|
Post by nhosier on Aug 7, 2017 13:36:14 GMT -8
Hello. I'm running a system with Win 7 64 bit and I've recently started experiencing issues. This past week, whenever I'd open a Firefox session, the page would stay at loading Firefox perpetually, and eat most of my system resources. When I'd use task manager to close Firefox, I'd notice that there were two sessions running, both with *32 suffixes. The one using lower memory could be closed and the Firefox window would close, but the other process would give me an access is denied message when I'd try to close. After reading some forums, I was led to believe that some Firefox update was the issue. Since then, however, I've noticed that there are multiple processes with the *32 suffix and about a dozen svchost.exe processes at any given time. My windows defender has been shut off, and my windows security center keeps telling me that it's service has stopped. I restarted my computer to try to start in safe mode, and my screen is currently stuck at a failure configuring Windows updates reverting changes. I appreciate any help I can get, please let me know if you need any further information.
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Aug 8, 2017 0:09:25 GMT -8
Hmm .... This does sound strange. It could be a corrupt user profile, bad service configuration or disk error problems. Let's check for the services first. Please download Farbar Service Scanner to your desktop and double click on the file to run it. [/b] Windows FirewallSystem RestoreSecurity CenterWindows UpdateWindows DefenderOther Services[/ul] Press " Scan". It will create a log (FSS.txt) in the same directory the tool is run. Please copy and paste the log to your reply. [/ul]
|
|
|
Post by nhosier on Aug 8, 2017 2:35:26 GMT -8
As of this morning when I left for work, my PC is still stuck at the "Windows update failure reverting changes" screen. Is there some way to get past that to my desktop?
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Aug 8, 2017 6:14:02 GMT -8
Do you have a Win7 install CD / DVD ? Do you have access to another computer to download files to transfer to your afflicted system?
|
|
|
Post by nhosier on Aug 8, 2017 12:20:38 GMT -8
I don't have the install CD anymore, it was an OEM version when I built the system and I've since misplaced the OS CD. I do have access to another computer though.
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Aug 8, 2017 21:36:52 GMT -8
Download the following three programs to your desktop of a functioning system: 1. Rufus 2. Windows 7 64bit RC - link sent to you via PM on this forum 3. Farbar Recovery Scan Tool x64 Insert the USB stick Then run Rufus Select the ISO file on the desktop via the ISO icon. Press Start Burn Then copy FRST to the same USB Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB Note: If you are not sure how to do that follow the instructions Here Windows 7 and Vista screenshots When you reboot you will see these commands: Click repair my computer Select your operating system Select Command prompt At the command prompt type the following : notepad and press Enter. The notepad opens. Under File menu select Open. Select "Computer" and find your flash drive letter and close the notepad. In the command window type e:\frst64.exe or e:\frst.exe dependant on system and press Enter Note: Replace letter e with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
|
|
|
Post by nhosier on Aug 9, 2017 15:32:06 GMT -8
The results of the scan are as follows:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 09-08-2017 Ran by SYSTEM on MININT-FUU6935 (09-08-2017 19:23:35) Running from f:\ Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 Boot Mode: Recovery Default: ControlSet001 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
Tutorial for Farbar Recovery Scan Tool: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation) HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4888264 2016-02-03] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM-x32\...\RunOnce: [CleanUp RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzInstallerDeletion.vbs [1446 2014-05-18] () Winlogon\Notify\ScCertProp: wlnotify.dll [X] BootExecute: autocheck autochk * SmartDefragBootTime.exe
