STOP: C0000135

So my laptop has just been hit by a "Stop C0000135 The program can't start because %hs is missing from your computer" error and its now stuck in a boot loop.

 

I did some research and the most frequent suggestion was to scan it with Farbar Recovery Scan Tool. So I did that, here are the logs:

 

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
Ran by SYSTEM on MININT-VB1QPUR (23-03-2017 02:10:41)
Running from f:\
Platform: Windows 7 Home Premium (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Recovery
Default: ControlSet001


==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ODDPwr] => C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe [223264 2010-04-22] (Acer Incorporated)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-26] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11046504 2010-07-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2103912 2010-07-13] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [320000 2009-04-09] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2107176 2010-03-11] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [594080 2010-07-29] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [377504 2010-07-29] (Atheros Commnucations)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-26] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-10] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-10] (Egis Technology Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [Microsoft Default Manager] => C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [MDS_Menu] => C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [205512 2017-03-18] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [262736 2017-03-18] (AVAST Software)
S2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [821792 2010-06-11] (Acer Incorporated)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-26] (Egis Technology Inc.)
S2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-16] (NTI, Inc.)
S2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [171040 2010-04-22] (Acer Incorporated)
S2 RichVideo; C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904 2010-02-03] ()
S2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S3 aswbIDSAgent; "C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [309272 2017-03-18] (AVAST Software s.r.o.)
S0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [189768 2017-03-18] (AVAST Software s.r.o.)
S0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [334600 2017-03-18] (AVAST Software s.r.o.)
S0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [48528 2017-03-18] (AVAST Software s.r.o.)
S3 aswHdsKe; C:\Windows\system32\drivers\aswHdsKe.sys [82936 2016-11-14] (AVAST Software)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [38296 2017-03-18] (AVAST Software)
S1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [32088 2017-03-18] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [126600 2017-03-18] (AVAST Software)
S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [100640 2017-03-18] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [75704 2017-03-18] (AVAST Software)
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [993608 2017-03-18] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [548928 2017-03-18] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162528 2017-03-18] (AVAST Software)
S0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [337592 2017-03-18] (AVAST Software)
S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9A4A1EEE802BF2F878EE8EAB407B21B7
C:\Windows\System32\DRIVERS\agrsm64.sys 98022774D9930ECBB292E70DB7601DF6
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\System32\drivers\AmUStor.SYS 391887990CDAA83DE5C56C3FDE966DA1
C:\Windows\system32\drivers\appid.sys 6474F8823C7188D2DA579F01FB6CED6B
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\system32\drivers\aswbidsdrivera.sys 1E6E1DA4A13081B54908E04B4BDBA55B
C:\Windows\system32\drivers\aswbidsha.sys A90FA5233DF055BBD5154E09DDACC5A3
C:\Windows\system32\drivers\aswbloga.sys 750DDA2A28B1886492527F2D864FDE72
C:\Windows\system32\drivers\aswbuniva.sys ED1492AFADFE425CB31FA789F3B5159F
C:\Windows\system32\drivers\aswHdsKe.sys 9450007630E89154884F1FDA5E56C9AF
C:\Windows\system32\drivers\aswHwid.sys 6633C8097F993B47D2464A634F87F8F4
C:\Windows\system32\drivers\aswKbd.sys 71230A8A374B5DF22D4DE9325CE5013C
C:\Windows\system32\drivers\aswMonFlt.sys 0ACB1ED63E538AB0CF3E85FF9FE2E957
C:\Windows\system32\drivers\aswRdr2.sys 4815CA800288A3C1CC35F4FDF8FDB2C1
C:\Windows\system32\drivers\aswRvrt.sys FF4B137482DC270AF9DC406B4A1010C7
C:\Windows\system32\drivers\aswSnx.sys 298827113E361F2EE68E7824BF59876F
C:\Windows\system32\drivers\aswSP.sys 300BFF5BB9F273ECC71B4C53668A5956
C:\Windows\system32\drivers\aswStm.sys C4DF85748415EC924321616A0F48F62C
C:\Windows\system32\drivers\aswVmm.sys 04817CE38098FBC16D3A925FCD3FE4A6
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\btath_flt.sys CBE61B4494165F458BD87E37181EE934
C:\Windows\System32\Drivers\AthDfu.sys 4119870B90E1B5E7797D6433D21F9216
C:\Windows\System32\DRIVERS\athrx.sys 931884F5F2D7E6973366782690BF1754
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\drivers\btath_a2dp.sys 2ECF188C1D4246EFC6419F118F7B8EC6
C:\Windows\System32\DRIVERS\btath_bus.sys A83A91D07D1FE6BBE7A9DB46CA00434B
C:\Windows\System32\DRIVERS\btath_hcrp.sys C864FF85EE16D61C2BDD5EF76824625F
C:\Windows\System32\DRIVERS\btath_lwflt.sys 701C4FD9E8F2315BB1732E24093E7E8B
C:\Windows\System32\DRIVERS\btath_rcp.sys 724C8088C96EFE7A3E63FEC21D4681C0
C:\Windows\System32\DRIVERS\btfilter.sys 6E7427156DE0F0601DC0DF42CAFF971D
C:\Windows\system32\drivers\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4
