Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 Failed to Start


  • This topic is locked This topic is locked
8 replies to this topic

#1 anto82

anto82

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 17 February 2015 - 06:17 PM

Boot in safe mode, System Repair and System Restore Failed. 

 

Farbar Recovery Scan Tool 32 and ComboFix in "Boot Mode: Recovery-> Command Prompt" Failed with message: The subsystem needed to support the image type is not present

 

Farbar Recovery Scan Tool 64 ran successfully:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015
Ran by SYSTEM on MININT-8MH09EV on 17-02-2015 20:56:49
Running from F:\farbar
Platform: Windows 7 Home Premium (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
 
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-02] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [926880 2011-05-31] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [792736 2011-05-31] (Atheros Commnucations)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-12] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-23] ()
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-08-30] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-10] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2014-12-11] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\tamara\...\Run: [Spotify Web Helper] => C:\Users\tamara\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-26] (Spotify Ltd)
HKU\tamara\...\Run: [Google Update] => C:\Users\tamara\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-05-11] (Google Inc.)
HKU\tamara\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
Startup: C:\Users\tamara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ritaglio schermata e avvio di OneNote 2010.lnk
ShortcutTarget: Ritaglio schermata e avvio di OneNote 2010.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-16] (Avira Operations GmbH & Co. KG)
S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-05-31] (Atheros)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
S2 HSPA USB MODEM Service; C:\Program Files (x86)\Wind Connection Manager\ApplicationController.exe [570232 2013-07-26] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 ALCATELUSB; C:\Windows\System32\Drivers\AlcatelUsb.sys [25088 2013-01-11] (Windows ® Codename Longhorn DDK provider)
S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-17] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-17] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [123776 2013-05-08] (TCT International Mobile Ltd.)
S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 vwifibus; C:\Windows\System32\DRIVERS\vwifibus.sys [24576 2009-07-13] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-02-17 20:55 - 2015-02-17 20:56 - 00000000 ____D () C:\FRST
2015-02-15 02:06 - 2015-02-15 02:07 - 00000000 ____D () C:\Users\tamara\AppData\Local\{FBECA25F-2C32-473F-A488-4908E002AD30}
2015-02-14 02:01 - 2015-02-14 02:01 - 00000000 ____D () C:\Users\tamara\AppData\Local\{BBE89A76-D730-4122-B025-88C797D36705}
2015-02-09 14:57 - 2015-02-09 14:57 - 01055936 _____ (Adobe) C:\Users\tamara\Downloads\install_flashplayer16x32_ltr5x64d_awc_aih.exe
2015-02-07 05:14 - 2015-02-07 05:14 - 00000000 ____D () C:\Users\tamara\AppData\Local\{CABE4A89-634F-40DE-9A20-CBC8CA2F95A8}
2015-02-05 05:09 - 2015-02-05 05:09 - 00000000 ____D () C:\Users\tamara\AppData\Local\{8AFD16A1-7195-4ABD-ABA6-D766942CD42D}
2015-02-04 14:09 - 2015-02-04 14:09 - 00673632 _____ () C:\Windows\Minidump\020415-19032-01.dmp
2015-01-30 04:48 - 2015-01-30 04:48 - 00000000 ____D () C:\Users\tamara\AppData\Local\{9A1E53F6-539F-4443-88CE-300E3E1887DE}
2015-01-29 11:50 - 2015-01-29 11:50 - 00000000 ____D () C:\Users\tamara\AppData\Local\{56FC3BE0-AA11-4F9A-A4D8-205DBB26B942}
2015-01-28 13:58 - 2015-01-28 13:58 - 00000000 ____D () C:\Users\tamara\AppData\Local\{4BA37C09-B395-42B3-9728-7A9DCBC61D26}
2015-01-27 10:58 - 2015-01-27 10:58 - 00000000 ____D () C:\Users\tamara\AppData\Local\{41FC8D7C-9C43-4C4E-B7B9-EB5A8E1AE816}
2015-01-27 01:44 - 2015-01-27 01:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 15:12 - 2015-01-26 15:12 - 00000000 ____D () C:\Windows\SysWOW64\IPM
2015-01-25 12:03 - 2015-01-25 12:03 - 00000000 ____D () C:\Users\tamara\AppData\Local\{BC749BB6-AFB1-4A01-A73B-35781FED6E3B}
2015-01-24 02:35 - 2015-01-24 02:35 - 00000000 ____D () C:\Users\tamara\AppData\Local\{48A8F39D-C94F-441D-A94A-39465D0D88DB}
2015-01-24 02:31 - 2015-01-24 02:31 - 00000000 ____D () C:\Users\tamara\AppData\Local\{32FBA8B9-BA34-43CB-A6A7-09FE7A2213C1}
2015-01-24 02:30 - 2015-01-24 02:30 - 00000000 ____D () C:\Users\tamara\AppData\Local\{3E521D49-5F06-415E-ABA9-ECBF784055C2}
2015-01-22 14:36 - 2014-12-11 21:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2015-01-22 14:36 - 2014-12-11 21:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2015-01-22 14:36 - 2014-12-11 21:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2015-01-22 14:36 - 2014-12-11 21:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2015-01-22 14:36 - 2014-12-11 21:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-22 14:36 - 2014-12-11 21:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-22 14:36 - 2014-12-11 21:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-21 12:10 - 2014-12-18 19:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2015-01-21 12:10 - 2014-12-18 17:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxdav.sys
2015-01-21 12:10 - 2014-12-11 09:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\TSWbPrxy.exe
2015-01-21 12:10 - 2014-12-05 20:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\System32\nlasvc.dll
2015-01-21 12:10 - 2014-12-05 19:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-21 12:10 - 2014-12-05 19:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-19 07:25 - 2015-01-19 07:25 - 00000000 ____D () C:\Windows\System32\%LOCALAPPDATA%
