[lruizm]

Hello,

I need help please! I posted this same thing in Windows 8 but they told me that this could be a Malware issue and that I had to re-post my problem here. I hope you can help me.

I bought a new dell Inspiron 15r 5537 touchscreen with built in windows 8. I bought it in September but my sister gave it to me as a Xmas present so It's basically brand new. It was working perfectly but now it freezes after logging in. I've logged in in safe mode and it works fine for a while but then it freezes again.
I updated it to windows 8.1 and after that I turned it on once and worked fine, BUT when I was putting it away, it slipped and hit the table... It was a hard hit but nothing happened to the core so I figured it wasn't important. Anyway, when I tried to turn it on again, it froze in the login page. I freaked out and pressed the power button to reboot it and it was all black.... I tried a bunch of things like logging in to the setup and configuration, pressing f8, f2, f11, just to see if anything worked at all. (I didn't change anything but I did a system restore and a diagnose that included an error in the HDD saying "short self test unsuccessful"). After the system restore I tried to log in normally and it worked! The screen wasn't black anymore and I could log in, but then it froze on the tile screen. Now, I can sometimes open up control panel or chrome, but it freezes almost immediately... If I let it think, it gets unresponsive for about 10-15min and then it works again for like 5 sec and freezes again...
I can't do anything! I tried scanning for virus in both normal and safe mode but it freezes all the time. There was one time that got up to 75% and then it died... But it didn't find anything, the laptop is brand new so I'm not sure it's a virus.
Please help me, this just happened a week ago and I don't know what to do. I don't know if the hit could have done something to the hard drive... I looked at the support forum of dell and it said that I should check the connections of the hard drive with the system board because it could have moved with the hit. They also told me that maybe I needed to update the BIOS and that the black screen is a common problem with the windows 8.1 update and that I should update some video drivers.
Anyway I've tried downloading these things but For some reason I haven't been able to do so in safe mode and it is incredibly frustrating to try to do it in the standard mode with all the frozen moments and the incredibly slow response of the computer.
I have no idea if I should update the BIOS or even open up the laptop, I wanted to check with you first. What do you think?
Please please please help me figure out what's going on!

Thank you!

Lruizm

[Advertisements]

Hi and welcome back to Geeks to Go.

The current issues may not be malware related but we can check as follows...

Scan with Farbar Recovery Scan Tool:

Please download and save Farbar Recovery Scan Tool 64-Bit to a Flash/USB drive.

Then insert the Flash/USB drive into your machine....

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

For Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

On the System Recovery Options menu you will get the following options:


Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst64.exe and press Enter[/list] Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste the contents of the aforementioned notepad file in your next reply.

[Dakeyras]

Hi and welcome back to Geeks to Go.

The current issues may not be malware related but we can check as follows...

Scan with Farbar Recovery Scan Tool:

Please download and save Farbar Recovery Scan Tool 64-Bit to a Flash/USB drive.

Then insert the Flash/USB drive into your machine....

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

For Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

On the System Recovery Options menu you will get the following options:


Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst64.exe and press Enter[/list] Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste the contents of the aforementioned notepad file in your next reply.

[lruizm]

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-01-2014
Ran by SYSTEM on MININT-78NK1PM on 10-01-2014 13:57:46
Running from K:\
Windows 8 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188040 2013-05-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1307720 2013-04-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_PushButton] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1307720 2013-04-24] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [5762408 2013-03-05] (Dell Inc.)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [102928 2012-10-23] (CyberLink Corp.)
HKLM-x32\...\Run: [mcpltui_exe] - C:\Program Files\mcafee.com\agent\mcagent.exe [454160 2012-11-30] (McAfee, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [132224 2013-02-28] ( (Qualcomm Atheros Commnucations))
HKU\Valeria\...\Run: [DellSystemDetect] - C:\Users\Valeria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms [370 2014-01-07] ()

==================== Services (Whitelisted) =================

S2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [227968 2013-02-28] (Qualcomm Atheros Commnucations)
S2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [125440 2013-04-30] (Dell Inc.)
S2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [220856 2012-11-30] (McAfee, Inc.)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel® Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-05-02] (Intel Corporation)
S3 McAWFwk; C:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334760 2012-12-21] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [220856 2012-11-30] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [220856 2012-11-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [388240 2012-11-23] (McAfee, Inc.)
S2 McOobeSv2; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [220856 2012-11-30] (McAfee, Inc.)
S2 mcpltsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [220856 2012-11-30] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [220856 2012-11-30] (McAfee, Inc.)
S2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1007288 2012-10-06] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218320 2012-11-09] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [177680 2012-11-09] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [220856 2012-11-30] (McAfee, Inc.)
S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [224840 2013-05-10] (Realtek Semiconductor)
S2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1915480 2013-05-23] (SoftThinks SAS)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-07-23] (Microsoft Corporation)
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [81536 2013-03-02] (Atheros)