C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys 404B7DF9CA4D1CB675045AF220FF3285
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 3323F76352B0AF14B2CDC4DFBF3E980A
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys 616387BBD83372220B09DE95F4E67BBC
C:\Windows\system32\drivers\drmkaud.sys 26FE888505E5A945B0536AF9A2A27A6F
C:\Windows\System32\drivers\dxgkrnl.sys 3A9D7D464BDB3B70D7ECF689ADABBD4D
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys B6AC71AAA2B10848F57FC49D55A651AF
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys F61634BEC53F73702A10DE69F6DCAF57
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys ABBF174CB394F5C437410A788B7E404A
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys F4F91789C7C7A159CE8215C1F69F2A85
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Impcd.sys 4B6363CD4610BB848531BB260B15DFCC
C:\Windows\System32\drivers\RTKVHD64.sys CB5FD9B681AD43B560490B5283DDC1C1
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\System32\DRIVERS\k57nd60a.sys 7DBAFE10C1B777305C80BEA42FBDA710
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 3974E5264A0481600370C5BEED061DDF
C:\Windows\System32\Drivers\ksecpkg.sys 6E85615A86FE86E76DAE49BF9F227483
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys A4A9CA24E54E81C6C3E469EAEB4B3F42
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys 67050452C0118BAF2883928E6FCCFE47
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys D7ADC2B83CA0B0381F75A98351F72CEE
C:\Windows\System32\DRIVERS\mrxsmb.sys 10112D850C844606419C79EE24EE6016
C:\Windows\System32\DRIVERS\mrxsmb10.sys DCC4343B422A13B42C7678998449CE8A
C:\Windows\System32\DRIVERS\mrxsmb20.sys 46C4F5BEE8D98BB1688752EAD0ABB7C0
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mwlPSDFilter.sys 6FFECC25B39DC7652A0CEC0ADA9DB589
C:\Windows\System32\DRIVERS\mwlPSDNServ.sys 0BEFE32CA56D6EE89D58175725596A85
C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys D43BC633B8660463E446E28E14A51262
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys F7309F42555F8AAB7144A51A1F2585B0
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys E47D571FEC2C76E867935109AB2A770C
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 47B2D0B31BDC3EBE6090228E2BA3764D
C:\Windows\system32\drivers\NTIDrvr.sys 710263B44C1D1AEE07525A53401FBE48
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ED6E75158D28D33A2E2A020AC5B2B59D
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfslh.sys D5183ED285D2795491DC15BDDCBEE5AD
C:\Windows\System32\DRIVERS\Sftplaylh.sys 00F118B68C50D2206DD51634F9142B83
C:\Windows\System32\DRIVERS\Sftredirlh.sys 76A827DF5640BFE16A0CDBB4108ADECA
C:\Windows\System32\DRIVERS\Sftvollh.sys 1B4C9701645086BAB8CAFFFCE30ED284
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys F2F4B895296EE3ECCE781CC2A296A5D1
C:\Windows\System32\DRIVERS\srv2.sys FD0008BEDD2723170CCA7D61837DFD52
C:\Windows\System32\DRIVERS\srvnet.sys 63B5845D9379262083655D5C6AB8DFC5
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys CE9B5A79AEE330BC7E88C0441E5727BB
C:\Windows\System32\drivers\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\DRIVERS\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys AA77EB517D2F07A947294F260E3ACA83
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys E232A3B43A894BB327FC161529BD9ED1
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\TurboB.sys 825E7A1F48FB8BCFBA27C178AAB4E275
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\system32\drivers\UBHelper.sys 40079B0B801C5432BA435B5AD61CE6E3
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\system32\drivers\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\system32\drivers\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS D029DD09E22EB24318A8FC3D8138BA43
C:\Windows\system32\drivers\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3
C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wdcsam64.sys D0335A55E5C3F812548E18300C2ACB62
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-03-23 02:09 - 2017-03-23 02:10 - 00000000 ____D C:\FRST
2017-03-22 16:43 - 2017-03-22 16:48 - 00000000 ____D C:\Temp
2017-03-18 03:41 - 2017-03-18 03:41 - 00003480 ____N C:\bootsqm.dat
2017-03-18 03:30 - 2017-03-18 03:30 - 00000000 __SHD C:\found.002
2017-03-18 03:07 - 2017-03-18 03:07 - 309614840 _____ C:\Windows\MEMORY.DMP
2017-03-18 02:46 - 2017-03-18 02:46 - 00003914 _____ C:\Windows\System32\Tasks\Avast Emergency Update
2017-03-18 02:46 - 2017-03-18 02:43 - 00334600 _____ (AVAST Software s.r.o.) C:\Windows\System32\Drivers\aswbloga.sys
2017-03-18 02:46 - 2017-03-18 02:43 - 00309272 _____ (AVAST Software s.r.o.) C:\Windows\System32\Drivers\aswbidsdrivera.sys
2017-03-18 02:46 - 2017-03-18 02:43 - 00189768 _____ (AVAST Software s.r.o.) C:\Windows\System32\Drivers\aswbidsha.sys
2017-03-18 02:46 - 2017-03-18 02:43 - 00048528 _____ (AVAST Software s.r.o.) C:\Windows\System32\Drivers\aswbuniva.sys
2017-03-18 02:45 - 2017-03-18 02:45 - 00398408 _____ (AVAST Software) C:\Windows\System32\aswBoot.exe
2017-03-14 09:19 - 2017-03-14 09:19 - 00000000 ____D C:\Users\Acer\Desktop\msc
2017-03-14 09:11 - 2017-03-14 09:50 - 06847064 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2017-03-10 09:03 - 2017-03-10 09:03 - 00000165 _____ C:\Users\Acer\Desktop\cisla.txt
2017-03-08 10:59 - 2016-07-22 06:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\System32\poqexec.exe
2017-03-08 10:59 - 2016-07-22 06:51 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2017-03-07 07:18 - 2017-03-07 07:36 - 206810045 _____ C:\Users\Acer\Downloads\m_68b948cb91cb862c93e81a2849dec2e5.mp4
2017-03-07 07:15 - 2017-03-07 07:40 - 221658358 _____ C:\Users\Acer\Downloads\m_4d39206543a43ae833bed8c0084b5196.mp4.part
2017-03-04 11:00 - 2017-03-05 04:06 - 00000000 ____D C:\Users\Acer\Desktop\nezajem

