfully.
IpInIp => Service deleted successfully.
MPFP => Service deleted successfully.
NwlnkFlt => Service deleted successfully.
NwlnkFwd => Service deleted successfully.
"C:\Program Files\Fast Browser Search" => File/Directory not found.
C:\Program Files\SGPSA => Moved successfully.

==== End of Fixlog ====

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-10-2014 01
Ran by SYSTEM on MINWINPC on 08-10-2014 00:35:35
Running from f:\
Platform: Windows Vista ™ Home Premium Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [ECenter] => C:\Dell\E-Center\EULALauncher.exe
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [200704 2008-09-03] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Windows\system32\WLTRAY.exe [3563520 2008-08-05] (Dell Inc.)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [1662032 2008-08-26] (Dell Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712 2008-05-07] (Intel Corporation)
HKLM\...\Run: [PDVDDXSrv] => C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128296 2008-05-23] (CyberLink Corp.)
HKLM\...\Run: [dellsupportcenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-06-03] (SupportSoft, Inc.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [O2] => C:\Program Files\O2\bin\sprtcmd.exe [198184 2008-03-28] (SupportSoft, Inc.)
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-05] (Apple Inc.)
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\QuickCam\Quickcam.exe [2656528 2008-12-19] ()
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [442460 2008-09-16] (IDT, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
HKU\Sweeney\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\Sweeney\...\Run: [Facebook Update] => C:\Users\Sweeney\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.)
HKU\Sweeney\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\Sweeney\...\Run: [KGShareApp] => C:\Program Files\Kodak\KODAK Share Button App\KGShare_App.exe [394752 2012-02-03] (Eastman Kodak Company)
HKU\Sweeney\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2008-11-18] (Google Inc.)
HKU\Sweeney\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation)
HKU\Sweeney\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-10-31] (Apple Inc.)
HKU\Sweeney\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-10-31] (Apple Inc.)
HKU\Sweeney\...\Run: [com.apple.dav.bookmarks.daemon] => C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [59720 2013-10-01] (Apple Inc.)
HKU\Sweeney\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\Sweeney\...\Run: [SkyDrive] => C:\Users\Sweeney\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [251040 2014-09-06] (Microsoft Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)
Startup: C:\Users\Sweeney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Socialbox.lnk
ShortcutTarget: Socialbox.lnk -> C:\Program Files\Socialbox\Socialbox.exe ()
Startup: C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\aestsrv.exe [73728 2008-09-16] (Andrea Electronics Corporation)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.)
S2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [161048 2008-05-02] (Stardock Corporation)
S2 gupdate1c9b546b1d43b40; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-04-04] (Google Inc.)
S2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2008-08-26] (SupportSoft, Inc.)
S2 sprtsvc_O2; C:\Program Files\O2\bin\sprtsvc.exe [202280 2007-06-07] (SupportSoft, Inc.)
S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\STacSV.exe [225362 2008-09-16] (IDT, Inc.)
S2 SupportSoft RemoteAssist; C:\Program Files\Common Files\supportsoft\bin\ssrc.exe [329080 2010-09-24] (SupportSoft, Inc.)
S2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2654208 2008-08-05] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [200984 2014-07-21] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.)
S0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-08-06] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.)
S1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42784 2014-08-17] (AVG Technologies)
S3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-08-05] (Broadcom Corporation)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25624 2008-12-16] ()
S3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41752 2008-12-16] (Logitech Inc.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13024 2014-09-06] ()