==================== Drivers (Whitelisted) ====================

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-02-28] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [69672 2012-11-09] (McAfee, Inc.)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-24] (OSR Open Systems Resources, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197264 2012-05-28] (McAfee, Inc.)
S3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99800 2013-05-02] (Intel Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [178840 2012-11-09] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309400 2012-11-09] (McAfee, Inc.)
S3 mfeavfk01; No ImagePath
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69168 2012-11-09] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515528 2012-11-09] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771096 2012-11-09] (McAfee, Inc.)
S3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [328976 2012-11-02] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [97208 2012-11-02] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [339776 2012-11-09] (McAfee, Inc.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [28400 2013-03-05] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [31984 2013-03-05] (Synaptics Incorporated)
S3 iscFlash; \??\C:\Users\Valeria\AppData\Local\Temp\7zSA25C.tmp\iscflashx64.sys [x]
S3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0; \??\c:\program files\my dell\pcdsrvc_x64.pkms [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-10 13:57 - 2014-01-10 13:57 - 00000000 ____D C:\FRST
2014-01-07 06:11 - 2014-01-07 06:11 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-07 06:10 - 2014-01-07 06:11 - 00000000 ____D C:\Users\Valeria\AppData\Local\Google
2014-01-07 06:10 - 2014-01-07 06:11 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-07 06:10 - 2014-01-07 06:10 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-07 06:08 - 2014-01-07 06:11 - 58649864 _____ C:\Users\Valeria\Downloads\iMEI_Intel_W8_X00_A01_Setup-C2DCT_ZPE.exe
2014-01-07 06:07 - 2014-01-07 06:07 - 01725064 _____ C:\Users\Valeria\Downloads\Adaware_Installer.exe
2014-01-07 06:07 - 2014-01-07 06:07 - 00000000 ____D C:\ProgramData\Lavasoft
2014-01-07 06:00 - 2014-01-07 06:00 - 12689121 _____ (Igor Pavlov) C:\Users\Valeria\Downloads\5537A06.exe
2014-01-07 02:57 - 2014-01-07 02:57 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\PCDr
2014-01-07 01:48 - 2014-01-10 04:51 - 00000000 ____D C:\Users\Valeria\AppData\Local\Deployment
2014-01-07 01:48 - 2014-01-07 01:48 - 00000000 ____D C:\Users\Valeria\AppData\Local\Apps\2.0
2014-01-07 01:47 - 2013-08-06 21:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\System32\tssdisai.dll
2014-01-07 01:47 - 2012-11-09 20:23 - 00148480 _____ (Microsoft Corporation) C:\Windows\System32\poqexec.exe
2014-01-07 01:47 - 2012-11-09 20:23 - 00132608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2014-01-07 01:47 - 2012-11-09 20:22 - 00126976 _____ (Microsoft Corporation) C:\Windows\System32\RDWebAI.dll
2014-01-07 01:47 - 2012-11-09 20:22 - 00122880 _____ (Microsoft Corporation) C:\Windows\System32\VmHostAI.dll
2014-01-07 01:47 - 2012-11-09 20:20 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\appserverai.dll
2014-01-07 01:37 - 2014-01-07 01:37 - 00000000 ____D C:\Users\Valeria\AppData\Local\softthinks
2014-01-07 01:37 - 2013-05-23 17:37 - 00000094 ____H C:\DBAR_Ver.txt
2014-01-07 00:19 - 2014-01-07 01:37 - 00000000 ____D C:\ProgramData\softthinks
2014-01-07 00:19 - 2014-01-07 00:19 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-01-07 00:19 - 2014-01-07 00:19 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Intel Corporation
2014-01-06 23:33 - 2014-01-07 06:50 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-623228269-1861945481-2527717363-1001
2014-01-05 17:34 - 2014-01-05 17:34 - 00000000 ____D C:\Windows\SMINST
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\Documents\Bluetooth Folder
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Leadertech
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Atheros
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\AppData\Local\BMExplorer
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\ProgramData\Atheros
2014-01-05 15:58 - 2014-01-05 15:58 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Macromedia
2014-01-05 15:58 - 2014-01-05 15:58 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Adobe
2014-01-05 15:58 - 2014-01-05 15:58 - 00000000 ____D C:\Users\Valeria\AppData\Local\Power2Go8
2014-01-05 15:57 - 2014-01-05 16:10 - 00000000 ____D C:\Users\Valeria\AppData\Local\Packages
2014-01-05 15:57 - 2014-01-05 16:10 - 00000000 ____D C:\users\Valeria
2014-01-05 15:57 - 2014-01-05 16:10 - 00000000 ____D C:\ProgramData\PRICache
2014-01-05 15:57 - 2014-01-05 15:57 - 00000020 ___SH C:\Users\Valeria\ntuser.ini
2014-01-05 15:57 - 2014-01-05 15:57 - 00000000 ____D C:\Users\Valeria\AppData\Local\VirtualStore