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-01-13] () S2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3705536 2017-07-03] (Microsoft Corporation) S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [249104 2016-07-13] (EasyAntiCheat Ltd) S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation) S2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [69964448 2015-04-03] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation) S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [441512 2015-04-03] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation) S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation) S3 rzdaendpt; C:\Windows\System32\DRIVERS\rzdaendpt.sys [43720 2015-08-13] (Razer Inc) S3 rzp1endpt; C:\Windows\System32\DRIVERS\rzp1endpt.sys [50904 2015-08-13] (Razer Inc) S3 rzvkeyboard; C:\Windows\System32\DRIVERS\rzvkeyboard.sys [31912 2014-09-04] (Razer Inc) S3 rzvmouse; C:\Windows\System32\DRIVERS\rzvmouse.sys [31912 2014-09-04] (Razer Inc) S3 S3XXx64; C:\Windows\System32\DRIVERS\S3XXx64.sys [70016 2012-07-31] (Identive) S0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit) S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-10] (MCCI Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-08-09 19:23 - 2017-08-09 19:23 - 000000000 ____D C:\FRST 2017-08-06 08:15 - 2017-08-06 17:00 - 000013738 _____ C:\Users\Nate\Desktop\Eve Market Tool Basic.xlsx 2017-07-31 16:10 - 2017-07-31 16:11 - 000000000 ____D C:\Users\Nate\Desktop\Joy's Stuff 2017-07-31 14:46 - 2017-07-31 14:46 - 000001146 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2017-07-31 14:44 - 2017-07-31 14:44 - 000266192 _____ (Mozilla) C:\Users\Nate\Downloads\Firefox Setup Stub 54.0.1.exe 2017-07-31 14:41 - 2017-07-31 14:42 - 000000000 ____D C:\Windows\LastGood.Tmp 2017-07-31 13:07 - 2017-07-31 13:07 - 000000000 ____D C:\Windows\CheckSur 2017-07-23 15:20 - 2017-07-31 16:10 - 000001009 _____ C:\Users\Public\Desktop\CPUID HWMonitor.lnk 2017-07-23 15:20 - 2017-07-23 15:20 - 000000000 ____D C:\Program Files\CPUID 2017-07-23 15:07 - 2017-07-23 15:07 - 000116744 _____ C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT 2017-07-23 15:07 - 2017-07-23 15:07 - 000116744 _____ C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT 2017-07-21 02:42 - 2017-07-21 02:42 - 000000000 ____D C:\Program Files\Common Files\DESIGNER 2017-07-18 12:55 - 2017-07-18 12:55 - 000000000 ____D C:\Users\Nate\AppData\LocalLow\Unity 2017-07-18 12:47 - 2017-07-18 12:47 - 000000000 ____D C:\Users\Nate\AppData\LocalLow\SKS 2017-07-14 12:49 - 2017-07-14 12:49 - 000000950 _____ C:\Users\Public\Desktop\LOOT.lnk 2017-07-11 14:54 - 2017-05-03 07:34 - 000094952 _____ (Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe 2017-07-11 14:54 - 2017-05-03 07:29 - 001206272 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll 2017-07-11 14:54 - 2017-05-03 05:05 - 001555968 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll 2017-07-11 14:54 - 2017-05-03 05:05 - 000620544 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll 2017-07-11 14:54 - 2017-05-03 05:05 - 000535552 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll 2017-07-11 14:54 - 2017-05-03 05:05 - 000325632 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll 2017-07-11 14:54 - 2017-05-03 05:05 - 000311296 _____ (Microsoft Corporation) C:\Windows\System32\centel.dll 2017-07-11 14:54 - 2017-05-03 05:05 - 000217088 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll 2017-07-11 14:54 - 2017-05-03 05:05 - 000127488 _____ (Microsoft Corporation) C:\Windows\System32\acmigration.dll 2017-07-11 14:54 - 2017-03-22 18:06 - 001691136 _____ (Microsoft Corporation) C:\Windows\System32\aitstatic.exe 2017-07-11 14:52 - 2017-06-29 20:15 - 000394448 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2017-07-11 14:52 - 2017-06-29 19:32 - 000346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 002319872 _____ (Microsoft Corporation) C:\Windows\System32\tquery.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 002222080 _____ (Microsoft Corporation) C:\Windows\System32\mssrch.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 002058240 _____ (Microsoft Corporation) C:\Windows\System32\Query.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 000778240 _____ (Microsoft Corporation) C:\Windows\System32\mssvp.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 000491520 _____ (Microsoft Corporation) C:\Windows\System32\mssph.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 000288256 _____ (Microsoft Corporation) C:\Windows\System32\mssphtb.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 000115200 _____ (Microsoft Corporation) C:\Windows\System32\mssitlb.