Jump to content

can't run Malwarebytes

kelliae

By kelliae
in Resolved Malware Removal Logs

 Share

Recommended Posts

kelliae

kelliae

Posted
Posted

Hi all, this morning my internet shut down due to a malicious threat - then started acting strangly the i could not run Malwarebytes of Chameleon, i posted in another forum who told me to run Farbar then post my results here - so here goes...

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by kellie at 2015-01-29 15:25:45
Running from C:\Users\kellie\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3 Stars of Destiny (HKLM-x32\...\3 Stars of Destiny) (Version:  - )
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.2.202.223 - Adobe Systems Incorporated)
Adobe Reader X (10.1.2) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.2 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
Ahriman's Prophecy (HKLM-x32\...\Ahriman's Prophecy) (Version: 1.0 - Amaranth Games)
Apple Application Support (HKLM-x32\...\{63EC2120-1742-4625-AA47-C6A8AEC9C64C}) (Version: 2.2.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)
Asguaard (HKLM-x32\...\Asguaard) (Version:  - )
Aveyond I - Rhen's Quest (HKLM-x32\...\Aveyond I - Rhen's Quest) (Version:  - Amaranth Games, LLC)
Aveyond II - Ean's Quest (HKLM-x32\...\Aveyond II - Ean's Quest) (Version:  - Amaranth Games, LLC)
Aveyond III - Gates of Night (HKLM-x32\...\Aveyond III - Gates of Night) (Version:  - Amaranth Games, LLC)
Aveyond III - Lord of Twilight (HKLM-x32\...\Aveyond III - Lord of Twilight) (Version:  - Amaranth Games, LLC)
Big Fish: Game Manager (HKLM-x32\...\BFGC) (Version: 3.2.0.7 - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broken Sword - Director's Cut (HKLM-x32\...\GOGPACKBROKENSWORD1DC_is1) (Version: 2.0.0.10 - GOG.com)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.3.5010 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Disk Speedup (HKLM-x32\...\{FC7E771F-8170-4573-825D-EDB6723C804F}_is1) (Version:  - Systweak Software)
Dreamscape (HKLM-x32\...\Dreamscape) (Version:  - )
Duplicate Cleaner Free 3.0.1 (HKLM-x32\...\Duplicate Cleaner Free) (Version: 3.0.1 - DigitalVolcano) <==== ATTENTION
Ella's Hope (HKLM-x32\...\BFG-Ella's Hope) (Version:  - )
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{7DA9DD7F-F4D9-40FB-BD27-69B7731DEDD9}) (Version: 5.1.3 - Hewlett-Packard)
GOG.com Downloader version 3.5.6 (HKLM-x32\...\{456A5815-604D-4D72-94DF-346D2B978A59}_is1) (Version: 3.5.6 - GOG.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{D4C4A751-F7F3-4DCA-B825-9AC391BFFC3F}) (Version: 1.0.19.76 - Google)
Heroes of Might and Magic 2 GOLD (HKLM-x32\...\Heroes of Might and Magic 2 GOLD_is1) (Version:  - GOG.com)
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{DB183033-C2DD-4A37-B43C-943DD4B28C77}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Launch Box (HKLM\...\{5A847522-375C-4D05-BD3D-88C450CC047F}) (Version: 1.1.5 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{7E799992-5DA0-4A1A-9443-B1836B063FEC}) (Version: 1.4.8 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15430.4033 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D63F6B96-86C6-4EE9-9494-AD71749242E5}) (Version: 4.5.6.1 - Hewlett-Packard Company)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)
Intel® OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2653 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
iTunes (HKLM\...\{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}) (Version: 10.7.0.21 - Apple Inc.)
Laxius Force (HKLM-x32\...\Laxius Force) (Version:  - )
Laxius Force II (HKLM-x32\...\Laxius Force II) (Version:  - )
Laxius Force III (HKLM-x32\...\Laxius Force III) (Version:  - )
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Millennium (HKLM-x32\...\Millennium) (Version:  - )
Millennium 2 (HKLM-x32\...\Millennium 2) (Version:  - )
Millennium 3 (HKLM-x32\...\Millennium 3) (Version:  - )
Millennium 4 (HKLM-x32\...\Millennium 4) (Version:  - )
Millennium 5 (HKU\S-1-5-21-1516264957-1895696595-2632153551-1001\...\Millennium 5) (Version:  - )
Moonchild (HKLM-x32\...\Moonchild) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Ralink RT5390R 802.11b/g/n 1x1 Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 3.02.07.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.51.116.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6577 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29005 - Realtek Semiconductor Corp.)
Skyborn (HKLM-x32\...\BFG-Skyborn) (Version:  - )
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.1.0 - Synaptics Incorporated)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points  =========================