==================== One Month Modified Files and Folders =======

2014-01-10 13:57 - 2014-01-10 13:57 - 00000000 ____D C:\FRST
2014-01-10 04:52 - 2013-07-23 10:55 - 01620695 _____ C:\Windows\WindowsUpdate.log
2014-01-10 04:51 - 2014-01-07 01:48 - 00000000 ____D C:\Users\Valeria\AppData\Local\Deployment
2014-01-10 04:51 - 2012-07-25 23:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-07 07:00 - 2012-07-26 00:12 - 00000000 ____D C:\Windows\System32\sru
2014-01-07 07:00 - 2012-07-25 23:28 - 00850046 _____ C:\Windows\System32\PerfStringBackup.INI
2014-01-07 06:58 - 2013-07-23 11:22 - 00000000 ____D C:\Program Files (x86)\Dell Backup and Recovery
2014-01-07 06:50 - 2014-01-06 23:33 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-623228269-1861945481-2527717363-1001
2014-01-07 06:11 - 2014-01-07 06:11 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-07 06:11 - 2014-01-07 06:10 - 00000000 ____D C:\Users\Valeria\AppData\Local\Google
2014-01-07 06:11 - 2014-01-07 06:10 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-07 06:11 - 2014-01-07 06:08 - 58649864 _____ C:\Users\Valeria\Downloads\iMEI_Intel_W8_X00_A01_Setup-C2DCT_ZPE.exe
2014-01-07 06:10 - 2014-01-07 06:10 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-07 06:07 - 2014-01-07 06:07 - 01725064 _____ C:\Users\Valeria\Downloads\Adaware_Installer.exe
2014-01-07 06:07 - 2014-01-07 06:07 - 00000000 ____D C:\ProgramData\Lavasoft
2014-01-07 06:00 - 2014-01-07 06:00 - 12689121 _____ (Igor Pavlov) C:\Users\Valeria\Downloads\5537A06.exe
2014-01-07 05:55 - 2013-07-23 10:38 - 00000000 ____D C:\DELL
2014-01-07 04:12 - 2012-07-25 21:37 - 00000000 ____D C:\Windows\servicing
2014-01-07 02:57 - 2014-01-07 02:57 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\PCDr
2014-01-07 02:55 - 2013-07-23 11:15 - 00000000 ____D C:\ProgramData\PCDr
2014-01-07 01:48 - 2014-01-07 01:48 - 00000000 ____D C:\Users\Valeria\AppData\Local\Apps\2.0
2014-01-07 01:37 - 2014-01-07 01:37 - 00000000 ____D C:\Users\Valeria\AppData\Local\softthinks
2014-01-07 01:37 - 2014-01-07 00:19 - 00000000 ____D C:\ProgramData\softthinks
2014-01-07 00:19 - 2014-01-07 00:19 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-01-07 00:19 - 2014-01-07 00:19 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Intel Corporation
2014-01-07 00:19 - 2013-07-23 11:27 - 00000000 ____D C:\ProgramData\McAfee
2014-01-05 17:34 - 2014-01-05 17:34 - 00000000 ____D C:\Windows\SMINST
2014-01-05 16:54 - 2012-07-26 00:12 - 00000000 ____D C:\Windows\rescache
2014-01-05 16:52 - 2013-07-23 10:43 - 00001854 _____ C:\Windows\PFRO.log
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\Documents\Bluetooth Folder
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Leadertech
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Atheros
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\Users\Valeria\AppData\Local\BMExplorer
2014-01-05 16:11 - 2014-01-05 16:11 - 00000000 ____D C:\ProgramData\Atheros
2014-01-05 16:10 - 2014-01-05 15:57 - 00000000 ____D C:\Users\Valeria\AppData\Local\Packages
2014-01-05 16:10 - 2014-01-05 15:57 - 00000000 ____D C:\users\Valeria
2014-01-05 16:10 - 2014-01-05 15:57 - 00000000 ____D C:\ProgramData\PRICache
2014-01-05 15:58 - 2014-01-05 15:58 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Macromedia
2014-01-05 15:58 - 2014-01-05 15:58 - 00000000 ____D C:\Users\Valeria\AppData\Roaming\Adobe
2014-01-05 15:58 - 2014-01-05 15:58 - 00000000 ____D C:\Users\Valeria\AppData\Local\Power2Go8
2014-01-05 15:58 - 2012-07-25 21:26 - 00262144 ___SH C:\Windows\System32\config\ELAM
2014-01-05 15:57 - 2014-01-05 15:57 - 00000020 ___SH C:\Users\Valeria\ntuser.ini
2014-01-05 15:57 - 2014-01-05 15:57 - 00000000 ____D C:\Users\Valeria\AppData\Local\VirtualStore
2014-01-05 15:57 - 2013-07-23 11:27 - 00000000 ____D C:\Program Files (x86)\McAfee
2014-01-05 15:57 - 2012-07-26 00:12 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2014-01-05 15:57 - 2012-07-26 00:12 - 00000000 ____D C:\Windows\WinStore