2015-01-18 02:01 - 2015-01-18 02:01 - 00000000 ____D () C:\Users\tamara\AppData\Local\{B754ED11-F8F8-4E63-99C9-437B352D5E52}
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-02-17 20:06 - 2014-12-16 07:18 - 00000000 ____D () C:\Windows\System32\appraiser
2015-02-17 20:06 - 2014-10-16 11:59 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2015-02-17 20:06 - 2014-08-21 02:17 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 20:06 - 2014-05-09 13:42 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-02-17 20:06 - 2014-05-02 23:31 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-02-17 20:06 - 2013-01-25 12:54 - 00000000 ____D () C:\Windows\System32\Macromed
2015-02-17 20:06 - 2013-01-23 12:10 - 00000000 ____D () C:\ProgramData\Skype
2015-02-17 20:06 - 2013-01-23 00:27 - 00000000 ____D () C:\ProgramData\P4G
2015-02-17 20:06 - 2013-01-21 23:50 - 00000000 ____D () C:\users\tamara
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\SysWOW64\he-IL
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\he-IL
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-02-17 20:05 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration
2015-02-17 20:02 - 2013-01-23 12:10 - 00000000 ____D () C:\Users\tamara\AppData\Roaming\Skype
2015-02-17 20:01 - 2014-06-02 23:02 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-17 20:01 - 2013-01-23 05:51 - 00000000 __RHD () C:\MSOCache
2015-02-17 04:55 - 2013-10-08 04:02 - 00000000 ____D () C:\Users\tamara\Desktop\A1.1
2015-02-17 04:54 - 2013-07-21 03:16 - 00000000 ____D () C:\Users\tamara\Desktop\GRUNDTVIG
2015-02-17 04:45 - 2013-01-21 23:51 - 00000000 ___HD () C:\ASUS.DAT
2015-02-17 02:04 - 2013-02-12 05:13 - 00000000 ____D () C:\Users\tamara\Documents\file lezione cidis
2015-02-15 14:51 - 2014-11-23 04:01 - 00000000 ____D () C:\Users\tamara\Desktop\eurobag collaboration
2015-02-14 09:44 - 2013-08-16 01:33 - 00000000 ____D () C:\Windows\System32\MRT
2015-02-14 09:34 - 2013-01-23 00:01 - 01580638 _____ () C:\Windows\WindowsUpdate.log
2015-02-14 09:28 - 2013-10-13 04:15 - 00000000 ____D () C:\Users\tamara\Desktop\caterina individuale
2015-02-14 09:21 - 2011-04-12 18:33 - 00001150 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-14 09:03 - 2013-05-31 11:56 - 00001164 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000UA.job
2015-02-14 09:02 - 2014-03-09 11:32 - 00000978 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-14 07:55 - 2009-07-13 20:45 - 00018736 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-14 07:55 - 2009-07-13 20:45 - 00018736 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-14 07:48 - 2013-01-21 23:50 - 00045056 _____ () C:\Windows\System32\acovcnt.exe
2015-02-14 07:48 - 2011-04-12 18:33 - 00001146 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-14 07:47 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-14 07:47 - 2009-07-13 20:51 - 00182626 _____ () C:\Windows\setupact(87).log
2015-02-14 06:21 - 2014-06-03 23:53 - 00000000 ____D () C:\Users\tamara\AppData\Local\Adobe
2015-02-14 06:21 - 2014-03-09 11:32 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-14 06:21 - 2014-03-09 11:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-14 06:21 - 2014-03-09 11:32 - 00003916 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-14 01:39 - 2011-02-18 20:35 - 08019004 _____ () C:\Windows\System32\perfh010.dat
2015-02-14 01:39 - 2011-02-18 20:35 - 02708908 _____ () C:\Windows\System32\perfc010.dat
2015-02-14 01:39 - 2009-07-13 21:13 - 00006268 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-02-11 14:39 - 2013-01-23 06:20 - 00000000 ____D () C:\Users\tamara\Documents\pagamenti edit
2015-02-10 13:02 - 2014-09-17 13:32 - 00000000 ____D () C:\Users\tamara\AppData\Local\CrashDumps
2015-02-09 15:26 - 2013-03-15 11:43 - 00000000 ____D () C:\Users\tamara\AppData\Roaming\Spotify
2015-02-09 14:42 - 2013-03-15 11:45 - 00000000 ____D () C:\Users\tamara\AppData\Local\Spotify
2015-02-08 13:10 - 2014-09-16 13:23 - 00000000 ____D () C:\Users\tamara\Desktop\Fei Edit
2015-02-08 04:03 - 2013-05-31 11:56 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000Core.job
2015-02-08 03:58 - 2013-05-31 11:56 - 00004136 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000UA
2015-02-08 03:58 - 2013-05-31 11:56 - 00003740 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000Core
2015-02-07 05:16 - 2011-04-12 18:33 - 00004146 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 05:16 - 2011-04-12 18:33 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 13:56 - 2015-01-17 05:55 - 00000000 ____D () C:\Users\tamara\Desktop\prils
2015-02-04 23:06 - 2009-07-13 20:51 - 00181730 _____ () C:\Windows\setupact.log
2015-02-04 14:09 - 2014-09-17 05:38 - 640786079 _____ () C:\Windows\MEMORY.DMP
2015-02-04 14:09 - 2014-09-17 05:38 - 00000000 ____D () C:\Windows\Minidump
2015-02-01 12:27 - 2014-11-30 04:03 - 00025600 _____ () C:\Users\tamara\Desktop\monte_ore_ Tamara Petriachi.xls
2015-01-30 05:46 - 2014-08-26 08:12 - 00000000 ____D () C:\Users\tamara\Desktop\SALTO TRAINING BRUXELLES
2015-01-30 05:22 - 2014-09-16 13:20 - 00000000 ____D () C:\Users\tamara\Documents\Spli
2015-01-28 13:02 - 2013-01-23 06:20 - 00000000 ____D () C:\Users\tamara\Documents\didattica
2015-01-28 00:03 - 2014-07-31 05:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-23 03:34 - 2009-07-13 21:08 - 00032548 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-20 12:51 - 2013-01-23 08:23 - 113365784 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-01-19 12:59 - 2014-06-28 07:31 - 00000000 ____D () C:\Users\tamara\Desktop\chiavetta
2015-01-19 12:59 - 2013-03-11 12:29 - 00000000 ___RD () C:\Users\tamara\Desktop\musica
2015-01-19 12:59 - 2013-01-23 06:19 - 00000000 ____D () C:\Users\tamara\Desktop\test d'ingresso fei
2015-01-19 12:59 - 2009-07-13 23:44 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-01-19 12:58 - 2013-01-23 06:20 - 00000000 ____D () C:\Users\tamara\Documents\VirtualDJ
 