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-03-18 03:01 - 2015-04-15 17:27 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2017-03-18 03:01 - 2015-04-15 17:27 - 00000000 ___SD C:\Windows\System32\GWX
2017-03-18 03:01 - 2015-01-07 19:29 - 00000000 ____D C:\Windows\System32\appraiser
2017-03-18 03:01 - 2014-05-07 03:16 - 00000000 ___SD C:\Windows\System32\CompatTel
2017-03-18 03:01 - 2009-07-13 23:45 - 00000000 ____D C:\Windows\ShellNew
2017-03-18 03:01 - 2009-07-13 23:45 - 00000000 ____D C:\Program Files\Windows Journal
2017-03-18 02:55 - 2013-07-24 15:31 - 00000000 ____D C:\Windows\System32\MRT
2017-03-18 02:52 - 2009-07-13 20:45 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-03-18 02:52 - 2009-07-13 20:45 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-03-18 02:49 - 2013-03-01 07:22 - 143495576 ____C (Microsoft Corporation) C:\Windows\System32\MRT.exe
2017-03-18 02:46 - 2015-05-25 14:26 - 00548928 _____ (AVAST Software) C:\Windows\System32\Drivers\aswsp.sys
2017-03-18 02:46 - 2015-05-25 14:26 - 00337592 _____ (AVAST Software) C:\Windows\System32\Drivers\aswvmm.sys
2017-03-18 02:45 - 2015-05-25 14:26 - 00547904 _____ (AVAST Software) C:\Windows\System32\Drivers\aswsp.sys.148983398942904
2017-03-18 02:45 - 2015-05-25 14:26 - 00337592 _____ (AVAST Software) C:\Windows\System32\Drivers\aswvmm.sys.148983399134806
2017-03-18 02:45 - 2015-05-25 14:26 - 00162528 _____ (AVAST Software) C:\Windows\System32\Drivers\aswStm.sys
2017-03-18 02:45 - 2015-05-25 14:26 - 00126600 _____ (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys
2017-03-18 02:45 - 2015-05-25 14:26 - 00100640 _____ (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys
2017-03-18 02:45 - 2015-05-25 14:26 - 00075704 _____ (AVAST Software) C:\Windows\System32\Drivers\aswRvrt.sys
2017-03-18 02:45 - 2015-05-25 14:26 - 00038296 _____ (AVAST Software) C:\Windows\System32\Drivers\aswHwid.sys
2017-03-18 02:44 - 2016-07-18 15:39 - 00032088 _____ (AVAST Software) C:\Windows\System32\Drivers\aswKbd.sys
2017-03-18 02:44 - 2015-05-25 14:25 - 00993608 _____ (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys
2017-03-18 02:42 - 2013-03-01 03:11 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2017-03-16 02:02 - 2016-02-29 21:12 - 00000000 ____D C:\Users\Acer\AppData\Roaming\vlc
2017-03-14 13:14 - 2015-06-26 17:15 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-03-14 09:50 - 2013-03-01 16:04 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-03-14 09:50 - 2013-03-01 16:04 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-14 09:50 - 2013-03-01 16:04 - 00004396 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-03-14 09:50 - 2013-03-01 16:04 - 00000000 ____D C:\Windows\System32\Macromed
2017-03-14 09:50 - 2010-11-24 08:22 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-03-10 22:43 - 2013-07-25 06:14 - 00000000 ____D C:\Users\Acer\AppData\Roaming\uTorrent
2017-03-10 22:35 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-03-10 05:41 - 2015-10-01 01:13 - 00000000 ____D C:\Users\Acer\Desktop\K
2017-03-09 06:15 - 2013-03-01 16:32 - 00000000 ____D C:\Users\Acer\AppData\Local\Last.fm
2017-03-09 04:07 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2017-03-08 07:34 - 2013-03-21 16:16 - 00000000 ____D C:\Users\Acer\AppData\Local\CrashDumps
2017-03-08 04:55 - 2013-03-01 11:16 - 01562800 _____ C:\Windows\System32\perfh005.dat
2017-03-08 04:55 - 2013-03-01 11:16 - 00451982 _____ C:\Windows\System32\perfc005.dat
2017-03-08 04:55 - 2009-07-13 21:13 - 00006532 _____ C:\Windows\System32\PerfStringBackup.INI
2017-03-06 04:32 - 2016-03-15 13:06 - 00000000 ____D C:\Users\Acer\Desktop\phone
2017-03-04 08:57 - 2009-07-13 19:20 - 00000000 __RHD C:\Users\Public\Libraries
2017-02-22 14:08 - 2015-03-01 05:32 - 00000000 ____D C:\Users\Acer\Desktop\Flashka bleep

