Farbar Recovery Scan tool unsuccessful

humanatek · June 3, 2013

Hello! I initially requested help because my computer would shut down and restart itself automatically when it was in regular mode. It does not happen when it is in safe mode. I ran Malwarebytes but it did not detect any problems with my computer. Then I downloaded Farbar Recovery Scan Tool x64 onto a flashdrive and followed the instructions you sent. But my computer would not detect it. When I clicked on "try again", it would say "The device is not ready."

I thought there might be a problem with the drive so I turned on the computer on regular mode and put in another flashdrive and the computer did detect the disc in the drive then. So, I don't think it's the drive.

What can I do now?

--Thanks!

Psychotic · June 3, 2013

Put FRST64.exe on the working usb flashdrive and use that one to scan your computer.

Put the flash drive into another usb port and try again.

humanatek · June 3, 2013

My computer keeps shutting down and restarting itself. I used Piriform Ccleaner to clean up the computer and although it said it removed stuff, the computer kept shutting down and restarting, so it did not fix the problem. I used the same cleaner again and it said it removed the same stuff. So it appears that whatever is in my computer is fooling this Ccleaner.

I also tried the current version of Malwarebytes, but Malwarebytes did not detect any problems with my computer.

Then I downloaded Farbar Recovery Scan Tool onto a flashdrive and tried to clean it up that way, but that did not work. The computer would not recognize that the flashdrive was in the port.

*My computer does work on safe mode with networking capabilities, but not in regular mode.

Anything else I can try?

Psychotic · June 3, 2013

Start your computer in safe mode with networking.

Then do the following:

Step 1: Gmer

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click Yes.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

Click the Scan button and let the program do its work. GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop.

Pleae attach the gmer.txt to your reply:

Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, browse to where you saved the file, and
Click Upload.

Step 2: FRST (safe mode)

Copy the FRST.exe (or FRST64.exe) you have on your usb flash device to your desktop. Run the tool by double click and hit scan.

It will produce two logfiles - post their content here.

humanatek · June 3, 2013

Gmer.txt FRST.txt Addition.txt

Psychotic · June 3, 2013

Scan with aswMBR

Please download aswMBR.exe to your desktop.

Double-click the aswMBR.exe to run it
When prompted with The application can use the Avast! Free Antivirus for scanning >> select No
Now click on the Scan button to start scan
On completion of the scan click Save Log, save it to your desktop and post the contents in your next reply

Note: There will also be a file on your desktop named MBR.dat(or similir) do not delete this for now it is a actual backup of the MBR(master boot record).

Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.exe and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Cure. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please post the contents of that log in your next reply.

humanatek · June 4, 2013

TDSSKiller.2.8.16.0_03.06.2013_18.03.04_log.txt

aswMBR.txt

Psychotic · June 4, 2013

Scan with adwCleaner

Please download AdwCleaner to your desktop.

Run adwcleaner.exe.
Hit delete.
When the run is finished, it will open up a text file.
Please post its contents within your next reply.
You´ll find the log file at C:\AdwCleaner[s1].txt also.

When finished, do another scan run with FRST and post up the log also.