Some content of TEMP:
====================
C:\Users\tamara\AppData\Local\Temp\avgnt.exe
C:\Users\tamara\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\tamara\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\tamara\AppData\Local\Temp\SkypeSetup.exe
C:\Users\tamara\AppData\Local\Temp\{1EA1E374-09C0-45A5-90ED-07E501EBDB13}-39.0.2171.99_chrome_installer.exe
C:\Users\tamara\AppData\Local\Temp\{80F96A6A-E3D3-4507-A7F4-0C6C5B6F08B7}-39.0.2171.95_39.0.2171.71_chrome_updater.exe
C:\Users\tamara\AppData\Local\Temp\{A8C244B5-74CD-4C82-9323-30CCF733D8EE}-39.0.2171.95_39.0.2171.71_chrome_updater.exe
 
 
==================== Known DLLs (Whitelisted) ================
 
[2009-07-13 15:26] - [2009-07-13 17:31] - 0002560 ____A () C:\Windows\System32\NORMALIZ.dll
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
==================== Restore Points  =========================
 
Restore point made on: 2015-02-05 02:34:43
Restore point made on: 2015-02-14 09:34:39
Restore point made on: 2015-02-15 14:51:50
 
==================== Memory info =========================== 
 
Percentage of memory in use: 15%
Total physical RAM: 4000.13 MB
Available physical RAM: 3380.05 MB
Total Pagefile: 3998.27 MB
Available Pagefile: 3369.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:125.03 GB) (Free:52.36 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:148.06 GB) (Free:147.35 GB) NTFS
Drive f: (BENNY) (Removable) (Total:0.95 GB) (Free:0.95 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 38601C96)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=125 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=148.1 GB) - (Type=OF Extended)
 
========================================================
Disk: 1 (Size: 977.5 MB) (Disk ID: 00000000)
 
Partition: GPT Partition Type.
 
