Cryptowall, dns problem

[cistern_eve]

Dear Kevin,

 

I ran the services repair tool and then ran FSS again. I have pasted the log below.

 

Thank you again for all of your help. What is the next step?

 

Regards,

CE

 

 

 

****

 

Farbar Service Scanner Version: 10-06-2014
Ran by Administrator (administrator) on 26-06-2014 at 09:35:52
Running from "C:\Users\jane_delgavio\Downloads"
Microsoft Windows 7 Professional  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

[kevinf80]

Go here: http://support.microsoft.com/kb/971058 run the appropriate "Fixit" for Windows 7. Re-boot your PC, check if Windows Update service will run/check for updates....

 

When complete let me know if you have any remaining issues or concerns....

 

Kevin

[cistern_eve]

Dear Kevin,

 

After this fixit runs, the report is a mixed bag. The result has been pasted below.

 

Checking for updates finds new updates but fails to install them with "unknown error" code 80246007

 

Thank you for your help!

 

CE

 

**

 

Windows Update

Publisher details

Issues found

Problems installing recent updates

Problems installing recent updates

Not fixed

Repair Windows Update

Completed

Problems installing recent updates

Problems installing recent updates

Not fixed

Repair Windows Update

Completed

Check for missing or corrupt files

Check for missing or corrupt files

Detected

Repair missing or corrupt files

Completed

Some security settings are missing or have been changed

Some security settings are missing or have been changed

Fixed

Reset security settings

Completed

Service registration is missing or corrupt

Service registration is missing or corrupt

Fixed

Reset service registration

Completed

Windows Update error 0x8024402C(2014-06-26-T-04_01_04P)

Windows Update error 0x8024402C(2014-06-26-T-04_01_04P)

Fixed

Resetting Windows Update data store

Completed

Potential issues that were checked

Windows Update environment variables are incorrect

Windows Update environment variables are incorrect

Issue not present

 

Windows Update services are not running

Windows Update services are not running

Issue not present

 

Cryptographic service components are not registered

Cryptographic service components are not registered

Issue not present

 

Issues found

 

 

 

5

Problems installing recent

 

 

 

Error Report

RootCause: RC_DataStore ErrorCode: 0x8024402C TimeDetected: 2014-06-26-T-04:01:04P

Collected File

File Name: CheckSURLog.cab Collection information Computer Name: WEE_FN_ADMIN10 Windows Version:

6.1

Architecture:

amd64

Time:

Thursday, June 26, 2014 4:00:46 PM

Publisher details

Background Intelligent Transfer Service Find and fix problems that may prevent background downloads from working Package Version:

1.2.1.20131113

Publisher:

Microsoft Corporation

Windows Update Find and fix problems with Windows Update Package Version:

8.1.1.20131113

Publisher:

Microsoft Corporation

Windows Update Find and fix problems with Windows Update Package Version:

8.1.1.20131113

Publisher:

Microsoft Corporation

 

[kevinf80]

1. Open Windows Update by clicking the Start button . In the search box, type Update, and then, in the list of results, click Windows Update.

2. In the left pane, click Check for updates, and then wait while Windows looks for the latest updates for your computer.

If updates are found, click Install updates.

Read and accept the license terms, and then click Finish if the update requires it.  If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

What happens, were updates found/installed?

[cistern_eve]

Dear Kevin,

 

After Windows Update looks for updates, it lists 11 updates, of which 2 are "important" and 9 are "optional"--there are details on the content of each update, as normal. Clicking on install results in a pause and then an error message ( "unknown error" code 80246007 ) and the updates are not installed. The details on the error are what I pasted into my previous post.

 

It looks like this error relates the Background Intelligent Transfer Service:

 

http://windows.microsoft.com/en-us/windows/windows-update-error-80246007#1TC=windows-7

 

The fixit that you linked to actually gave the option to "fix" either Windows Update or BITS within one of the dialogue boxes. Should I run it again and select BITS this time?

 

Thank you.

 

Regards,

CE

 

 

[kevinf80]

Yes please, when that is done run FSS one more time from an admin account and post the log..

[cistern_eve]

_{Dear Kevin,}

 

_{This windows fixit fails also with windows update error0x80070057}

 

It says "repair missing or corrupt files. SFC Output: Windows Resource Protection could not start the repair service."