humanatek · June 5, 2013

<p>Ok, here are the results from my FRST cleaning:</p>

<div>Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-05-2013</div>

<div>Ran by De Campo at 2013-06-04 19:03:36 Run:</div>

<div>Running from J:\</div>

<div>Boot Mode: Safe Mode (with Networking)</div>

<div>==================== Installed Programs =======================</div>

<div> Update for Microsoft Office 2007 (KB2508958)</div>

<div>µTorrent (Version: 3.1.3)</div>

<div>64 Bit HP CIO Components Installer (Version: 7.2.8)</div>

<div>7500_7600_7700_Help1 (Version: 1.00.0000)</div>

<div>7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)</div>

<div>7-Zip 9.21 (Version: 9.21.00.0)</div>

<div>Adobe Flash Player 11 ActiveX 64-bit (Version: 11.2.202.233)</div>

<div>Adobe Reader X (10.1.6) (Version: 10.1.6)</div>

<div>Apple Application Support (Version: 2.3.3)</div>

<div>Apple Mobile Device Support (Version: 6.1.0.13)</div>

<div>Apple Software Update (Version: 2.1.3.127)</div>

<div>Belkin Setup and Router Monitor</div>

<div>Belkin USB Print and Storage Center (Version: 1.1.4)</div>

<div>Bing Bar (Version: 7.1.361.0)</div>

<div>Bitdefender Antivirus Free Edition (Version: 1.0.15.946)</div>

<div>Bonjour (Version: 3.0.0.10)</div>

<div>bpd_scan_Carrier (Version: 3.00.0000)</div>

<div>BPDSoftware (Version: 140.0.000.000)</div>

<div>BPDSoftware_Ini (Version: 1.00.0000)</div>

<div>BufferChm (Version: 140.0.213.000)</div>

<div>Catalina Savings Printer (Version: 1.0.0)</div>

<div>CCleaner (Version: 4.01)</div>

<div>Check Designer (Version: 1.00.000)</div>

<div>CouponBar (Version: 5.0.0.5)</div>

<div>Destinations (Version: 130.0.0.0)</div>

<div>DeviceDiscovery (Version: 140.0.213.000)</div>

<div>DocProc (Version: 140.0.100.000)</div>

<div>ezCheckPrinting (Version: 5.0.11)</div>

<div>ezPaycheck (Version: 3.3.12)</div>

<div>Fax (Version: 140.0.213.000)</div>

<div>Google Chrome (Version: 27.0.1453.94)</div>

<div>Google Desktop (Version: 5.9.1005.12335)</div>

<div>Google Earth (Version: 6.2.1.6014)</div>

<div>Google Talk (remove only)</div>

<div>GPBaseService2 (Version: 140.0.212.000)</div>

<div>HP Customer Participation Program 14.0 (Version: 14.0)</div>

<div>HP Imaging Device Functions 14.0 (Version: 14.0)</div>

<div>HP OfficeJet L7300/L7500/7600/7700 (Version: 14.0)</div>

<div>HP Smart Web Printing 4.60 (Version: 4.60)</div>

<div>HP Solution Center 14.0 (Version: 14.0)</div>

<div>HP Update (Version: 5.005.000.002)</div>

<div>HPDiagnosticAlert (Version: 1.00.0000)</div>

<div>HPProductAssistant (Version: 140.0.213.000)</div>

<div>HPSSupply (Version: 140.0.212.000)</div>

<div>iCloud (Version: 2.1.2.8)</div>

<div>iTunes (Version: 11.0.2.26)</div>

<div>Java 7 Update 7 (Version: 7.0.70)</div>

<div>Java Auto Updater (Version: 2.1.9.0)</div>

<div>Java 6 Update 31 (Version: 6.0.310)</div>

<div>JavaFX 2.1.1 (Version: 2.1.1)</div>

<div>L7700 (Version: 140.0.000.000)</div>

<div>Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)</div>

<div>MarketResearch (Version: 140.0.214.000)</div>

<div>McAfee Security Scan Plus (Version: 2.1.121.2)</div>

<div>Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)</div>

<div>Microsoft Application Error Reporting (Version: 12.0.6015.5000)</div>

<div>Microsoft IntelliPoint 8.2 (Version: 8.20.468.0)</div>

<div>Microsoft Office 2007 Service Pack 3 (SP3)</div>

<div>Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)</div>

<div>Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)</div>

<div>Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)</div>

<div>Microsoft Silverlight (Version: 5.1.20125.0)</div>

<div>Mozilla Firefox 12.0 (x86 en-US) (Version: 12.0)</div>

<div>Mozilla Maintenance Service (Version: 12.0)</div>

<div>MPM (Version: 1.00.0000)</div>

<div>MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)</div>

<div>MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)</div>

<div>MySoftware Fonts</div>

<div>Network64 (Version: 140.0.215.000)</div>

<div>Network64 (Version: 140.0.221.000)</div>

<div>NVIDIA 3D Vision Driver 311.06 (Version: 311.06)</div>

<div>NVIDIA Control Panel 311.06 (Version: 311.06)</div>

<div>NVIDIA Graphics Driver 311.06 (Version: 311.06)</div>

<div>NVIDIA Install Application (Version: 2.1002.108.688)</div>

<div>NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1106)</div>

<div>NVIDIA Update 1.11.3 (Version: 1.11.3)</div>

<div>NVIDIA Update Components (Version: 1.11.3)</div>

<div>OCR Software by I.R.I.S. 14.0 (Version: 14.0)</div>