 
LastRegBack: 2015-02-03 12:26
 
==================== End Of Log ============================


BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,600 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:28 PM

Posted 22 February 2015 - 06:20 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/567421 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new FRST log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download FRST by Farbar from the following link if you no longer have it available and save it to your destop.

    FRST Download Link

  • When you go to the above page, there will be 32-bit and 64-bit downloads available. Please click on the appropriate one for your version of Windows. If you are unsure as to whether your Windows is 32-bit or 64-bit, please see this tutorial.
  • Double click on the FRST icon and allow it to run.
  • Agree to the usage agreement and FRST will open. Do not make any changes and click on the Scan button.
  • Notepad will open with the results.
  • Post the new logs as explained in the prep guide.
  • Close the program window, and delete the program from your desktop.


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 anto82

anto82
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 23 February 2015 - 07:05 AM

I NEED URGENT HELP!! 6 days and I'm waiting for the 1st reply.... Can you answer me please?

 

I've not used the infeted laptop this days... it can't boot.... but i post a new FRST Log (with options flagged) if this can help you:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015
Ran by SYSTEM on MININT-OQN9PHF on 23-02-2015 12:54:21
Running from F:\farbar
Platform: Windows 7 Home Premium (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
 
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-02] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [926880 2011-05-31] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [792736 2011-05-31] (Atheros Commnucations)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-12] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-23] ()
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-08-30] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-10] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2014-12-11] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\tamara\...\Run: [Spotify Web Helper] => C:\Users\tamara\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-26] (Spotify Ltd)
HKU\tamara\...\Run: [Google Update] => C:\Users\tamara\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-05-11] (Google Inc.)
HKU\tamara\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
Startup: C:\Users\tamara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ritaglio schermata e avvio di OneNote 2010.lnk
ShortcutTarget: Ritaglio schermata e avvio di OneNote 2010.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-16] (Avira Operations GmbH & Co. KG)
S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-05-31] (Atheros)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
S2 HSPA USB MODEM Service; C:\Program Files (x86)\Wind Connection Manager\ApplicationController.exe [570232 2013-07-26] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 ALCATELUSB; C:\Windows\System32\Drivers\AlcatelUsb.sys [25088 2013-01-11] (Windows ® Codename Longhorn DDK provider)
S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-17] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-17] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [123776 2013-05-08] (TCT International Mobile Ltd.)
S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 vwifibus; C:\Windows\System32\DRIVERS\vwifibus.sys [24576 2009-07-13] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 
========================== Drivers MD5 =======================
 