==================== Known DLLs (Whitelisted) =========================


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2016-06-20 11:32] - [2016-04-08 21:53] - 3231232 ____A (Microsoft Corporation) 9DA3B83F80E205B6C601EEE1312FD0A0

C:\Windows\SysWOW64\explorer.exe
[2016-06-20 11:32] - [2016-04-08 21:44] - 2973184 ____A (Microsoft Corporation) 3DA48EA028AD771C5B71727F0C3984E9

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\dnsapi.dll => MD5 is legit
C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Association (Whitelisted) =============


==================== Restore Points =========================

Restore point date: 2016-07-10 17:48
Restore point date: 2016-09-01 18:51
Restore point date: 2016-09-05 03:04
Restore point date: 2017-03-10 05:30
Restore point date: 2017-03-10 22:42
Restore point date: 2017-03-16 02:04
Restore point date: 2017-03-23 02:09

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3766.69 MB
Available physical RAM: 3076.54 MB
Total Virtual: 3764.84 MB
Available Virtual: 3065.47 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:244.14 GB) (Free:80.29 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Nový svazek) (Fixed) (Total:221.62 GB) (Free:221.23 GB) NTFS
Drive e: (GRMC(X)FREOEM_CS_DVD) (CDROM) (Total:3.71 GB) (Free:0 GB) UDF
Drive f: (Sony_8GM) (Removable) (Total:7.26 GB) (Free:7.26 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: BE521DB5)
Partition 1: (Active) - (Size=244.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=221.6 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7.3 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=7.3 GB) - (Type=0C)