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 000099840 _____ (Microsoft Corporation) C:\Windows\System32\mssprxy.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 000075264 _____ (Microsoft Corporation) C:\Windows\System32\msscntrs.dll 2017-07-11 14:52 - 2017-06-29 18:57 - 000014336 _____ (Microsoft Corporation) C:\Windows\System32\msshooks.dll 2017-07-11 14:52 - 2017-06-29 18:40 - 000591872 _____ (Microsoft Corporation) C:\Windows\System32\SearchIndexer.exe 2017-07-11 14:52 - 2017-06-29 18:40 - 000249856 _____ (Microsoft Corporation) C:\Windows\System32\SearchProtocolHost.exe 2017-07-11 14:52 - 2017-06-29 18:39 - 001549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll 2017-07-11 14:52 - 2017-06-29 18:39 - 000113664 _____ (Microsoft Corporation) C:\Windows\System32\SearchFilterHost.exe 2017-07-11 14:52 - 2017-06-29 18:38 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll 2017-07-11 14:52 - 2017-06-29 18:38 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll 2017-07-11 14:52 - 2017-06-29 18:38 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll 2017-07-11 14:52 - 2017-06-29 18:38 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll 2017-07-11 14:52 - 2017-06-29 18:38 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll 2017-07-11 14:52 - 2017-06-29 18:38 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll 2017-07-11 14:52 - 2017-06-29 18:38 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll 2017-07-11 14:52 - 2017-06-29 18:38 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll 2017-07-11 14:52 - 2017-06-29 18:27 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe 2017-07-11 14:52 - 2017-06-29 18:27 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe 2017-07-11 14:52 - 2017-06-29 18:26 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe 2017-07-11 14:52 - 2017-06-29 18:26 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll 2017-07-11 14:52 - 2017-06-28 22:27 - 025734656 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2017-07-11 14:52 - 2017-06-28 22:19 - 002724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2017-07-11 14:52 - 2017-06-28 22:18 - 000004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll 2017-07-11 14:52 - 2017-06-28 22:04 - 000066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2017-07-11 14:52 - 2017-06-28 22:03 - 000417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec 2017-07-11 14:52 - 2017-06-28 22:03 - 000048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll 2017-07-11 14:52 - 2017-06-28 22:02 - 002899456 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2017-07-11 14:52 - 2017-06-28 22:02 - 000576512 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2017-07-11 14:52 - 2017-06-28 22:02 - 000088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll 2017-07-11 14:52 - 2017-06-28 21:55 - 000054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2017-07-11 14:52 - 2017-06-28 21:54 - 000034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2017-07-11 14:52 - 2017-06-28 21:51 - 000615936 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2017-07-11 14:52 - 2017-06-28 21:50 - 000817664 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2017-07-11 14:52 - 2017-06-28 21:50 - 000814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll 2017-07-11 14:52 - 2017-06-28 21:50 - 000144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2017-07-11 14:52 - 2017-06-28 21:50 - 000116224 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe 2017-07-11 14:52 - 2017-06-28 21:44 - 005975552 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2017-07-11 14:52 - 2017-06-28 21:43 - 000968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe 2017-07-11 14:52 - 2017-06-28 21:39 - 000489984 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll 2017-07-11 14:52 - 2017-06-28 21:35 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2017-07-11 14:52 - 2017-06-28 21:31 - 000087552 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx 2017-07-11 14:52 - 2017-06-28 21:31 - 000077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll 2017-07-11 14:52 - 2017-06-28 21:30 - 000107520 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll 2017-07-11 14:52 - 2017-06-28 21:27 - 000199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll 2017-07-11 14:52 - 2017-06-28 21:26 - 000092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2017-07-11 14:52 - 2017-06-28 21:23 - 020270592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2017-07-11 