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys FA886682CFC5D36718D3E436AACF10B9
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\System32\Drivers\AlcatelUsb.sys 913C625EB03E0F917BF934734369EC54
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\System32\drivers\AmUStor.SYS 92A848F962DA91C631147D566414BB7E
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys 4C016FD76ED5C05E84CA8CAB77993961
C:\Windows\System32\DRIVERS\asmthub3.sys 954950D11ADA98AC1B7EE3C770E4622C
C:\Windows\System32\DRIVERS\asmtxhci.sys 01DBB05DB1DB95803E3C9F2B49AFE79C
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athrx.sys DE9FB3DADE8FD39AE2C587DF22D36B8E
C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys 1F7238A37389ED92E9D8EEE975CABD54
C:\Windows\System32\DRIVERS\avgntflt.sys 1B87A1F2FA5B91AC1A7D171B8D952441
C:\Windows\System32\DRIVERS\avipbb.sys AF61774060F277FE45CBD3A9A8E7D45A
C:\Windows\System32\DRIVERS\avkmgr.sys 390184FAD8FCC1B6DA25AEBAE928C3B6
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\btath_bus.sys D6EAD8F45ECBEDE3B1ADBEE5F075E0E2
C:\Windows\system32\drivers\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4
C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys EBF28856F69CF094A902F884CF989706
C:\Windows\System32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 87CE5C8965E101CCCED1F4675557E868
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ETD.sys 4C120D2B2EA269EAE7A5744794EB6DB1
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys 6C06701BF1DB05405804D7EB610991CE
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys D7921D5A870B11CC1ADAB198A519D50A
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys 174BCAC474DE13B2650E444CF124828E
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys 718A4008EE5DA174400396B27509EF82
C:\Windows\System32\DRIVERS\IntcDAud.sys FC727061C0F47C8059E88E05D5C8E381
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\System32\DRIVERS\jrdusbser.sys 7F928D5A5D1D843AAECE688E96963575
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbfiltr.sys E63EF8C3271D014F14E2469CE75FECB4
C:\Windows\System32\Drivers\ksecdd.sys 353009DEDF918B2A51414F330CF72DEC
C:\Windows\System32\Drivers\ksecpkg.sys 41774FF331F609EF442B7398EE6202B1
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys A4A9CA24E54E81C6C3E469EAEB4B3F42
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys AE3334958D8F631FF14A0AEB3D7EFB3A
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 1A29A59A4C5BA6F8C85062A613B7E2B2
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SiSG664.sys 1BC348CF6BAA90EC8E533EF6E6A69933
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\DRIVERS\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys 70988118145F5F10EF24720B97F35F65
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys E232A3B43A894BB327FC161529BD9ED1
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\system32\drivers\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\system32\drivers\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3
C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7
C:\Windows\System32\DRIVERS\usb8023x.sys 7B28E2FBE75115660FAB31079C0A9F29
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys 7E08EFD861D2A50EABB1A98B8C9C861D
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wimfltr.sys 52DED146E4797E6CCF94799E8E22BB2A
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\System32\DRIVERS\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-02-17 20:55 - 2015-02-23 12:54 - 00000000 ____D () C:\FRST
2015-02-15 02:06 - 2015-02-15 02:07 - 00000000 ____D () C:\Users\tamara\AppData\Local\{FBECA25F-2C32-473F-A488-4908E002AD30}
2015-02-14 02:01 - 2015-02-14 02:01 - 00000000 ____D () C:\Users\tamara\AppData\Local\{BBE89A76-D730-4122-B025-88C797D36705}
2015-02-09 14:57 - 2015-02-09 14:57 - 01055936 _____ (Adobe) C:\Users\tamara\Downloads\install_flashplayer16x32_ltr5x64d_awc_aih.exe
2015-02-07 05:14 - 2015-02-07 05:14 - 00000000 ____D () C:\Users\tamara\AppData\Local\{CABE4A89-634F-40DE-9A20-CBC8CA2F95A8}
2015-02-05 05:09 - 2015-02-05 05:09 - 00000000 ____D () C:\Users\tamara\AppData\Local\{8AFD16A1-7195-4ABD-ABA6-D766942CD42D}
2015-02-04 14:09 - 2015-02-04 14:09 - 00673632 _____ () C:\Windows\Minidump\020415-19032-01.dmp
2015-01-30 04:48 - 2015-01-30 04:48 - 00000000 ____D () C:\Users\tamara\AppData\Local\{9A1E53F6-539F-4443-88CE-300E3E1887DE}
2015-01-29 11:50 - 2015-01-29 11:50 - 00000000 ____D () C:\Users\tamara\AppData\Local\{56FC3BE0-AA11-4F9A-A4D8-205DBB26B942}
2015-01-28 13:58 - 2015-01-28 13:58 - 00000000 ____D () C:\Users\tamara\AppData\Local\{4BA37C09-B395-42B3-9728-7A9DCBC61D26}
2015-01-27 10:58 - 2015-01-27 10:58 - 00000000 ____D () C:\Users\tamara\AppData\Local\{41FC8D7C-9C43-4C4E-B7B9-EB5A8E1AE816}
2015-01-27 01:44 - 2015-01-27 01:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 15:12 - 2015-01-26 15:12 - 00000000 ____D () C:\Windows\SysWOW64\IPM
2015-01-25 12:03 - 2015-01-25 12:03 - 00000000 ____D () C:\Users\tamara\AppData\Local\{BC749BB6-AFB1-4A01-A73B-35781FED6E3B}
2015-01-24 02:35 - 2015-01-24 02:35 - 00000000 ____D () C:\Users\tamara\AppData\Local\{48A8F39D-C94F-441D-A94A-39465D0D88DB}
2015-01-24 02:31 - 2015-01-24 02:31 - 00000000 ____D () C:\Users\tamara\AppData\Local\{32FBA8B9-BA34-43CB-A6A7-09FE7A2213C1}