LastRegBack: 2016-05-29 17:12

==================== End of FRST.txt ============================

 

Search.txt

Farbar Recovery Scan Tool (x64) Version: 15-03-2017
Ran by SYSTEM (23-03-2017 02:14:38)
Running from f:\
Boot Mode: Recovery

================== Search Files: "services.exe;winsrv.*" =============

C:\Windows\winsxs\wow64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_60bc905e6b8364f0\winsrv.dll.mui
[2013-03-01 11:13][2013-03-01 11:13] 0008704 ____A (Microsoft Corporation) BF8AB343877C2CDD696ED42ADD5F08E7

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23543_none_150c9958cc2bd04d\winsrv.dll
[2017-03-14 10:02][2016-09-09 10:20] 0215552 ____A (Microsoft Corporation) 20EBCFD94E5F9C801354062991E7257B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23539_none_151d6b00cc1e4c66\winsrv.dll
[2017-03-14 09:59][2016-09-02 07:31] 0215552 ____A (Microsoft Corporation) B96D67F1BF78F1005B9D77EA7889F2B8

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23418_none_153208a8cc0efe06\winsrv.dll
[2016-05-10 16:03][2016-04-08 22:58] 0215552 ____A (Microsoft Corporation) E0E4D286839FC27F56A85B4710E16B6B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23392_none_14d585a6cc55485d\winsrv.dll
[2016-04-13 06:56][2016-03-17 14:58] 0215552 ____A (Microsoft Corporation) 841BF993597DCD498247684B5D3AE845

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23391_none_14d4855ccc562f06\winsrv.dll
[2016-04-13 06:49][2016-03-16 10:53] 0215552 ____A (Microsoft Corporation) C3A12C3277B625E5D6B8CC3586D7A16B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23349_none_15129748cc266e09\winsrv.dll
[2016-03-13 09:57][2016-02-10 10:56] 0215552 ____A (Microsoft Corporation) ACCB745C5952B041B548DDD879902369

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23338_none_151c66eacc1f38c1\winsrv.dll
[2016-02-10 15:49][2016-01-21 22:28] 0215552 ____A (Microsoft Corporation) 2EAE95F2308236806D0BA94A8059F072

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23334_none_151865c2cc22d365\winsrv.dll
[2016-02-10 15:51][2016-01-16 16:32] 0215552 ____A (Microsoft Corporation) 21D831EA876E381114DACFD0A002C71A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23313_none_152d0550cc13822c\winsrv.dll
[2016-01-13 08:04][2015-12-30 11:14] 0215552 ____A (Microsoft Corporation) 1B191119CA1CAABEC3D22C606577C941

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23250_none_14fec2dccc36a8c4\winsrv.dll
[2015-11-13 02:02][2015-10-19 17:12] 0215552 ____A (Microsoft Corporation) 5670C0D6F1D4D280A04D94CA482F6EE1

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23226_none_1525345ccc18ecfb\winsrv.dll
[2015-10-16 01:34][2015-10-01 10:07] 0215552 ____A (Microsoft Corporation) C3C3221BC5FF27C3747E354112671221

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23223_none_1522337ecc1ba0f6\winsrv.dll
[2015-10-16 01:31][2015-09-28 10:16] 0215552 ____A (Microsoft Corporation) FE2BB7D5CF4460551FF5A0079AAFA7FC

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23153_none_1501c1d4cc33f7a2\winsrv.dll
[2015-09-21 04:24][2015-08-04 10:12] 0215552 ____A (Microsoft Corporation) BEF290D165BE120135C21438C40E2F99

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23142_none_150b9176cc2cc25a\winsrv.dll
[2015-09-21 04:26][2015-07-22 14:04] 0215552 ____A (Microsoft Corporation) 93B05A374E8B264FE41553BAEA2DAC07

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23136_none_151a628acc210bc5\winsrv.dll
[2015-08-21 18:52][2015-07-15 10:09] 0215552 ____A (Microsoft Corporation) 9EF75B9438147AAD6A6899F76FB8B4E3

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23126_none_15253276cc18efd4\winsrv.dll
[2015-08-21 18:46][2015-07-14 19:20] 0215552 ____A (Microsoft Corporation) 3E19966F2F720A4DF6C1F2F0D483DC81