 

When I run windows update, it finds the same 11 updates. When I attempt to install them, it fails with the same error code as before.

 

I pasted the FSS log below.

 

Thank you for your help!

 

CE

 

******

 

Farbar Service Scanner Version: 10-06-2014
Ran by Administrator (administrator) on 27-06-2014 at 14:03:47
Running from "C:\Users\jane_delgavio\Downloads"
Microsoft Windows 7 Professional  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

[kevinf80]

Run the windows update trouble shooter from here: http://windows.microsoft.com/en-US/windows7/Open-the-Windows-Update-troubleshooter does that make any difference?

[kevinf80]

The infected PC already has Windows 7 operating system, where does windows xp run?

 

Files that have been encrypted by Cryptowall are not recoverable unless you pay the ransom for the Key. Probably the best option is to Reformat and Re-install the OS..  Or continue as follows

 

See if you can run the following:

 

download Portable Windows Repair (all in one) from one of the following:

 

http://www.tweaking.com/content/page/windows_repair_all_in_one.html

http://www.majorgeeks.com/Tweaking.com_-_Windows_Repair_Portable_d7222.html

http://www.bleepingcomputer.com/download/windows-repair-all-in-one-portable/

 

Unzip the contents into a newly created folder on your desktop.

 

Open the folder, run the tool by right click on Repair_Windows (icon with red briefcase) select "Run as Administrator"

 

 

 

 

From the main GUI do the following:

 

 

Select Tab 3 and allow it to run Disk check

 

 

 

 

Select Tab 4 and allow it to run SFC

 

 

 

 

Select Tab 5 and Create System Restore Point

 

 

 

 

Select Start Repairs tab => Click the Start

 

 

 

 

The repairs window will open, Check the boxes as indicated, also the "Restart" option, then select Start...

 

 

 

 

DON'T use the computer while each scan is in progress.

 

Post the log, to access select "settings" tab > "open log folder" tab, log will be named _Windows_Repair_Log

 

Kevin...

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

[AdvancedSetup]

Topic reopened per user request

[kevinf80]

What is the current status, what issues or concerns remain?

[cistern_eve]

Dear Kevin,

 

Thank you for your help!

 

Windows update still fails with Error code 80070663 after running the windows update troubleshooter you suggested above.

 

The issue after windows update is data recovery. Would PhotoRec help? Do you have program suggestions? Or should this wait until windows update is fixed?

 

Thank you again

 

CE

[kevinf80]

select start > into the search box type or copy and paste services.msc select ok or tap enter...

 

The services window will open, scroll to Cryptographic Services Can you check and see what the "Status" and "Start up"  are. They should be status = "running" and Start up = "Automatic"

 

Is that correct...

[cistern_eve]

Dear Kevin,

Under Cryptographic services, it lists

Status = Started

Startup type = Automatic

Thank you!

[kevinf80]

Can you get the KB numbers of the failed updates, instructions here: http://www.sevenforums.com/tutorials/24367-windows-update-view-update-history-details.html

[cistern_eve]

Dear Kevin,

They are

KB2878281

KB2880971

Thank you!

CE

[kevinf80]

Those two updates are for MS Office, run the following repair relevant to your version of windows and MS Office 2010:

 

http://office.microsoft.com/en-us/excel-help/repair-office-programs-HA010357402.aspx

 

Re-boot when complete then try widows update once more. If the updates fail again it will be beneficial to Uninstall MS office, reboot then reinstall MS office, reboot again. Update once more.....

 

Kevin

[cistern_eve]

Dear Kevin,

 

The updates still failed after running the linked tool, so I uninstalled and then reinstalled the MS office programs.

 

When MS office was uninstalled, windows update would run successfully. When I reinstalled, 43 updates were found (relating to MS office 2010), which were installed successfully.

 

However, after all of that, running windows update still fails for 2 updates that are found, with the same KB numbers:

 

KB2880971 (security update for MS office)

KB2878281 (MS filter pack 2.0)

 

Thank you for your help!

CE

[cistern_eve]

postscript: Windows update fails with code 80070663.

[kevinf80]

Run this please and post its log..

 

Please download VEW by Vino Rosso  from HERE and save it to your Desktop.