19-11-2014 14:39:09 Scheduled Checkpoint
26-11-2014 19:40:36 Scheduled Checkpoint
04-12-2014 15:41:12 Scheduled Checkpoint
08-12-2014 18:11:32 Cleaner (Spybot - Search & Destroy 2.4, administrator privileges
16-12-2014 10:34:17 Scheduled Checkpoint
23-12-2014 11:35:37 Scheduled Checkpoint
30-12-2014 22:19:52 Scheduled Checkpoint
07-01-2015 11:59:55 Scheduled Checkpoint
14-01-2015 12:00:32 Scheduled Checkpoint
22-01-2015 19:40:07 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 13:34 - 2014-10-11 00:43 - 00450709 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com

There are 1000 more lines.

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {138405A3-EAD3-44A0-8D29-D4C041D9F885} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Task: {16A62207-AE17-47A4-AB37-9DE1E9B006DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-15] (Hewlett-Packard)
Task: {5A23B37F-1155-4422-BD9F-CFA88D4816DF} - System32\Tasks\{D139FAEE-F7A1-4195-AB9C-509921B7DC00} => C:\Program Files (x86)\Ahriman's Prophecy\RPG_RT.exe [2004-03-07] ()
Task: {6580008E-6063-478B-9EDD-EB390FB7538B} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {755AEFB5-C3B1-490B-8825-6EFFE6076752} - System32\Tasks\{0BBA1E77-601E-121A-9E23-DE192913D63D} => C:\Users\kellie\AppData\Roaming\MQOCdNSk\KoZZgZBa\hEngcpNp\SXclzaICO.exe
Task: {97C29D65-6DA7-4BE8-A69B-6F1E82A1072F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {99E109CF-13BE-4B5A-9589-EDE87AEB71F7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-07] (Google Inc.)
Task: {B5A17322-016B-485F-B652-4FDB8178A7CF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {BA0D353D-DC51-43F3-BEED-0BBA790F9239} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {C4E0E3E7-0887-4A80-BFB6-CB00FFD7CAC6} - System32\Tasks\HPCeeScheduleForkellie => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C75BE10C-B636-4033-84F1-45AB83B5D6F7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-02-11] (CyberLink)
Task: {D19D60A9-28DC-41E9-982B-6717816D07DA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-16] (Adobe Systems Incorporated)
Task: {D2F426E7-892D-402D-8A51-9087E2CAA4A9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-07] (Google Inc.)
Task: {D4A1CDF1-5599-4F31-942E-3269E41F3C7C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {E8109E4B-48DE-4759-B608-C48AF4965224} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForkellie.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2012-02-15 04:53 - 2012-02-15 04:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-09 01:09 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-09-09 01:09 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-09-09 01:09 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-09-09 01:09 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-09-09 01:09 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-06-29 02:03 - 2013-06-29 02:03 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\8b857add6394c98128874eb2579534e5\IsdiInterop.ni.dll
2012-08-18 08:53 - 2011-11-30 14:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2012-08-18 08:57 - 2012-02-08 12:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:08DB0309
AlternateDataStreams: C:\ProgramData\Temp:0D5C92DB
AlternateDataStreams: C:\ProgramData\Temp:0EABC438
AlternateDataStreams: C:\ProgramData\Temp:12169ADE
AlternateDataStreams: C:\ProgramData\Temp:13A52F9B
AlternateDataStreams: C:\ProgramData\Temp:15A1EB41
AlternateDataStreams: C:\ProgramData\Temp:1E138C75
AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
AlternateDataStreams: C:\ProgramData\Temp:2E05F719
AlternateDataStreams: C:\ProgramData\Temp:32B2B2E7
AlternateDataStreams: C:\ProgramData\Temp:39B14E09
AlternateDataStreams: C:\ProgramData\Temp:46B52E68
AlternateDataStreams: C:\ProgramData\Temp:572A6D77
AlternateDataStreams: C:\ProgramData\Temp:5DCCCA92
AlternateDataStreams: C:\ProgramData\Temp:7852FF7D
AlternateDataStreams: C:\ProgramData\Temp:7BF749CA
AlternateDataStreams: C:\ProgramData\Temp:800C3681
AlternateDataStreams: C:\ProgramData\Temp:A3C2A225
AlternateDataStreams: C:\ProgramData\Temp:A708668B
AlternateDataStreams: C:\ProgramData\Temp:B2E5F50D
AlternateDataStreams: C:\ProgramData\Temp:D0D0FFBF
AlternateDataStreams: C:\ProgramData\Temp:FA1999D1
AlternateDataStreams: C:\ProgramData\Temp:FFC89F0E