14:52 - 2017-06-28 21:23 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2017-07-11 14:52 - 2017-06-28 21:23 - 000315392 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll 2017-07-11 14:52 - 2017-06-28 21:23 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2017-07-11 14:52 - 2017-06-28 21:23 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2017-07-11 14:52 - 2017-06-28 21:22 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2017-07-11 14:52 - 2017-06-28 21:22 - 000152064 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll 2017-07-11 14:52 - 2017-06-28 21:22 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2017-07-11 14:52 - 2017-06-28 21:19 - 002290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2017-07-11 14:52 - 2017-06-28 21:17 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2017-07-11 14:52 - 2017-06-28 21:16 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2017-07-11 14:52 - 2017-06-28 21:14 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2017-07-11 14:52 - 2017-06-28 21:13 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2017-07-11 14:52 - 2017-06-28 21:13 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2017-07-11 14:52 - 2017-06-28 21:13 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2017-07-11 14:52 - 2017-06-28 21:11 - 000262144 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll 2017-07-11 14:52 - 2017-06-28 21:09 - 000806912 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2017-07-11 14:52 - 2017-06-28 21:09 - 000725504 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2017-07-11 14:52 - 2017-06-28 21:08 - 001359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll 2017-07-11 14:52 - 2017-06-28 21:07 - 002132992 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2017-07-11 14:52 - 2017-06-28 21:05 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2017-07-11 14:52 - 2017-06-28 21:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2017-07-11 14:52 - 2017-06-28 21:00 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2017-07-11 14:52 - 2017-06-28 21:00 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2017-07-11 14:52 - 2017-06-28 20:58 - 015253504 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2017-07-11 14:52 - 2017-06-28 20:58 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2017-07-11 14:52 - 2017-06-28 20:56 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2017-07-11 14:52 - 2017-06-28 20:56 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2017-07-11 14:52 - 2017-06-28 20:54 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2017-07-11 14:52 - 2017-06-28 20:53 - 003240960 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2017-07-11 14:52 - 2017-06-28 20:52 - 004549632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2017-07-11 14:52 - 2017-06-28 20:48 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2017-07-11 14:52 - 2017-06-28 20:47 - 000693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2017-07-11 14:52 - 2017-06-28 20:46 - 002057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2017-07-11 14:52 - 2017-06-28 20:46 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2017-07-11 14:52 - 2017-06-28 20:43 - 013663744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2017-07-11 14:52 - 2017-06-28 20:41 - 001545728 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2017-07-11 14:52 - 2017-06-28 20:29 - 000800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2017-07-11 14:52 - 2017-06-28 20:28 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2017-07-11 14:52 - 2017-06-28 20:24 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2017-07-11 14:52 - 2017-06-28 20:23 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2017-07-11 14:52 - 2017-06-22 06:58 - 003223040 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2017-07-11 14:52 - 2017-06-15 12:23 - 000753664 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\http.sys 2017-07-11 14:52 - 2017-06-12 14:54 - 000370920 _____ (Microsoft Corporation) C:\Windows\System32\clfs.sys 2017-07-11 14:52 - 2017-06-12 14:54 - 000154856 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2017-07-11 14:52 - 2017-06-12 14:54 - 000095464 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2017-07-11 14:52 - 2017-06-12 14:49 - 001460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 001363456 _____ (Microsoft Corporation) C:\Windows\System32\wdc.