• 
  

Double-click VEW.exe. to start, Vista and Windows 7 users Right Click and select "Run as Administrator"
Under 'Select log to query...check the boxes for both Application and System.
Under 'Select type to list... select both Error and Critical.
Click the radio button for 'Number of events...Type 10 in the 1 to 20 box.
Then click the Run button.
Notepad will open with the output log. It will take a couple of minutes to generate the log, please be patient.

 

Please post the Output log in your next reply.

[cistern_eve]

Dear Kevin,

 

That log is below.

 

Thank you!

 

CE

 

*******

 

 

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 23/07/2014 10:08:58 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 21/07/2014 6:42:14 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x0000000000000000 Faulting process id: 0xae0 Faulting application start time: 0x01cfa5136cafd8e4 Faulting application path: C:\Windows\Explorer.EXE Faulting module path: unknown Report Id: bb4ec6b2-1106-11e4-a39a-0020188cf1d7

Log: 'Application' Date/Time: 16/07/2014 1:49:04 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4 Faulting module name: DUI70.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdf25 Exception code: 0xc0000005 Fault offset: 0x00000000000010c5 Faulting process id: 0xbd8 Faulting application start time: 0x01cfa0fa820ac9a0 Faulting application path: C:\Windows\Explorer.EXE Faulting module path: C:\Windows\system32\DUI70.dll Report Id: f29f5f2b-0cef-11e4-bfd0-0020188cf1d7

Log: 'Application' Date/Time: 03/07/2014 1:48:51 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_esa.cab. Verify that the file exists and that you can access it.

Log: 'Application' Date/Time: 03/07/2014 1:48:39 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_zta.cab. Verify that the file exists and that you can access it.

Log: 'Application' Date/Time: 03/07/2014 1:48:28 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_zha.cab. Verify that the file exists and that you can access it.

Log: 'Application' Date/Time: 03/07/2014 1:48:17 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_tra.cab. Verify that the file exists and that you can access it.

Log: 'Application' Date/Time: 03/07/2014 1:48:06 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_rua.cab. Verify that the file exists and that you can access it.

Log: 'Application' Date/Time: 03/07/2014 1:47:54 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_msa.cab. Verify that the file exists and that you can access it.

Log: 'Application' Date/Time: 03/07/2014 1:47:44 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_koa.cab. Verify that the file exists and that you can access it.

Log: 'Application' Date/Time: 03/07/2014 1:47:33 PM
Type: Error Category: 0
Event: 11311 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2014 -- Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\ProgramData\AVG2014\SetupBackup\lng_ida.cab. Verify that the file exists and that you can access it.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 23/07/2014 7:00:41 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition.

Log: 'System' Date/Time: 23/07/2014 7:00:41 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition.

Log: 'System' Date/Time: 22/07/2014 1:26:08 PM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition.

Log: 'System' Date/Time: 22/07/2014 1:26:08 PM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition.

Log: 'System' Date/Time: 22/07/2014 1:23:48 PM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition.

Log: 'System' Date/Time: 22/07/2014 1:23:48 PM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition.

Log: 'System' Date/Time: 22/07/2014 7:10:31 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition.

Log: 'System' Date/Time: 22/07/2014 7:04:08 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80070663: Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition.

Log: 'System' Date/Time: 21/07/2014 6:44:14 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The NVIDIA Update Service Daemon service failed to start due to the following error:  The service did not start due to a logon failure.

Log: 'System' Date/Time: 21/07/2014 6:44:14 PM
Type: Error Category: 0
Event: 7038 Source: Service Control Manager
The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:  Logon failure: the specified account password has expired.  To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
 

[kevinf80]

Download Portable Windows Repair (all in one) from one of the following:

 

http://www.tweaking.com/content/page/windows_repair_all_in_one.html

http://www.majorgeeks.com/Tweaking.com_-_Windows_Repair_Portable_d7222.html

http://www.bleepingcomputer.com/download/windows-repair-all-in-one-portable/

 

Unzip the contents into a newly created folder on your desktop.

 

Open the folder, run the tool by right click on Repair_Windows (icon with red briefcase) select "Run as Administrator"

 

 

 

From the main GUI do the following:

 

 

Select Tab 5 and Create System Restore Point

 

 

 

 

Select Start Repairs tab => Click the Start

 

 

 

 

The repairs window will open, Check the boxes as indicated, also the "Restart" option, then select Start...