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

========================= Accounts: ==========================

Administrator (S-1-5-21-1516264957-1895696595-2632153551-500 - Administrator - Disabled)
Guest (S-1-5-21-1516264957-1895696595-2632153551-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1516264957-1895696595-2632153551-1002 - Limited - Enabled)
kellie (S-1-5-21-1516264957-1895696595-2632153551-1001 - Administrator - Enabled) => C:\Users\kellie

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (01/29/2015 02:48:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x11cc
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 02:48:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x100084f1
Faulting process id: 0x1378
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 01:02:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x100084f1
Faulting process id: 0x270
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 01:01:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x364
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 00:56:55 PM) (Source: Google_Toolbar) (EventID: 1) (User: )
Description: Google Toolbar error dump created. ID: Unsubmitted. Local file: C:\Users\kellie\AppData\Local\Temp\\Google Toolbar\693ed500-afef-415d-b9b7-5739c3e2d781.dmp.

Error: (01/29/2015 00:56:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: iertutil.dll, version: 9.0.8112.16490, time stamp: 0x51955aee
Exception code: 0xc0000005
Fault offset: 0x00124d66
Faulting process id: 0x638
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 00:56:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc00000fd
Fault offset: 0x10007210
Faulting process id: 0xebc
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 00:56:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc00000fd
Fault offset: 0x1000846a
Faulting process id: 0x1338
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 00:56:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc00000fd
Fault offset: 0x100018f3
Faulting process id: 0x69c
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/29/2015 00:56:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16490, time stamp: 0x51955cca
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec49b8f
Exception code: 0xc00000fd
Fault offset: 0x000222a8
Faulting process id: 0x860
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

System errors:
=============
Error: (01/29/2015 00:43:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error:
%%2

Error: (01/29/2015 00:41:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MBAMService service failed to start due to the following error:
%%1053

Error: (01/29/2015 00:41:39 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMService service to connect.

Error: (01/29/2015 00:41:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MBAMScheduler service failed to start due to the following error:
%%1053

Error: (01/29/2015 00:41:39 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect.

Error: (01/29/2015 00:41:37 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x000000d1 (0xfffff8a00fa25010, 0x0000000000000002, 0x0000000000000000, 0xfffff88003cca385)C:\Windows\MEMORY.DMP012915-26083-01

Error: (01/29/2015 00:41:31 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 12:39:43 PM on ‎29/‎01/‎2015 was unexpected.