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23072_none_14eb1fcccc451906\winsrv.dll
[2015-06-11 18:27][2015-05-25 10:22] 0215552 ____A (Microsoft Corporation) 7B3C10D38F84D2D534E1565A8B17018C

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23002_none_1536cf40cc0c556f\winsrv.dll
[2015-04-25 19:04][2015-03-16 21:12] 0215552 ____A (Microsoft Corporation) C05095F6593579EA61C5E99FD264D602

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22653_none_1501e21acc33cfc4\winsrv.dll
[2014-05-16 21:42][2014-04-11 18:32] 0215552 ____A (Microsoft Corporation) BDADDE9AD8DD2BF67426C23A8874D776

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22616_none_153022a8cc10ac05\winsrv.dll
[2014-04-12 04:30][2014-03-04 03:08] 0215552 ____A (Microsoft Corporation) 9A1BEE89214174AC2862344670C42B5A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22436_none_151a7f04cc20e999\winsrv.dll
[2013-10-14 22:18][2013-08-28 18:21] 0215040 ____A (Microsoft Corporation) 516D82106CAFAE156C61C5AB627A6409

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22411_none_152b1d6acc153304\winsrv.dll
[2013-09-11 16:50][2013-08-01 22:23] 0215040 ____A (Microsoft Corporation) 99AACC82C6B8A8E976CA59CFD3C322EF

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22209_none_153debdacc05e77d\winsrv.dll
[2013-03-01 05:37][2013-01-03 21:43] 0215040 ____A (Microsoft Corporation) 5F38CFC96BCA5DD462E2B243B6E31849

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22177_none_14f039eccc407b3f\winsrv.dll
[2013-03-01 05:42][2012-11-29 21:55] 0215040 ____A (Microsoft Corporation) C2B1F6196C7FE1EA1BF827312B095D06

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22125_none_152448f4cc19bcdc\winsrv.dll
[2013-03-01 05:39][2012-10-04 09:43] 0215040 ____A (Microsoft Corporation) CC44EBC3E04E76AABE19EB4A16663E4A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19160_none_146a5625b32124eb\winsrv.dll
[2016-03-13 09:57][2016-02-11 10:49] 0215040 ____A (Microsoft Corporation) DE4812AB2E6926D0FF2423F3B774585A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19135_none_148fc75bb3044fcb\winsrv.dll
[2016-02-10 15:49][2016-01-21 22:20] 0215040 ____A (Microsoft Corporation) 96AEEE466EA56AF34AE4AD5E55DAD164

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19131_none_148bc633b307ea6f\winsrv.dll
[2016-02-10 15:51][2016-01-16 11:03] 0215040 ____A (Microsoft Corporation) 5D47F5EFC5D88116D71BA72B1D1BE118

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19110_none_14a065c1b2f89936\winsrv.dll
[2016-01-13 08:03][2015-12-30 11:02] 0215040 ____A (Microsoft Corporation) CE14A4BBF890A7D4C898CF886D145EC9

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19045_none_1484f589b30c6e95\winsrv.dll
[2015-11-13 02:02][2015-10-19 17:06] 0215040 ____A (Microsoft Corporation) FF41063E45C6238CAF48CBE6D0D6FC4B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19018_none_14a8662bb2f166c7\winsrv.dll
[2015-10-16 01:31][2015-09-28 19:11] 0215040 ____A (Microsoft Corporation) 4AD1C61152A0199E3D7F9A82C07AC629

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18939_none_1493ee7bb30084be\winsrv.dll
[2015-09-21 04:26][2015-07-22 16:03] 0215040 ____A (Microsoft Corporation) 8927015C999D55D9B4AC66000EE5343D

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18933_none_148decbfb305ecb4\winsrv.dll
[2015-08-21 18:52][2015-07-15 10:11] 0215040 ____A (Microsoft Corporation) E80CA72FA43BF258E72C408CEF9839BE

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18923_none_1498bcabb2fdd0c3\winsrv.dll
[2015-08-21 18:46][2015-07-14 19:20] 0215040 ____A (Microsoft Corporation) C5A10C9C75F8A51AD20ED0E2EC4C82A4

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18869_none_14737cd1b318db6a\winsrv.dll
[2015-06-11 18:27][2015-05-25 10:19] 0215040 ____A (Microsoft Corporation) 2313AF8D5A9CEB4A55400A01DD311A95

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18798_none_14520addb33218bf\winsrv.dll
[2015-04-25 19:04][2015-03-16 21:16] 0215040 ____A (Microsoft Corporation) EA32F4EA3AE06EDD122FBCD5A489E457