<div>ProductContext (Version: 140.0.000.000)</div>

<div>PVSonyDll (Version: 1.00.0001)</div>

<div>QuickTime (Version: 7.73.80.64)</div>

<div>Realtek High Definition Audio Driver (Version: 6.0.1.5910)</div>

<div>Scan (Version: 140.0.167.000)</div>

<div>Shop for HP Supplies (Version: 14.0)</div>

<div>Skype™ 5.9 (Version: 5.9.114)</div>

<div>SmartWebPrinting (Version: 140.0.213.000)</div>

<div>Solid Savings (Version: 1.26.153.1)</div>

<div>SolutionCenter (Version: 140.0.214.000)</div>

<div>Status (Version: 140.0.256.000)</div>

<div>Toolbox (Version: 140.0.428.000)</div>

<div>TrayApp (Version: 140.0.213.000)</div>

<div>Unity Web Player (Version: 2.5.5b4_50)</div>

<div>Update for 2007 Microsoft Office System (KB967642)</div>

<div>Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)</div>

<div>Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)</div>

<div>Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)</div>

<div>Update for Microsoft Office 2007 Help for Common Features (KB963673)</div>

<div>Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition</div>

<div>Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition</div>

<div>Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition</div>

<div>Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition</div>

<div>Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition</div>

<div>Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition</div>

<div>Update for Microsoft Office Access 2007 Help (KB963663)</div>

<div>Update for Microsoft Office Excel 2007 Help (KB963678)</div>

<div>Update for Microsoft Office Infopath 2007 Help (KB963662)</div>

<div>Update for Microsoft Office OneNote 2007 Help (KB963670)</div>

<div>Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition</div>

<div>Update for Microsoft Office Outlook 2007 Help (KB963677)</div>

<div>Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817359) 32-Bit Edition</div>

<div>Update for Microsoft Office Powerpoint 2007 Help (KB963669)</div>

<div>Update for Microsoft Office Publisher 2007 Help (KB963667)</div>

<div>Update for Microsoft Office Script Editor Help (KB963671)</div>

<div>Update for Microsoft Office Word 2007 Help (KB963665)</div>

<div>Video Mover</div>

<div>VLC media player 2.0.1 (Version: 2.0.1)</div>

<div>WebReg (Version: 140.0.213.017)</div>

<div>Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)</div>

<div>==================== Restore Points =========================</div>

<div>21-05-2013 01:36:13 Scheduled Checkpoint</div>

<div>30-05-2013 02:10:12 Scheduled Checkpoint</div>

<div>==================== Faulty Device Manager Devices =============</div>

<div>Name: Security Processor Loader Driver</div>

<div>Description: Security Processor Loader Driver</div>

<div>Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}</div>

<div>Manufacturer: </div>

<div>Service: spldr</div>

<div>Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)</div>

<div>Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.</div>

<div>Devices stay in this state if they have been prepared for removal.</div>

<div>After you remove the device, this error disappears.Remove the device, and this error should be resolved.</div>

<div>Name: eHome Infrared Receiver (USBCIR)</div>

<div>Description: eHome Infrared Receiver (USBCIR)</div>

<div>Class Guid: {36fc9e60-c465-11cf-8056-444553540000}</div>

<div>Manufacturer: Microsoft</div>

<div>Service: usbcir</div>

<div>Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)</div>

<div>Resolution: Update the driver</div>

<div>Name: Officejet Pro L7700</div>

<div>Description: Officejet Pro L7700</div>

<div>Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}</div>

<div>Manufacturer: HP</div>

<div>Service: </div>

<div>Problem: : This device is disabled. (Code 22)</div>

<div>Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.</div>

<div>Name: Consumer IR Devices</div>

<div>Description: Consumer IR Devices</div>

<div>Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}</div>

<div>Manufacturer: Microsoft</div>

<div>Service: circlass</div>

<div>Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)</div>

<div>Resolution: Update the driver</div>

<div>Name: SXUPTP Driver</div>

<div>Description: SXUPTP Driver</div>

<div>Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}</div>

<div>Manufacturer: Belkin International, Inc.</div>

<div>Service: sxuptp</div>

<div>Problem: : Windows cannot initialize the device driver for this hardware. (Code 37)</div>