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 001212928 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000731648 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000690688 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000594432 _____ (Microsoft Corporation) C:\Windows\System32\wvc.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000475136 _____ (Microsoft Corporation) C:\Windows\System32\sysmon.ocx 2017-07-11 14:52 - 2017-06-12 14:49 - 000463872 _____ (Microsoft Corporation) C:\Windows\System32\certcli.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000345600 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000316928 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000312320 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000210432 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000190464 _____ (Microsoft Corporation) C:\Windows\System32\rpchttp.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000123904 _____ (Microsoft Corporation) C:\Windows\System32\bcrypt.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000058880 _____ (Microsoft Corporation) C:\Windows\System32\pdhui.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000043520 _____ (Microsoft Corporation) C:\Windows\System32\cryptbase.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll 2017-07-11 14:52 - 2017-06-12 14:49 - 000022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll 2017-07-11 14:52 - 2017-06-12 14:29 - 001227264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll 2017-07-11 14:52 - 2017-06-12 14:29 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2017-07-11 14:52 - 2017-06-12 14:29 - 000444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll 2017-07-11 14:52 - 2017-06-12 14:29 - 000390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx 2017-07-11 14:52 - 2017-06-12 14:29 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2017-07-11 14:52 - 2017-06-12 14:29 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2017-07-11 14:52 - 2017-06-12 14:29 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll 2017-07-11 14:52 - 2017-06-12 14:29 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2017-07-11 14:52 - 2017-06-12 14:28 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2017-07-11 14:52 - 2017-06-12 14:19 - 000064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe 2017-07-11 14:52 - 2017-06-12 14:14 - 000379392 _____ (Microsoft Corporation) C:\Windows\System32\msinfo32.exe 2017-07-11 14:52 - 2017-06-12 14:14 - 000172544 _____ (Microsoft Corporation) C:\Windows\System32\perfmon.exe 2017-07-11 14:52 - 2017-06-12 14:14 - 000103936 _____ (Microsoft Corporation) C:\Windows\System32\resmon.exe 2017-07-11 14:52 - 2017-06-12 14:12 - 000291328 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys 2017-07-11 14:52 - 2017-06-12 14:12 - 000159744 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys 2017-07-11 14:52 - 2017-06-12 14:12 - 000129536 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys 2017-07-11 14:52 - 2017-06-12 14:11 - 000030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe 2017-07-11 14:52 - 2017-06-12 14:09 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2017-07-11 14:52 - 2017-06-12 14:06 - 000303616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe 2017-07-11 14:52 - 2017-06-12 14:06 - 000157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe 2017-07-11 14:52 - 2017-06-12 14:06 - 000103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resmon.exe 2017-07-11 14:52 - 2017-06-12 14:05 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll 2017-07-11 14:52 - 2017-06-10 07:59 - 000313856 _____ (Microsoft Corporation) C:\Windows\System32\Wldap32.dll 2017-07-11 14:52 - 2017-06-10 07:39 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll 2017-07-11 14:52 - 2017-06-09 07:33 - 001680616 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys 2017-07-11 14:52 - 2017-06-06 07:30 - 001867264 _____ (Microsoft Corporation) C:\Windows\System32\ExplorerFrame.dll 2017-07-11 14:52 - 2017-06-06 07:12 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll 2017-07-11 14:52 - 2017-05-29 20:56 - 001895656 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2017-07-11 14:52 - 2017-05-29 20:56 - 000377576 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys 2017-07-11 14:52 - 2017-05-29 20:56 - 000287976 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS 2017-07-11 14:52 - 2017-05-20 20:24 - 000002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll 2017-07-11 14:52 - 2017-05-20 20:06 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2017-07-11 14:52 - 2017-05-16 07:35 - 000986856 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2017-07-11 14:52 - 2017-05-16 07:35 - 000265448 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys 2017-07-11 14:52 - 2017-05-16 07:30 - 000144384 _____ (Microsoft Corporation) C:\Windows\System32\cdd.