 

 

 

 

DON'T use the computer while each scan is in progress.

 

Post the log, to access select "settings" tab > "open log folder" tab, log will be named _Windows_Repair_Log

 

 

 

 

Let me see that log, also give windows update another try...

[cistern_eve]

Dear Kevin,

 

I have posted the log below. I am running windows update again and will post results when it finishes.

 

 

Thank you!

CE

 

 

 

******

 

System Variables
--------------------------------------------------------------------------------
OS: Windows 7 Professional
OS Architecture: 64-bit
OS Version: 6.1.7601
OS Service Pack: Service Pack 1
Computer Name: WEE_FN_ADMIN10
Windows Drive: C:\
Windows Path: C:\Windows
Program Files: C:\Program Files
Program Files (x86): C:\Program Files (x86)
Current Profile: C:\Users\Administrator
Current Profile SID: S-1-5-21-2990107124-1154940266-691022547-500
Current Profile Classes: S-1-5-21-2990107124-1154940266-691022547-500_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\Administrator\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 02 Days 00:57:09

Process Count: 76
Commit Total: 2.07 GB
Commit Limit: 15.99 GB
Commit Peak: 2.93 GB
Handle Count: 26517
Kernel Total: 504.72 MB
Kernel Paged: 417.84 MB
Kernel Non Paged: 86.88 MB
System Cache: 5.71 GB
Thread Count: 998
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 8.00 GB
Memory Used: 1.90 GB(23.7227%)
Memory Avail.: 6.10 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 8.00 GB
Memory Used: 1.60 GB(19.9763%)
Memory Avail.: 6.40 GB
--------------------------------------------------------------------------------

Starting Repairs...
   Started at (7/23/2014 3:41:35 PM)

01 - Reset Registry Permissions 01/03
   HKEY_CURRENT_USER & Sub Keys
   Start (7/23/2014 3:41:51 PM)
   Running Repair Under Current User Account
   Done (7/23/2014 3:41:55 PM)

01 - Reset Registry Permissions 02/03
   HKEY_LOCAL_MACHINE & Sub Keys
   Start (7/23/2014 3:41:55 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:45:36 PM)

01 - Reset Registry Permissions 03/03
   HKEY_CLASSES_ROOT & Sub Keys
   Start (7/23/2014 3:45:36 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:47:51 PM)

02 - Reset File Permissions: C:
   C: & Sub Folders
   Start (7/23/2014 3:47:51 PM)
   Running Repair Under Current User Account
   Done (7/23/2014 3:47:57 PM)

02 - Reset File Permissions: D:
   D: & Sub Folders
   Start (7/23/2014 3:47:57 PM)
   Running Repair Under Current User Account
   Done (7/23/2014 3:48:00 PM)

02 - Reset File Permissions: E:
   E: & Sub Folders
   Start (7/23/2014 3:48:00 PM)
   Running Repair Under Current User Account
   Done (7/23/2014 3:48:03 PM)

02 - Reset File Permissions: G:
   G: & Sub Folders
   Start (7/23/2014 3:48:04 PM)
   Running Repair Under Current User Account
   Done (7/23/2014 3:48:42 PM)

02 - Reset File Permissions: Q:
   Q: & Sub Folders
   Start (7/23/2014 3:48:42 PM)
   Running Repair Under Current User Account
   Done (7/23/2014 3:48:47 PM)

02 - Reset File Permissions: All Profiles
   C:\Users & Sub Folders
   Start (7/23/2014 3:48:47 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:50:18 PM)

02 - Reset File Permissions: Current Profile
   C:\Users\Administrator & Sub Folders
   Start (7/23/2014 3:50:18 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:50:49 PM)

02 - Reset File Permissions: Cleanup
   Repairing Restricted Folders Permissions To Avoid Infinite Loops
   Start (7/23/2014 3:50:49 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:51:02 PM)

03 - Reset Service Permissions
   Start (7/23/2014 3:51:03 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:52:31 PM)

04 - Register System Files
   Start (7/23/2014 3:52:31 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:53:48 PM)

05 - Repair WMI
   Start (7/23/2014 3:53:48 PM)

   Starting Security Center So We Can Export The Security Info.