<div>Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.</div>

<div>==================== Event log errors: =========================</div>

<div>Application errors:</div>

<div>Error: (06/01/2013 09:31:35 AM) (Source: NVIDIA OpenGL Driver) (User: )</div>

<div>Description: The NVIDIA OpenGL driver lost connection with the display</div>

<div>driver due to exceeding the Windows Time-Out limit and is unable to continue.</div>

<div>The application must close.</div>

<div>Error code: 7</div>

<div>Visit http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=3007 for more information.</div>

<div>Error: (05/31/2013 11:18:01 PM) (Source: NVIDIA OpenGL Driver) (User: )</div>

<div>Description: The NVIDIA OpenGL driver detected a problem with the display</div>

<div>driver and is unable to continue. The application must close.</div>

<div>Error code: 3</div>

<div>Visit http://www.nvidia.com/page/support.html for more information.</div>

<div>Error: (05/29/2013 10:38:43 PM) (Source: NVIDIA OpenGL Driver) (User: )</div>

<div>Description: The NVIDIA OpenGL driver detected a problem with the display</div>

<div>driver and is unable to continue. The application must close.</div>

<div>Error code: 3</div>

<div>Visit http://www.nvidia.com/page/support.html for more information.</div>

<div>Error: (05/29/2013 09:47:11 PM) (Source: Application Hang) (User: )</div>

<div>Description: The program PhotoScreensaver.scr version 6.1.7601.17514 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.</div>

<div>Process ID: 146c</div>

<div>Start Time: 01ce5cdfb708ea92</div>

<div>Termination Time: 20</div>

<div>Application Path: C:\Windows\system32\PhotoScreensaver.scr</div>

<div>Report Id: f4380d42-c8e3-11e2-90f5-001e8c5c64ae</div>

<div>Error: (05/20/2013 08:43:10 PM) (Source: Application Hang) (User: )</div>

<div>Description: The program chrome.exe version 26.0.1410.64 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.</div>

<div>Process ID: 1298</div>

<div>Start Time: 01ce55d469c3c07c</div>

<div>Termination Time: 1821</div>

<div>Application Path: C:\Users\De Campo\AppData\Local\Google\Chrome\Application\chrome.exe</div>

<div>Report Id: 7ed19460-c1c8-11e2-a797-001e8c5c64ae</div>

<div>Error: (05/20/2013 04:24:25 PM) (Source: Microsoft Security Client Setup) (User: DeCampo-PC)</div>

<div>Description: HRESULT:0x8004FF0A</div>

<div>Description:Security Essentials is still installed on your computer.. Security Essentials was not removed from your computer. It will continue to monitor your computer and help protect it from potential threats. Error code:0x8004FF0A.</div>

<div>Error: (05/20/2013 04:05:43 PM) (Source: Microsoft Security Client Setup) (User: DeCampo-PC)</div>

<div>Description: HRESULT:0x8004FF11</div>

<div>Description:Can’t install Microsoft Security Essentials on a computer running in safe mode. Your computer is currently running in safe mode. To install Security Essentials, your computer must be running in normal mode. Please restart your computer in normal mode, and then try to run the Security Essentials Setup Wizard again. Error code:0x8004FF11.</div>

<div>Error: (05/19/2013 10:42:03 PM) (Source: Windows Search Service) (User: )</div>

<div>Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.</div>

<div>Details:</div>

<div>The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)</div>

<div>Error: (05/19/2013 10:42:03 PM) (Source: Windows Search Service) (User: )</div>

<div>Description: The index cannot be initialized.</div>

<div>Details:</div>

<div>The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)</div>

<div>Error: (05/19/2013 10:42:03 PM) (Source: Windows Search Service) (User: )</div>

<div>Description: The application cannot be initialized.</div>

<div>Context: Windows Application</div>

<div>Details:</div>

<div>The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)</div>

<div>System errors:</div>

<div>Error: (06/04/2013 07:02:33 PM) (Source: Service Control Manager) (User: )</div>