Error: (01/29/2015 11:58:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error:
%%2

Error: (01/28/2015 01:21:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error:
%%2

Error: (01/27/2015 03:22:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error:
%%2

Microsoft Office Sessions:
=========================
Error: (01/29/2015 02:48:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaunknown0.0.0.000000000c00000050000000011cc01d03b767c29ba14C:\Program Files (x86)\Internet Explorer\iexplore.exeunknownb9ee12b7-a769-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 02:48:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaunknown0.0.0.000000000c0000005100084f1137801d03b760214020dC:\Program Files (x86)\Internet Explorer\iexplore.exeunknownb88d4cd9-a769-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 01:02:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaunknown0.0.0.000000000c0000005100084f127001d03b675e2f0189C:\Program Files (x86)\Internet Explorer\iexplore.exeunknowne84fcc55-a75a-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 01:01:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaunknown0.0.0.000000000c00000050000000036401d03b677b46c6beC:\Program Files (x86)\Internet Explorer\iexplore.exeunknownb9f4663c-a75a-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 00:56:55 PM) (Source: Google_Toolbar) (EventID: 1) (User: )
Description: Google Toolbar error dump created. ID: Unsubmitted. Local file: C:\Users\kellie\AppData\Local\Temp\\Google Toolbar\693ed500-afef-415d-b9b7-5739c3e2d781.dmp.

Error: (01/29/2015 00:56:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaiertutil.dll9.0.8112.1649051955aeec000000500124d6663801d03b66d1b2f7dbC:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\syswow64\iertutil.dll0f61e41b-a75a-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 00:56:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaunknown0.0.0.000000000c00000fd10007210ebc01d03b66d0068029C:\Program Files (x86)\Internet Explorer\iexplore.exeunknown0e9c51e5-a75a-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 00:56:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaunknown0.0.0.000000000c00000fd1000846a133801d03b66c9d041e2C:\Program Files (x86)\Internet Explorer\iexplore.exeunknown089a98f4-a75a-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 00:56:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccaunknown0.0.0.000000000c00000fd100018f369c01d03b66c9d041e2C:\Program Files (x86)\Internet Explorer\iexplore.exeunknown088042c0-a75a-11e4-8b85-b4b52f36bac8

Error: (01/29/2015 00:56:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.1649051955ccantdll.dll6.1.7601.177254ec49b8fc00000fd000222a886001d03b66c0c68858C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\SysWOW64\ntdll.dllff9c9f3a-a759-11e4-8b85-b4b52f36bac8

==================== Memory info ===========================

Processor: Intel® Core i3-2328M CPU @ 2.20GHz
Percentage of memory in use: 60%
Total physical RAM: 3996.36 MB
Available physical RAM: 1558.65 MB
Total Pagefile: 7992.72 MB
Available Pagefile: 5197.72 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:445.33 GB) (Free:373.67 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:20.13 GB) (Free:2.15 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive e: (HAVEN_S4) (CDROM) (Total:7.07 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: BB355487)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=445.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