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-02 21:30 - 2014-10-08 00:35 - 00000000 ____D () C:\FRST
2014-09-14 06:03 - 2014-09-23 18:12 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1(95)
2014-09-14 06:03 - 2014-09-23 18:12 - 00000000 ____D () C:\Program Files\iTunes(86)
2014-09-14 06:03 - 2014-09-14 06:03 - 00000000 ____D () C:\Program Files\iPod(85)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-23 18:42 - 2014-09-03 11:33 - 00000000 ____D () C:\users\TEMP
2014-09-23 18:42 - 2009-02-05 11:00 - 00000000 ____D () C:\users\Sweeney
2014-09-23 18:42 - 2006-11-02 02:22 - 61079552 _____ () C:\Windows\System32\config\software_previous
2014-09-23 18:41 - 2014-09-06 07:23 - 00000000 ____D () C:\Users\Sweeney\AppData\Local\PasswordSafe
2014-09-23 18:41 - 2014-09-06 07:22 - 00000000 ____D () C:\Program Files\Password Safe
2014-09-23 18:41 - 2014-09-06 07:08 - 00000000 ___RD () C:\Users\Sweeney\Dropbox
2014-09-23 18:41 - 2014-09-06 06:58 - 00000000 ___RD () C:\Users\Sweeney\OneDrive
2014-09-23 18:41 - 2014-08-19 11:54 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-09-23 18:41 - 2014-08-19 11:54 - 00000000 ____D () C:\Program Files\iTunes
2014-09-23 18:41 - 2014-06-11 07:32 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-09-23 18:41 - 2011-10-23 10:56 - 00000000 ____D () C:\Program Files\Common Files\AVG Secure Search
2014-09-23 18:41 - 2010-11-09 13:35 - 00000000 ____D () C:\ProgramData\MFAData
2014-09-23 18:41 - 2009-12-15 09:16 - 00000000 ___RD () C:\Program Files\Skype
2014-09-23 18:41 - 2009-02-05 13:27 - 00000000 ____D () C:\Users\Sweeney\AppData\Local\Microsoft Help
2014-09-23 18:41 - 2009-02-05 12:50 - 00000000 ____D () C:\Users\Sweeney\AppData\Roaming\Skype
2014-09-23 18:41 - 2009-02-05 11:44 - 00000000 ____D () C:\Users\Sweeney\AppData\Local\PowerDVD DX
2014-09-23 18:41 - 2006-11-02 03:18 - 00000000 __RSD () C:\Windows\Media
2014-09-23 18:41 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\System32\spool
2014-09-23 18:41 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\System32\Msdtc
2014-09-23 18:40 - 2009-12-06 12:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-09-23 18:40 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\registration
2014-09-23 18:39 - 2014-09-06 07:07 - 00000000 ____D () C:\Program Files\Dropbox
2014-09-23 18:39 - 2014-09-03 11:33 - 00000000 ____D () C:\Users\TEMP\AppData\Roaming\Macromedia
2014-09-23 18:28 - 2014-08-19 11:54 - 00000000 ____D () C:\Program Files\iPod
2014-09-23 18:26 - 2006-11-02 02:22 - 21757952 _____ () C:\Windows\System32\config\system_previous
2014-09-23 08:45 - 2008-11-18 05:52 - 01576736 _____ () C:\Windows\WindowsUpdate.log
2014-09-22 11:16 - 2006-11-02 04:52 - 00128228 _____ () C:\Windows\setupact.log
2014-09-17 07:33 - 2006-11-02 02:22 - 44564480 _____ () C:\Windows\System32\config\components_previous
2014-09-14 06:02 - 2006-11-02 02:22 - 00786432 _____ () C:\Windows\System32\config\default_previous
2014-09-10 11:14 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-10 10:27 - 2009-02-05 12:50 - 00000000 ____D () C:\ProgramData\Skype
2014-09-10 10:17 - 2006-11-02 02:22 - 00262144 _____ () C:\Windows\System32\config\security_previous
2014-09-10 10:17 - 2006-11-02 02:22 - 00262144 _____ () C:\Windows\System32\config\sam_previous
2014-09-10 10:16 - 2008-01-20 18:47 - 00272782 _____ () C:\Windows\PFRO.log
2014-09-09 13:23 - 2009-02-05 13:27 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-09 13:19 - 2013-08-13 13:13 - 00000000 ____D () C:\Windows\System32\MRT
2014-09-09 11:49 - 2012-04-02 06:55 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2014-09-09 11:49 - 2012-01-01 11:35 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2014-09-09 11:44 - 2006-11-02 04:47 - 00003616 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-09 11:44 - 2006-11-02 04:47 - 00003616 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