2015-01-24 02:30 - 2015-01-24 02:30 - 00000000 ____D () C:\Users\tamara\AppData\Local\{3E521D49-5F06-415E-ABA9-ECBF784055C2}
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-02-17 20:06 - 2014-12-16 07:18 - 00000000 ____D () C:\Windows\System32\appraiser
2015-02-17 20:06 - 2014-10-16 11:59 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2015-02-17 20:06 - 2014-08-21 02:17 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 20:06 - 2014-05-09 13:42 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-02-17 20:06 - 2014-05-02 23:31 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-02-17 20:06 - 2013-01-25 12:54 - 00000000 ____D () C:\Windows\System32\Macromed
2015-02-17 20:06 - 2013-01-23 12:10 - 00000000 ____D () C:\ProgramData\Skype
2015-02-17 20:06 - 2013-01-23 00:27 - 00000000 ____D () C:\ProgramData\P4G
2015-02-17 20:06 - 2013-01-21 23:50 - 00000000 ____D () C:\users\tamara
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\SysWOW64\he-IL
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\he-IL
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-17 20:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-02-17 20:05 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration
2015-02-17 20:02 - 2013-01-23 12:10 - 00000000 ____D () C:\Users\tamara\AppData\Roaming\Skype
2015-02-17 20:01 - 2014-06-02 23:02 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-17 20:01 - 2013-01-23 05:51 - 00000000 __RHD () C:\MSOCache
2015-02-17 04:55 - 2013-10-08 04:02 - 00000000 ____D () C:\Users\tamara\Desktop\A1.1
2015-02-17 04:54 - 2013-07-21 03:16 - 00000000 ____D () C:\Users\tamara\Desktop\GRUNDTVIG
2015-02-17 04:45 - 2013-01-21 23:51 - 00000000 ___HD () C:\ASUS.DAT
2015-02-17 02:04 - 2013-02-12 05:13 - 00000000 ____D () C:\Users\tamara\Documents\file lezione cidis
2015-02-15 14:51 - 2014-11-23 04:01 - 00000000 ____D () C:\Users\tamara\Desktop\eurobag collaboration
2015-02-14 09:44 - 2013-08-16 01:33 - 00000000 ____D () C:\Windows\System32\MRT
2015-02-14 09:34 - 2013-01-23 00:01 - 01580638 _____ () C:\Windows\WindowsUpdate.log
2015-02-14 09:28 - 2013-10-13 04:15 - 00000000 ____D () C:\Users\tamara\Desktop\caterina individuale
2015-02-14 09:21 - 2011-04-12 18:33 - 00001150 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-14 09:03 - 2013-05-31 11:56 - 00001164 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000UA.job
2015-02-14 09:02 - 2014-03-09 11:32 - 00000978 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-14 07:55 - 2009-07-13 20:45 - 00018736 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-14 07:55 - 2009-07-13 20:45 - 00018736 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-14 07:48 - 2013-01-21 23:50 - 00045056 _____ () C:\Windows\System32\acovcnt.exe
2015-02-14 07:48 - 2011-04-12 18:33 - 00001146 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-14 07:47 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-14 07:47 - 2009-07-13 20:51 - 00182626 _____ () C:\Windows\setupact(87).log
2015-02-14 06:21 - 2014-06-03 23:53 - 00000000 ____D () C:\Users\tamara\AppData\Local\Adobe
2015-02-14 06:21 - 2014-03-09 11:32 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-14 06:21 - 2014-03-09 11:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-14 06:21 - 2014-03-09 11:32 - 00003916 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-14 01:39 - 2011-02-18 20:35 - 08019004 _____ () C:\Windows\System32\perfh010.dat
2015-02-14 01:39 - 2011-02-18 20:35 - 02708908 _____ () C:\Windows\System32\perfc010.dat
2015-02-14 01:39 - 2009-07-13 21:13 - 00006268 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-02-11 14:39 - 2013-01-23 06:20 - 00000000 ____D () C:\Users\tamara\Documents\pagamenti edit
2015-02-10 13:02 - 2014-09-17 13:32 - 00000000 ____D () C:\Users\tamara\AppData\Local\CrashDumps
2015-02-09 15:26 - 2013-03-15 11:43 - 00000000 ____D () C:\Users\tamara\AppData\Roaming\Spotify
2015-02-09 14:42 - 2013-03-15 11:45 - 00000000 ____D () C:\Users\tamara\AppData\Local\Spotify
2015-02-08 13:10 - 2014-09-16 13:23 - 00000000 ____D () C:\Users\tamara\Desktop\Fei Edit
2015-02-08 04:03 - 2013-05-31 11:56 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000Core.job
2015-02-08 03:58 - 2013-05-31 11:56 - 00004136 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000UA
2015-02-08 03:58 - 2013-05-31 11:56 - 00003740 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1955375020-690034-34887530-1000Core
2015-02-07 05:16 - 2011-04-12 18:33 - 00004146 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 05:16 - 2011-04-12 18:33 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 13:56 - 2015-01-17 05:55 - 00000000 ____D () C:\Users\tamara\Desktop\prils
2015-02-04 23:06 - 2009-07-13 20:51 - 00181730 _____ () C:\Windows\setupact.log
2015-02-04 14:09 - 2014-09-17 05:38 - 640786079 _____ () C:\Windows\MEMORY.DMP
2015-02-04 14:09 - 2014-09-17 05:38 - 00000000 ____D () C:\Windows\Minidump
2015-02-01 12:27 - 2014-11-30 04:03 - 00025600 _____ () C:\Users\tamara\Desktop\monte_ore_ Tamara Petriachi.xls
2015-01-30 05:46 - 2014-08-26 08:12 - 00000000 ____D () C:\Users\tamara\Desktop\SALTO TRAINING BRUXELLES
2015-01-30 05:22 - 2014-09-16 13:20 - 00000000 ____D () C:\Users\tamara\Documents\Spli
2015-01-28 13:02 - 2013-01-23 06:20 - 00000000 ____D () C:\Users\tamara\Documents\didattica
2015-01-28 00:03 - 2014-07-31 05:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
 