==================== End Of Log ============================

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by kellie (administrator) on KELLIE-HP on 29-01-2015 15:25:01
Running from C:\Users\kellie\Downloads
Loaded Profiles: kellie (Available profiles: kellie)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Systweak Inc., (www.systweak.com)) C:\Program Files (x86)\Disk Speedup\DSUDefragSrv64.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-14] (Realtek Semiconductor)
HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-24] (Synaptics Incorporated)
HKLM\...\Run: [setDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-20] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.)
HKLM-x32\...\Run: [sDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL/13
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL/13
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL/13
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL/13
HKU\S-1-5-21-1516264957-1895696595-2632153551-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
HKU\S-1-5-21-1516264957-1895696595-2632153551-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL/13
HKU\S-1-5-21-1516264957-1895696595-2632153551-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.facebook.com/
http://www.google.com.au/
HKU\S-1-5-21-1516264957-1895696595-2632153551-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-1516264957-1895696595-2632153551-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://au.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-111071-2357-7/4?satitle={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://au.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-111071-2357-7/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://au.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-111071-2357-7/4?satitle={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
CHR Profile: C:\Users\kellie\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Wallet) - C:\Users\kellie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DSUDiskOptimizer; C:\Program Files (x86)\Disk Speedup\DSUDefragSrv64.exe [691984 2014-03-03] (Systweak Inc., (www.systweak.com))
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-08] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [21136 2012-10-31] (AVAST Software)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-29] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-28] (Realtek Semiconductor Corp.)
R3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-24] (Synaptics Incorporated)
S3 avchv; system32\DRIVERS\avchv.sys [X]
S3 BS2054132096; \??\C:\Users\kellie\AppData\Local\Temp\NTFS.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-29 15:25 - 2015-01-29 15:25 - 00014997 _____ () C:\Users\kellie\Downloads\FRST.txt
2015-01-29 15:24 - 2015-01-29 15:25 - 00000000 ____D () C:\FRST
2015-01-29 15:24 - 2015-01-29 15:24 - 02130432 _____ (Farbar) C:\Users\kellie\Downloads\FRST64.exe
2015-01-29 15:20 - 2015-01-29 15:21 - 00001756 _____ () C:\Windows\system32\DB2054132096
2015-01-29 14:58 - 2015-01-29 14:58 - 00001427 _____ () C:\Users\kellie\Desktop\attach.txt
2015-01-29 14:57 - 2015-01-29 14:57 - 00688992 ____R (Swearware) C:\Users\kellie\Downloads\dds.com
2015-01-29 14:54 - 2015-01-29 14:54 - 01943800 _____ (Bleeping Computer, LLC) C:\Users\kellie\Downloads\eXplorer.exe
2015-01-29 14:53 - 2015-01-29 14:53 - 01943800 _____ (Bleeping Computer, LLC) C:\Users\kellie\Downloads\iExplore.exe
2015-01-29 14:52 - 2015-01-29 14:52 - 01943800 _____ (Bleeping Computer, LLC) C:\Users\kellie\Downloads\rkill (1).exe
2015-01-29 14:50 - 2015-01-29 14:50 - 00001123 _____ () C:\Users\kellie\Desktop\rkill - Shortcut.lnk
2015-01-29 14:49 - 2015-01-29 14:49 - 01943800 _____ (Bleeping Computer, LLC) C:\Users\kellie\Downloads\rkill.exe
2015-01-29 13:04 - 2015-01-29 13:04 - 00000000 ____D () C:\Users\kellie\Documents\mbam-chameleon-3.1.7.0
2015-01-29 12:43 - 2015-01-29 12:43 - 01233116 _____ () C:\Windows\system32\CFG2054132096
2015-01-29 12:41 - 2015-01-29 12:41 - 533097761 _____ () C:\Windows\MEMORY.DMP
2015-01-29 12:41 - 2015-01-29 12:41 - 00279936 _____ () C:\Windows\Minidump\012915-26083-01.dmp
2015-01-29 12:41 - 2015-01-29 12:41 - 00000000 ____D () C:\Windows\Minidump

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-29 15:16 - 2012-03-16 11:14 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-29 15:16 - 2012-03-16 11:14 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-29 14:48 - 2012-11-07 12:35 - 00000000 ____D () C:\Users\kellie\AppData\Local\CrashDumps
2015-01-29 14:40 - 2012-11-07 10:27 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-29 13:00 - 2012-11-07 10:27 - 00000000 ____D () C:\Users\kellie\AppData\Local\Google
2015-01-29 13:00 - 2012-11-07 10:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-29 12:50 - 2009-07-14 15:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-29 12:50 - 2009-07-14 15:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-29 12:47 - 2012-11-07 10:11 - 01376390 _____ () C:\Windows\WindowsUpdate.log
2015-01-29 12:41 - 2012-11-07 10:27 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-29 12:41 - 2009-07-14 16:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-29 12:41 - 2009-07-14 15:51 - 00129306 _____ () C:\Windows\setupact.log
2015-01-29 12:37 - 2014-10-11 22:56 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-27 15:44 - 2012-11-09 16:27 - 00002143 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-26 17:13 - 2009-07-14 16:13 - 00778834 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-23 23:21 - 2009-07-14 14:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-23 12:14 - 2012-11-15 18:48 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForkellie
2015-01-23 12:14 - 2012-11-15 18:48 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForkellie.job
2015-01-23 10:25 - 2010-11-21 14:47 - 00521772 _____ () C:\Windows\PFRO.log
2015-01-22 22:26 - 2014-09-09 14:10 - 00049854 _____ () C:\Windows\wininit.ini