Files to move or delete:
====================
C:\Users\Public\RemoveSGP.exe


Some content of TEMP:
====================
C:\Users\Sweeney\AppData\Local\Temp\8.2.30.1-EasyShrx.Dll
C:\Users\Sweeney\AppData\Local\Temp\8.3.30.1-EasyShrx.Dll
C:\Users\Sweeney\AppData\Local\Temp\AVGTBProductUpgrade.exe
C:\Users\Sweeney\AppData\Local\Temp\avguidx.dll
C:\Users\Sweeney\AppData\Local\Temp\CommonInstaller.exe
C:\Users\Sweeney\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjeeywx.dll
C:\Users\Sweeney\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Sweeney\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Sweeney\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Sweeney\AppData\Local\Temp\GLF34B3.tmp.ConduitEngineSetup.exe
C:\Users\Sweeney\AppData\Local\Temp\GLF53D6.tmp.tbSear.dll
C:\Users\Sweeney\AppData\Local\Temp\GoogleChromeInstaller.exe
C:\Users\Sweeney\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\Sweeney\AppData\Local\Temp\g_xhvm-h.dll
C:\Users\Sweeney\AppData\Local\Temp\iGearedHelper.dll
C:\Users\Sweeney\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\Sweeney\AppData\Local\Temp\MSNB155.exe
C:\Users\Sweeney\AppData\Local\Temp\nsa3B7B.exe
C:\Users\Sweeney\AppData\Local\Temp\nsaB02E.exe
C:\Users\Sweeney\AppData\Local\Temp\nsaC313.exe
C:\Users\Sweeney\AppData\Local\Temp\nsk2E02.exe
C:\Users\Sweeney\AppData\Local\Temp\oi_{832E5707-7ED6-4F1A-A7CF-5A21E195E039}.exe
C:\Users\Sweeney\AppData\Local\Temp\omrvf9kk.dll
C:\Users\Sweeney\AppData\Local\Temp\ose00000.exe
C:\Users\Sweeney\AppData\Local\Temp\qc_quickcam.exe
C:\Users\Sweeney\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Sweeney\AppData\Local\Temp\setup.exe
C:\Users\Sweeney\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sweeney\AppData\Local\Temp\t6an3su2.dll
C:\Users\Sweeney\AppData\Local\Temp\tbTran.dll
C:\Users\Sweeney\AppData\Local\Temp\ToolbarInstaller.exe
C:\Users\Sweeney\AppData\Local\Temp\VistaLib32_1.dll
C:\Users\Sweeney\AppData\Local\Temp\wlsetup-cvr.exe
C:\Users\Sweeney\AppData\Local\Temp\xswday0y.dll
C:\Users\Sweeney\AppData\Local\Temp\Zynga.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-07-23 12:46:09
Restore point made on: 2014-07-29 07:59:37
Restore point made on: 2014-08-17 13:05:11
Restore point made on: 2014-08-17 13:06:43
Restore point made on: 2014-08-17 13:16:33
Restore point made on: 2014-08-22 12:13:03
Restore point made on: 2014-08-24 11:27:40
Restore point made on: 2014-08-25 03:08:44
Restore point made on: 2014-09-01 13:05:38
Restore point made on: 2014-09-06 05:15:41
Restore point made on: 2014-09-07 11:32:00
Restore point made on: 2014-09-09 12:44:49
Restore point made on: 2014-09-09 13:08:05
Restore point made on: 2014-09-12 11:39:00
Restore point made on: 2014-09-14 05:57:15
Restore point made on: 2014-09-17 08:09:09

==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 3033.64 MB
Available physical RAM: 2712.08 MB
Total Pagefile: 2934.28 MB
Available Pagefile: 2790.1 MB
Total Virtual: 2047.88 MB
Available Virtual: 1963.87 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:223.08 GB) (Free:110.87 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive f: () (Removable) (Total:3.74 GB) (Free:3.74 GB) FAT32
Drive x: (RECOVERY) (Fixed) (Total:9.77 GB) (Free:4.78 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: 00000080)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=9.8 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=223.1 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 3.8 GB) (Disk ID: 00473FFD)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0B)


LastRegBack: 2014-09-10 10:29

==================== End Of Log ============================

nasdaq,

 

I forgot to mention I still cannot boot into windows

 

Cheers



#4 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:08 PM

Posted 08 October 2014 - 08:14 AM

Check if you can restore you computer to a date prior to the start of your computer problems.

http://windows.microsoft.com/en-ca/windows-vista/turn-back-time-on-your-pc-undo-system-changes-with-system-restore

Try safe mode if you can.

Keep me posted.

Edited by nasdaq, 08 October 2014 - 08:16 AM.


#5 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:08 PM

Posted 14 October 2014 - 08:20 AM


If all is well.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:08 PM

Posted 20 October 2014 - 08:29 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users