Some content of TEMP:
====================
C:\Users\tamara\AppData\Local\Temp\avgnt.exe
C:\Users\tamara\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\tamara\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\tamara\AppData\Local\Temp\SkypeSetup.exe
C:\Users\tamara\AppData\Local\Temp\{1EA1E374-09C0-45A5-90ED-07E501EBDB13}-39.0.2171.99_chrome_installer.exe
C:\Users\tamara\AppData\Local\Temp\{80F96A6A-E3D3-4507-A7F4-0C6C5B6F08B7}-39.0.2171.95_39.0.2171.71_chrome_updater.exe
C:\Users\tamara\AppData\Local\Temp\{A8C244B5-74CD-4C82-9323-30CCF733D8EE}-39.0.2171.95_39.0.2171.71_chrome_updater.exe
 
 
==================== Known DLLs (Whitelisted) ================
 
[2009-07-13 15:26] - [2009-07-13 17:31] - 0002560 ____A () C:\Windows\System32\NORMALIZ.dll
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
==================== Restore Points  =========================
 
Restore point made on: 2015-02-05 02:34:43
Restore point made on: 2015-02-14 09:34:39
Restore point made on: 2015-02-15 14:51:50
 
==================== BCD ================================
 
Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  it-IT
inherit                 {globalsettings}
default                 {default}
resumeobject            {8cb2d9b0-7c05-11de-842e-b4611d44fefa}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30
 
Windows Boot Loader
-------------------
identifier              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  it-IT
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {8cb2d9b0-7c05-11de-842e-b4611d44fefa}
nx                      OptIn
 
Windows Boot Loader
-------------------
identifier              {current}
device                  ramdisk=[C:]\Recovery\8cb2d9b4-7c05-11de-842e-b4611d44fefa\Winre.wim,{8cb2d9b5-7c05-11de-842e-b4611d44fefa}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\8cb2d9b4-7c05-11de-842e-b4611d44fefa\Winre.wim,{8cb2d9b5-7c05-11de-842e-b4611d44fefa}
systemroot              \windows
nx                      OptIn
winpe                   Yes
 
Resume from Hibernate
---------------------
identifier              {8cb2d9b0-7c05-11de-842e-b4611d44fefa}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  it-IT
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No
 
Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  it-IT
inherit                 {globalsettings}
badmemoryaccess         Yes
 
EMS Settings
------------
identifier              {emssettings}
bootems                 Yes
 
Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200
 
RAM Defects
-----------
identifier              {badmemory}
 
Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}
 
Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}
 
Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200
 
Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}
 
Device options
--------------
identifier              {8cb2d9b5-7c05-11de-842e-b4611d44fefa}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\8cb2d9b4-7c05-11de-842e-b4611d44fefa\boot.sdi
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 15%
Total physical RAM: 4000.13 MB
Available physical RAM: 3384.59 MB
Total Pagefile: 3998.27 MB
Available Pagefile: 3370.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:125.03 GB) (Free:52.36 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:148.06 GB) (Free:147.35 GB) NTFS
Drive f: (BENNY) (Removable) (Total:0.95 GB) (Free:0.94 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 38601C96)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=125 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=148.1 GB) - (Type=OF Extended)
 
========================================================
Disk: 1 (Size: 977.5 MB) (Disk ID: 00000000)
 
Partition: GPT Partition Type.
 
 
LastRegBack: 2015-02-03 12:26
 
==================== End Of Log ============================


#4 BrianDrab

BrianDrab

  • Malware Response Team
  • 267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:28 PM

Posted 25 February 2015 - 07:08 PM

Hi anto82 -

 

Welcome to BleepingComputer.com and Sorry for the delay in getting back to you. A few questions before we get started.