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18229_none_149eb11db2f87cbc\winsrv.dll
[2013-09-11 16:50][2013-08-01 18:14] 0215040 ____A (Microsoft Corporation) 88EDD0B34EED542745931E581AD21A32

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18043_none_14830bbdb30e2246\winsrv.dll
[2013-03-01 05:37][2013-01-03 21:46] 0215040 ____A (Microsoft Corporation) 0C27239FEA4DB8A2AAC9E502186B7264

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18015_none_14a57c15b2f40121\winsrv.dll
[2013-03-01 05:42][2012-11-29 21:45] 0215040 ____A (Microsoft Corporation) 9E479C2B605C25DA4971ABA36250FAEF

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17965_none_146f9457b31c5994\winsrv.dll
[2013-03-01 05:39][2012-10-04 09:45] 0215040 ____A (Microsoft Corporation) 72CC564BBC70DE268784BCE91EB8A28F

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17514_none_14a49c11b2f4bfec\winsrv.dll
[2013-03-12 07:31][2010-11-20 05:27] 0214016 ____A (Microsoft Corporation) E0406AEF04B088D1C49FC78D0546F689

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.21416_none_1349be0aceea4b7d\winsrv.dll
[2013-03-01 05:37][2013-01-04 06:18] 0215040 ____A (Microsoft Corporation) 7BAEFACB8C5048465B7E3D354554DA70

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.21386_none_12fe0cb0cf2311ed\winsrv.dll
[2013-03-01 05:42][2012-11-29 21:43] 0215040 ____A (Microsoft Corporation) B0F0F844BB3BA4C25837310FD0909BFD

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.21335_none_13331c02cefb6ce1\winsrv.dll
[2013-03-01 05:39][2012-10-04 09:35] 0215040 ____A (Microsoft Corporation) 7C17C4AACC79E619E6A4131F51588ED3

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.17206_none_12caef45b5c4929b\winsrv.dll
[2013-03-01 05:37][2013-01-03 21:36] 0215040 ____A (Microsoft Corporation) 3FB74FF230B5D240A57AE1C4A3D0459D

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.17179_none_12823ec9b5faa510\winsrv.dll
[2013-03-01 05:42][2012-11-29 21:49] 0215040 ____A (Microsoft Corporation) C4C551E6AB333C0EB812A3A4672E89DB

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.17135_none_12a97d51b5ddcff0\winsrv.dll
[2013-03-01 05:39][2012-10-04 09:38] 0215040 ____A (Microsoft Corporation) 4343295C52C8B1ADD906F1A37B940AA1

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.16385_none_12738849b6063c52\winsrv.dll
[2009-07-13 15:38][2009-07-13 17:41] 0214016 ____A (Microsoft Corporation) 457B44AB6D502E55F64A867D4F35C76C

C:\Windows\winsxs\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_5667e60c3722a2f5\winsrv.dll.mui
[2013-03-01 11:13][2013-03-01 11:13] 0008704 ____A (Microsoft Corporation) 8BDDD712EA078F49FD84D6078F87B5C6

C:\Windows\winsxs\amd64_microsoft-windows-winsrv-adm_31bf3856ad364e35_6.1.7600.16385_none_74fe9f3a6d505307\Winsrv.admx
[2009-06-10 12:42][2009-06-10 12:42] 0001342 ____A () B28573159BDEA736F3BDFF16604A4AD3

C:\Windows\winsxs\amd64_microsoft-windows-winsrv-adm.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7cc8314786373590\Winsrv.adml
[2013-03-01 11:14][2013-03-01 11:14] 0001577 ____A () B68735EBB518A7E636A4D4C3C40457D4

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7601.23033_none_2df8898bfd178df8\services.exe
[2015-05-20 15:23][2015-04-10 20:31] 0328704 ____A (Microsoft Corporation) 43DCEC23557C32F7702C8D5BC729738F

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7601.18829_none_2d7fe646e3ec3705\services.exe
[2015-05-20 15:23][2015-04-12 19:28] 0328704 ____A (Microsoft Corporation) 71C85477DF9347FE8E7BC55768473FCA

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19][2009-07-13 17:39] 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\SysWOW64\cs-CZ\winsrv.dll.mui
[2013-03-01 11:13][2013-03-01 11:13] 0008704 ____A (Microsoft Corporation) BF8AB343877C2CDD696ED42ADD5F08E7