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-08-09 13:05 - 2009-07-13 20:45 - 000029120 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-08-09 13:05 - 2009-07-13 20:45 - 000029120 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-08-09 13:02 - 2009-07-13 21:13 - 000006894 _____ C:\Windows\System32\PerfStringBackup.INI 2017-08-09 12:54 - 2009-07-13 21:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2017-08-07 14:05 - 2016-07-13 15:23 - 000672648 _____ C:\Windows\ntbtlog.txt 2017-08-07 13:21 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\inf 2017-08-07 12:57 - 2012-04-13 11:33 - 000000000 ____D C:\Program Files (x86)\Steam 2017-08-07 12:50 - 2009-07-13 21:08 - 000032570 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2017-08-06 07:57 - 2016-11-19 07:21 - 000000000 ____D C:\Users\Nate\AppData\LocalLow\Mozilla 2017-08-03 18:11 - 2015-07-15 23:50 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2017-08-01 13:05 - 2017-04-24 08:03 - 000000000 ____D C:\Users\Nate\Documents\My Scans 2017-08-01 13:02 - 2013-09-14 09:48 - 000000000 ____D C:\Users\Nate\AppData\Local\CrashDumps 2017-07-31 16:10 - 2014-06-29 09:38 - 000000969 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk 2017-07-31 14:52 - 2017-05-13 08:31 - 000000000 ____D C:\ProgramData\VCE Exam Simulator 2017-07-31 14:52 - 2012-09-11 12:06 - 000000000 ____D C:\Program Files\TeamSpeak 3 Client 2017-07-31 14:46 - 2016-11-19 00:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-07-31 14:46 - 2014-02-28 03:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-07-31 14:43 - 2012-04-12 17:40 - 000000000 ____D C:\Program Files (x86)\Razer 2017-07-31 14:43 - 2012-04-11 19:12 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2017-07-31 14:38 - 2014-06-28 18:05 - 000000000 ____D C:\Users\Nate\AppData\Local\Razer 2017-07-31 14:38 - 2014-06-28 17:40 - 000000000 ____D C:\ProgramData\Razer 2017-07-31 14:31 - 2013-05-31 10:55 - 000000000 ____D C:\Program Files (x86)\Mumble 2017-07-31 14:28 - 2016-09-05 08:55 - 000000000 ____D C:\Program Files (x86)\EVEMon 2017-07-31 14:15 - 2014-06-29 09:51 - 000000000 ____D C:\Games 2017-07-30 18:08 - 2015-09-26 06:42 - 000000000 ____D C:\Users\Nate\AppData\Roaming\uTorrent 2017-07-23 13:39 - 2016-02-14 17:38 - 000000000 ____D C:\ProgramData\Package Cache 2017-07-23 13:33 - 2015-03-14 06:49 - 000000404 _____ C:\Windows\Tasks\DriverEasy Scheduled Scan.job 2017-07-22 09:41 - 2016-03-08 14:08 - 000000000 ____D C:\Users\Nate\AppData\Roaming\.minecraft 2017-07-22 09:37 - 2016-03-08 14:07 - 000000000 ____D C:\Program Files (x86)\Minecraft 2017-07-22 09:09 - 2016-07-04 06:22 - 000000000 ____D C:\Users\Nate\AppData\Roaming\7DaysToDie 2017-07-21 02:44 - 2014-09-15 14:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2017-07-21 02:42 - 2009-07-13 19:20 - 000000000 ____D C:\Program Files\Common Files\Microsoft Shared 2017-07-21 02:39 - 2014-09-15 14:38 - 000000000 ____D C:\Program Files\Microsoft Office 2017-07-14 13:13 - 2012-11-18 08:04 - 000000000 ____D C:\Users\Nate\AppData\Local\Skyrim 2017-07-14 13:09 - 2015-07-10 14:09 - 000000000 ____D C:\Users\Nate\AppData\Local\LOOT 2017-07-14 12:49 - 2015-07-10 14:09 - 000000000 ____D C:\Program Files (x86)\LOOT 2017-07-12 12:23 - 2014-09-16 16:29 - 000000000 ____D C:\Users\Nate\AppData\Local\Adobe 2017-07-12 01:41 - 2012-04-12 18:27 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-07-12 01:41 - 2012-04-12 18:27 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-07-12 01:41 - 2012-04-12 18:27 - 000000000 ____D C:\Windows\SysWOW64\Macromed 2017-07-12 01:41 - 2012-04-12 18:27 - 000000000 ____D C:\Windows\System32\Macromed 2017-07-12 00:51 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\rescache 2017-07-11 23:38 - 2015-11-23 13:39 - 000453272 _____ C:\Windows\System32\FNTCACHE.DAT 2017-07-11 23:28 - 2014-12-11 00:26 - 000000000 ____D C:\Windows\System32\appraiser 2017-07-11 23:11 - 2013-09-14 23:09 - 000000000 ____D C:\Windows\System32\MRT 2017-07-11 23:06 - 2012-04-14 19:48 - 135225752 ____C (Microsoft Corporation) C:\Windows\System32\MRT.exe