==================== Files in the root of some directories =======

2012-11-07 10:27 - 2012-11-07 10:29 - 4096000 _____ () C:\Program Files (x86)\GUT9B55.tmp
2013-05-28 23:11 - 2014-11-07 22:33 - 0009728 _____ () C:\Users\kellie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-10-10 11:56 - 2014-10-10 11:56 - 0007605 _____ () C:\Users\kellie\AppData\Local\Resmon.ResmonCfg

Files to move or delete:
====================
C:\Users\kellie\Uninstal.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-24 11:53

==================== End Of Log ============================

 

Thanks

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hello kelliae, welcome to Malwarebytes' Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. :)
 
General P2P/Piracy Notice: 
 

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum. 
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

  • Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  • If you are unable to copy/paste your logs directly into your post, please attach the file. 
  • Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
  • Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.
  • If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  • Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
  • Ensure you are following this topic. Click xetYzdbu.png.pagespeed.ic.U7AjmRUewW.png at the top of the page. 
     

======================================================
 
Please consider the following suggestion, and proceed with the instructions below. 
 

goGMWSt.gifSpybot S&D No Longer Recommended

------------------------------

MVPS.org is no longer recommending Spybot S&D due to poor testing results (scroll down and read under Freeware Antispyware Products).

I would advise uninstalling Spybot S&D. The presence of this programme can make the cleaning of your computer more difficult. You can uninstall the programme by:

  • Press the Windows Key pdKOQKY.png + r on your keyboard at the same time. Type appwiz.cpl and click OK.
  • Search for Spybot, right-click the entry and click Uninstall.
Please inform me of your decision.

 

STEP 1
xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Script

  • Press the Windows Key pdKOQKY.png + r on your keyboard at the same time. Type Notepad and click OK.
  • Copy the entire contents of the codebox below and paste into the Notepad document.
    startCreateRestorePoint:CloseProcesses:SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/we...&l=dis&o=CPNTDFSearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://au.search.yah...psg&type=CPNTDFSearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/we...&l=dis&o=CPNTDFSearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://au.search.yah...psg&type=CPNTDFSearchScopes: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/we...&l=dis&o=CPNTDFSearchScopes: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://au.search.yah...psg&type=CPNTDFToolbar: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No FileToolbar: HKU\S-1-5-21-1516264957-1895696595-2632153551-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No FileS3 avchv; system32\DRIVERS\avchv.sys [X]S3 BS2054132096; \??\C:\Users\kellie\AppData\Local\Temp\NTFS.sys [X]C:\Users\kellie\Uninstal.exeTask: {755AEFB5-C3B1-490B-8825-6EFFE6076752} - System32\Tasks\{0BBA1E77-601E-121A-9E23-DE192913D63D} => C:\Users\kellie\AppData\Roaming\MQOCdNSk\KoZZgZBa\hEngcpNp\SXclzaICO.exeC:\Users\kellie\AppData\Roaming\MQOCdNSkAlternateDataStreams: C:\ProgramData\Temp:08DB0309AlternateDataStreams: C:\ProgramData\Temp:0D5C92DBAlternateDataStreams: C:\ProgramData\Temp:0EABC438AlternateDataStreams: C:\ProgramData\Temp:12169ADEAlternateDataStreams: C:\ProgramData\Temp:13A52F9BAlternateDataStreams: C:\ProgramData\Temp:15A1EB41AlternateDataStreams: C:\ProgramData\Temp:1E138C75AlternateDataStreams: C:\ProgramData\Temp:2CB9631FAlternateDataStreams: C:\ProgramData\Temp:2E05F719AlternateDataStreams: C:\ProgramData\Temp:32B2B2E7AlternateDataStreams: C:\ProgramData\Temp:39B14E09AlternateDataStreams: C:\ProgramData\Temp:46B52E68AlternateDataStreams: C:\ProgramData\Temp:572A6D77AlternateDataStreams: C:\ProgramData\Temp:5DCCCA92AlternateDataStreams: C:\ProgramData\Temp:7852FF7DAlternateDataStreams: C:\ProgramData\Temp:7BF749CAAlternateDataStreams: C:\ProgramData\Temp:800C3681AlternateDataStreams: C:\ProgramData\Temp:A3C2A225AlternateDataStreams: C:\ProgramData\Temp:A708668BAlternateDataStreams: C:\ProgramData\Temp:B2E5F50DAlternateDataStreams: C:\ProgramData\Temp:D0D0FFBFAlternateDataStreams: C:\ProgramData\Temp:FA1999D1AlternateDataStreams: C:\ProgramData\Temp:FFC89F0ECMD: ipconfig /flushdnsCMD: netsh winsock reset allCMD: netsh int ipv4 resetCMD: netsh int ipv6 resetEmptyTemp:end
  • Click File, Save As and type fixlist.txt as the File Name.
  • Important: The file must be saved in the same location as FRST64.exe.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