   Exporting Antivirus Info...
   AVG AntiVirus Free Edition 2014 Exported.

   Exporting AntiSpyware Info...
   Windows Defender Exported.
   Spybot - Search and Destroy Exported.
   AVG AntiVirus Free Edition 2014 Exported.

   Exporting 3rd Party Firewall Info...
   AVG Internet Security 2014 Exported.

   Running Repair Under Current User Account
   Done (7/23/2014 3:55:08 PM)

06 - Repair Windows Firewall
   Start (7/23/2014 3:55:08 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:56:16 PM)

07 - Repair Internet Explorer
   Start (7/23/2014 3:56:16 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:57:02 PM)

08 - Repair MDAC/MS Jet
   Start (7/23/2014 3:57:02 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:57:19 PM)

09 - Repair Hosts File
   Start (7/23/2014 3:57:20 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:57:26 PM)

10 - Remove Policies Set By Infections
   Start (7/23/2014 3:57:26 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:57:37 PM)

11 - Repair Start Menu Icons Removed By Infections
   Start (7/23/2014 3:57:37 PM)
   Running Repair Under System Account
   Done (7/23/2014 3:57:49 PM)

12 - Repair Icons
   Start (7/23/2014 3:57:50 PM)
   Running Repair Under Current User Account
   Done (7/23/2014 3:57:53 PM)

13 - Repair Winsock & DNS Cache
   Start (7/23/2014 3:57:53 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:58:21 PM)

15 - Repair Proxy Settings
   Start (7/23/2014 3:58:21 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:58:34 PM)

17 - Repair Windows Updates
   Start (7/23/2014 3:58:34 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:59:06 PM)

18 - Repair CD/DVD Missing/Not Working
   Start (7/23/2014 3:59:06 PM)
   iTunes not found, not applying UpperFilters iTunes Reg Key
   Done (7/23/2014 3:59:06 PM)

19 - Repair Volume Shadow Copy Service
   Start (7/23/2014 3:59:06 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:59:33 PM)

21 - Repair MSI (Windows Installer)
   Start (7/23/2014 3:59:33 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 3:59:53 PM)

23.01 - Repair bat Association
   Start (7/23/2014 3:59:53 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:00:03 PM)

23.02 - Repair cmd Association
   Start (7/23/2014 4:00:03 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:00:12 PM)

23.03 - Repair com Association
   Start (7/23/2014 4:00:12 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:00:22 PM)

23.04 - Repair Directory Association
   Start (7/23/2014 4:00:22 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:00:30 PM)

23.05 - Repair Drive Association
   Start (7/23/2014 4:00:30 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:00:40 PM)

23.06 - Repair exe Association
   Start (7/23/2014 4:00:40 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:00:56 PM)

23.07 - Repair Folder Association
   Start (7/23/2014 4:00:56 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:01:04 PM)

23.08 - Repair inf Association
   Start (7/23/2014 4:01:04 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:01:13 PM)

23.09 - Repair lnk (Shortcuts) Association
   Start (7/23/2014 4:01:13 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:01:23 PM)

23.10 - Repair msc Association
   Start (7/23/2014 4:01:23 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:01:32 PM)

23.11 - Repair reg Association
   Start (7/23/2014 4:01:32 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:01:42 PM)

23.12 - Repair scr Association
   Start (7/23/2014 4:01:42 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:01:51 PM)

24 - Repair Windows Safe Mode
   Start (7/23/2014 4:01:51 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:02:02 PM)

25 - Repair Print Spooler
   Start (7/23/2014 4:02:02 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:02:43 PM)

26 - Restore Important Windows Services
   Start (7/23/2014 4:02:43 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:02:59 PM)

27 - Set Windows Services To Default Startup
   Start (7/23/2014 4:02:59 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:04:03 PM)

31 - Repair Windows 'New' Submenu
   Start (7/23/2014 4:04:03 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/23/2014 4:04:11 PM)

Cleaning up empty logs...

All Selected Repairs Done.
   Done at (7/23/2014 4:04:11 PM)
   Total Repair Time: 00:23:13


...YOU MUST RESTART YOUR SYSTEM...
   Running Repair Under Current User Account
 

[cistern_eve]

PS -- windows update fails, saying that I could not search for new updates. There is nothing in the history.