Some files in TEMP: ==================== 2017-07-31 14:27 - 2017-07-31 14:27 - 000363208 _____ (BitRaider, LLC) C:\Users\Nate\AppData\Local\Temp\BRSVC_5381082_hlp.exe
==================== Known DLLs (Whitelisted) =========================
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll [2017-05-09 09:54] - [2017-04-17 07:37] - 000512000 _____ (Microsoft Corporation) 5E9F8D029D9B03110D835CBFC058068B
C:\Windows\System32\dnsapi.dll => MD5 is legit C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== Association (Whitelisted) =============
==================== Restore Points =========================
Restore point date: 2017-08-04 13:10 Restore point date: 2017-08-09 03:37
==================== Memory info ===========================
Percentage of memory in use: 7% Total physical RAM: 16329.37 MB Available physical RAM: 15095.1 MB Total Virtual: 16327.57 MB Available Virtual: 15105.87 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:1397.17 GB) (Free:573.46 GB) NTFS Drive f: (Repair disc Windows 7 64-bit) (Removable) (Total:29.25 GB) (Free:29.02 GB) NTFS Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: 92F90226) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=1397.2 GB) - (Type=07 NTFS)
======================================================== Disk: 1 (Size: 29.3 GB) (Disk ID: F6F28325) Partition 1: (Active) - (Size=29.2 GB) - (Type=07 NTFS)
LastRegBack: 2017-07-31 20:37
==================== End of FRST.txt ============================
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Aug 9, 2017 21:38:06 GMT -8
You may want to read carefully all of this message first before starting the steps. NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemDownload the script file that is attached by right clicking on it and selecting "Save Target As..." or "Save Link As ...." (depends on the browser you are using). Please make sure that the file type is set as Text File (or All Files but NOT as a HTML file) and the files name is Fixlist.txt. Save this file to the USB stick that has FRST on it so that fixlist.txt is next to FRST64.exe, Start the FRST tool on the disabled system the same way you did for the scan EXCEPT do not press the SCAN button. This time press the FIX button just once and wait for the tool to finish its run. Remove the USB drive from the system (once the log file has been written to the drive) and reboot the system. The tool will make a log on the USB drive named (Fixlog.txt) please post it to your reply (attach or paste). Does the system boot any better now? Attachments:Fixlist.txt (434 B)
|
|
|
Post by nhosier on Aug 10, 2017 2:38:47 GMT -8
I didn't try to boot following the scan, I shut down in anticipation of further instructions. I'll run the fix when I get home from work, and try to boot following that. Thanks for the help, looking forward to getting my system back!
|
|
|
Post by nhosier on Aug 10, 2017 12:50:05 GMT -8
The contents of fixlog.txt are as follows:
Fix result of Farbar Recovery Scan Tool (x64) Version: 09-08-2017 Ran by SYSTEM (10-08-2017 16:45:18) Run:1 Running from f:\ Boot Mode: Recovery ==============================================
fixlist content: ***************** HKLM-x32\...\RunOnce: [CleanUp RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzInstallerDeletion.vbs [1446 2014-05-18] () Winlogon\Notify\ScCertProp: wlnotify.dll [X] 2017-07-31 14:27 - 2017-07-31 14:27 - 000363208 _____ (BitRaider, LLC) C:\Users\Nate\AppData\Local\Temp\BRSVC_5381082_hlp.exe S0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit) LastRegBack: 2017-07-31 20:37
*****************
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\CleanUp RzWizard => value removed successfully HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp => key removed successfully C:\Users\Nate\AppData\Local\Temp\BRSVC_5381082_hlp.exe => moved successfully HKLM\System\ControlSet001\Services\SmartDefragDriver => key removed successfully SmartDefragDriver => service removed successfully DEFAULT => copied successfully to System32\config\HiveBackup DEFAULT => restored successfully from registry back up SAM => copied successfully to System32\config\HiveBackup SAM => restored successfully from registry back up SECURITY => copied successfully to System32\config\HiveBackup SECURITY => restored successfully from registry back up SOFTWARE => Could not copy SOFTWARE => Could not restore from registry back up SYSTEM => Could not copy SYSTEM => Could not restore from registry back up
==== End of Fixlog 16:45:20 ====
|
|