  • Right-Click FRST64.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Click Fix.
  • A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
     

STEP 2
YARWD1t.png TDSSKiller Scan

  • Please download TDSSKiller and save the file to your Desktop.
  • Right-Click TDSSKiller.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Click Change parameters. Place a checkmark next to:
    • Loaded Modules
    • Detect TDLFS file system
    • Verify file digital signatures
  • Note: If you receive the following message: Extended Monitoring Driver is required, click Reboot now, and continue from here following the reboot.
  • ​Click Start Scan. Do not use the computer during the scan.
  • If objects are found, change the action to skip.
  • Click Continue and close the window.
  • A log will be created and saved to the root directory (usually C:\). Attach the log in your next reply.
     

STEP 3
nWhGEI3.png VirusTotal Upload

  • Please go to VirusTotal.com.
  • Click Choose File and locate the following file:
    • C:\Windows\system32\DB2054132096
  • ​Click Scan it!.
  • If you receive the following notification: File already analysed click Reanalyse.
  • Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply. 
  • Please do the same for the files below:
    • C:\Windows\system32\CFG2054132096
       

======================================================
 
STEP 4
pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

  • Fixlog.txt
  • TDSSKiller log (attached!)
  • VirusTotal Results
Link to post
Share on other sites
kelliae

kelliae

Posted
  • Author
Posted

Hi Adam, I really appreciate your help... unfortunately things seem to have gotten worse..... i removed spybot, i made the fixlist file and then was running FRST64.exe - it seemed to be taking a long time so i eventually wandered off. When i returned by computer had shut down (possibly thermal shutdown that happens occassionally?) now i can't get it to restart (this has never happened before)... it gets as far as "press escape to enter startup" then shuts down and reboots in a continual loop. I am able to enter the startup bit if i time it right but i don't know what to do in there....

 

thanks for your help, Kellie

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hi Kellie, 
 
I'm sorry to hear this has happened. Malware removal can be unpredictable at times, and unforeseen issues do occur. 
 
Please let me know if you can get into Safe Mode. 
If you can, please run an FRST scan. 
 
MgeHyNE.png Boot into Safe Mode

  • Restart your PC.
  • As soon as the BIOS is loaded, begin repeatedly tapping the F8 key until the Advanced Options menu appears.  
  • Using the arrow keys, select Safe Mode. 
  • Press the Enter key.
     

xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Scan

  • Right-Click FRST64.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
Link to post
Share on other sites
kelliae

kelliae

Posted
  • Author
Posted

Hi Adam, no i cant get into safe mode - pressing F8 does not effect the boot cycle, if i press escape i can get to the startup menu which offers system info, system diagnostics, boot device options, BIOS setup and System recovery (I tried the system recovery one and nothing happened, i tried system diagnostics and everything passed

Link to post
Share on other sites
Naathim

Naathim

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.