C:\Windows\System32\services.exe
[2015-05-20 15:23][2015-04-12 19:28] 0328704 ____A (Microsoft Corporation) 71C85477DF9347FE8E7BC55768473FCA

C:\Windows\System32\winsrv.dll
[2016-05-10 16:03][2016-04-08 22:58] 0215552 ____A (Microsoft Corporation) E0E4D286839FC27F56A85B4710E16B6B

C:\Windows\System32\cs-CZ\winsrv.dll.mui
[2013-03-01 11:13][2013-03-01 11:13] 0008704 ____A (Microsoft Corporation) 8BDDD712EA078F49FD84D6078F87B5C6

C:\Windows\SoftwareDistribution\Download\4cd9ee4dd600ff2423b7df10c650461c\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23040_none_15098efccc2e9285\winsrv.dll
[2015-05-19 19:18][2015-04-27 11:17] 0215552 ____A (Microsoft Corporation) 4A7726EC105064BB6614A402F25D3913

C:\Windows\SoftwareDistribution\Download\4cd9ee4dd600ff2423b7df10c650461c\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18839_none_1493ec95b3008797\winsrv.dll
[2015-05-19 19:18][2015-04-27 11:23] 0215040 ____A (Microsoft Corporation) D17DD01601460F5899E5C154B3FD0BFA

X:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7600.16385_none_12738849b6063c52\winsrv.dll
[2009-07-13 15:38][2009-07-13 17:41] 0214016 ____A (Microsoft Corporation) 457B44AB6D502E55F64A867D4F35C76C

X:\Windows\winsxs\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_en-us_99be31681e1cff53\winsrv.dll.mui
[2009-07-13 19:03][2009-07-13 19:03] 0008192 ____A (Microsoft Corporation) 0E4E26AF593AC5023E55333096DDD9EA

X:\Windows\winsxs\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_5667e60c3722a2f5\winsrv.dll.mui
[2009-10-05 13:20][2009-10-05 13:20] 0008704 ____A (Microsoft Corporation) 8BDDD712EA078F49FD84D6078F87B5C6

X:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19][2009-07-13 17:39] 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

X:\Windows\System32\services.exe
[2009-07-13 15:19][2009-07-13 17:39] 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

X:\Windows\System32\winsrv.dll
[2009-07-13 15:38][2009-07-13 17:41] 0214016 ____A (Microsoft Corporation) 457B44AB6D502E55F64A867D4F35C76C

X:\Windows\System32\en-US\winsrv.dll.mui
[2009-07-13 19:03][2009-07-13 19:03] 0008192 ____A (Microsoft Corporation) 0E4E26AF593AC5023E55333096DDD9EA

X:\Windows\System32\cs-CZ\winsrv.dll.mui
[2009-10-05 13:20][2009-10-05 13:20] 0008704 ____A (Microsoft Corporation) 8BDDD712EA078F49FD84D6078F87B5C6

====== End of Search ======

 

Thanks in advance for the help.

Greetings Tomek2 and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:

• First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
• Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
• Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
• Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
• When you post your reply, use the button instead.
• In the upper right hand corner of the topic you will see the button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
• If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
• When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
• I would like to remind you to make no further changes to your computer unless I direct you to do so.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. Please allow me just a bit of time to review what you have posted.

Thanks for your continued patience.

Please do this.

===================================================

Running chkdsk /r in the Recovery Environment

--------------------

• Boot your computer into the Recovery Environment
• Select Command Prompt
• Type c: and Enter
• Type chkdsk /r and Enter
• If you receive a message about unmounting the volume check Yes
• If the program doesn't start automatically repeat the chkdsk /r command
• Once the process is finished please write down any information provided on the screen
• Attempt to reboot your computer into Normal Mode.
• If you receive a Blue Screen of Death (BSOD) please provide that information in your post.

Note: This process may take awhile to complete. You may also notice the progress bar jumping back and forth. This is normal. Please be patient.

===================================================

Running System File Checker (SFC) in the Recovery Environment

--------------------

• Boot your computer into the Recovery Environment
• Select Command Prompt
• Type the following (there is a space before each "/") after the Command Prompt and hit Enter

SFC /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\WINDOWS

• Allow the process to complete and report the results
• Attempt to boot your computer into Normal Mode, or Safe Mode

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Results?

Greetings,

===================================================

Do You Still Need Help?

It has been 3 days since my last post.

• Do you still need help with this?
• If you have not replied within 48 hours I will assume you have abandoned the Topic and it will be closed.

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.