 

1. Do you have a Windows 7 Home Premium (X64) re-install CD?

2. Can you tell me exactly when this happened? Was it on the day of your original post of 2/17/2015?

3. Were you doing anything specific when it happened?

4. Were you having any sort of issues before this happened?

5. Can you tell me exactly what happens when you try to go into Safe Mode? Please ensure you let me know of any error messages, etc.

 

Thank you.



#5 BrianDrab

BrianDrab

  • Malware Response Team
  • 267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:28 PM

Posted 25 February 2015 - 07:23 PM

One more question. Do you have all of your important data backed up to another source?



#6 anto82

anto82
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 26 February 2015 - 07:32 AM

Hi Malware Response Team,

 

I've tried to fix with FRST "LastRegBack: 2015-02-03 12:26", but dosen't works. After the reboot in System Repair -> advanced options, I had no more command prompt, but only System Repair option.

 

I've booted from an ubuntu live usb, backed up on external hd, set the recovery partition active/boot and reinstalled Win7 from the recovery partition.

 

Anyway a answer yours questions:

 

1. No, only recovery partition.

2. Yes was 2015-02-17

3. This isn't my laptop, I'm recover it for a friend. She said that problems happened when attached a USB pendrive, maybe not safely removed.

4. Yes, some issues months ago solved with combofix and mbam

5. If I try normal or safe mode, start the System Repair and not solve the problems without errors.

 

So, new Win7 installed... can you suggest me more security programs? A free antivirus for personal use, Avira, AVG or Avast? CryptoPrevent? My fiend is a teacher, she use usb pendrives in public places, schools and library, some extra security tool for malware form USB devices? Anything else?

 

Thanks for your work.  :lol:



#7 BrianDrab

BrianDrab

  • Malware Response Team
  • 267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:28 PM

Posted 26 February 2015 - 08:34 AM

OK, I'm glad you got this resolved.

 

As far as free Antivirus I would suggest Microsoft Security Essentials or Avast. I personally use Microsoft Security Essentials on all my Win7 computers. Following is some more information that may be helpful.

 

1. Keeping Programs Updated
You need to ensure that any programs installed on your machine are kept current. The bad guys exploit vulnerabilities that are found in older versions of software. A very good piece of software that keeps your programs up-to-date is Secunia Personal Software Inspector (PSI). You can download and install it from here. You can read more information about this free software as well as a video walkthrough from here.
 
2. Antimalware- Preventative

Note: Let's keep Malwarebytes installed (or install it if it's not) as it's a fantastic piece of software. Malwarebytes is an anti-malware software and not an antivirus software so it won't conflict with the Antivirus that you are running. I would recommend that you open up this program, allow it to update and scan your machine at least quarterly...monthly if you can.
 
3. Crypto Warning!!!! - Complete Data Loss can occur!
There are particularly nasty infections out there at the moment that encrypt your data and hold it for ransom. You may read more about this here.
 

  • Download CryptoPrevent free for home use here following the instructions below.
  • Save the file to your desktop from the link above and then open the program by clicking Run when prompted from your browser or by going to the desktop where the file was saved and double-clicking.
  • Accept all the defaults during the install. The last screen of the install has a checkmark in "Launch CryptoPrevent". This is good and will launch the program once you click Finish.
  • You will get a prompt asking if you purchased a Product Key for Automatic Updates. You can answer No.
  • You will then be prompted to learn more about automatic updates or if you want to purchase a key. This is up to you but you don't have to.
  • You will be prompted to click OK to continue and select your protection level. Go ahead and click OK.
  • Click the Apply button to set Default protection.
  • You may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.
  • That's it. The protection is in place.

Note: The free version doesn't provide automatic updates. Periodically, you should open up the program (there is a shortcut on your desktop now) and select the Updates! menu....and select Check for Updates to see if there are any as this infection has serious consequences.
 
UpdatesV7.4.11.JPG
 

 

4. Prevent Spread of Infection via USB Drive
 
1. Download MCShield to the desktop and install. Accept all the defaults.
2. The MCShield Control Center will open at the end of the install after clicking Run.
3. Click on the scanner tab and tick Always unhide items on flash drives and click on the Apply button to save the changes.
Main.JPG

4. Plug in your USB drive and McShield will start a scan.
5. Once the scan is complete, click the Logs tab and scroll down to the bottom of the log. If it says anything other than "The drive is clean" the USB drive may have an infection..
Log.JPG

 

For more information about computer security and how to protect yourself when on the internet, please read this guide Best Practices for Safe Computing
 
OK, all the best, and stay safe!
 

 



#8 anto82

anto82
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 26 February 2015 - 10:31 AM

Ok, thanks!! You can close the topic, bye!  :thumbup2:



#9 BrianDrab

BrianDrab

  • Malware Response Team
  • 267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:28 PM

Posted 26 February 2015 - 11:41 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users