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2014-01-07 04:09:06

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 5860.96 MB
Available physical RAM: 5111.59 MB
Total Pagefile: 5860.96 MB
Available Pagefile: 5121.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:452.57 GB) (Free:415.06 GB) NTFS
Drive e: (ESP) (Fixed) (Total:0.48 GB) (Free:0.42 GB) FAT32 ==>[System with boot components (obtained from reading drive)]
Drive f: (DIAGS) (Fixed) (Total:0.04 GB) (Free:0.04 GB) FAT32
Drive g: () (Fixed) (Total:0.12 GB) (Free:0.11 GB) NTFS
Drive h: (WINRETOOLS) (Fixed) (Total:0.48 GB) (Free:0.2 GB) NTFS
Drive i: () (Fixed) (Total:0.34 GB) (Free:0.31 GB) NTFS
Drive j: (PBR Image) (Fixed) (Total:11.72 GB) (Free:0.71 GB) NTFS
Drive k: (My Passport) (Fixed) (Total:931.48 GB) (Free:507.4 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: B4D75D39)

Partition: GPT Partition Type
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931 GB) (Disk ID: 0003F448)
Partition 1: (Not Active) - (Size=931 GB) - (Type=07 NTFS)


LastRegBack: 2013-07-23 10:43

==================== End Of Log ============================

[Dakeyras]

Hi.

Lets proceed as follows shall we...

Please note: If successful your machine may be back to its prior state before upgrading to W8.1, so your call if you wish to proceed or not. If you would prefer not to my best advise would be seek further assistance with the Computer Manufacturer since the machine should still be under the twelve month warranty. Or consider invoking the Recovery Partition etc and start over.

Custom FRST Script:

Please download the attached fixlist.txt(see below) and save it to your flash drive.

[attachment=68493:fixlist.txt]

• Now please enter System Recovery Options on the problem machine again and then select Command Prompt.
• Run FRST64 again as outlined in my prior post and then press the Fix button just once and wait.
• The tool will make a log on the flashdrive (Fixlog.txt). Please copy and paste the contents of the aforementioned notepad file in your next reply
• Reboot the machine back into Normal Mode.

Note: This above custom script was created specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Next:

Let myself know when completed the above, if any problems encountered and if your machine is now able to boot up into Normal Mode successfully. If so all good and merely inform myself but make no other changes and we will then go from there, thank you.

[lruizm]

Hi,

here is the fix log:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-01-2014
Ran by SYSTEM at 2014-01-10 14:44:50 Run:1
Running from D:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Start
LastRegBack: 2013-07-23 10:43
End

*****************

DEFAULT hive was successfully copied to System32\config\HiveBackup
DEFAULT hive was successfully restored from registry back up.
SAM hive was successfully copied to System32\config\HiveBackup
SAM hive was successfully restored from registry back up.
SECURITY hive was successfully copied to System32\config\HiveBackup
SECURITY hive was successfully restored from registry back up.
SOFTWARE hive was successfully copied to System32\config\HiveBackup
SOFTWARE hive was successfully restored from registry back up.
SYSTEM hive was successfully copied to System32\config\HiveBackup
SYSTEM hive was successfully restored from registry back up.

==== End of Fixlog ====

I'm waiting for the computer to boot normally. The "automatic repair" screen appeared, I clicked on "repair" and now I'm waiting for it to boot. It is still at the Dell logo screen.

[Dakeyras]

Acknowledged, if it still will not boot...remove the USB drive if still connected and anything else that may be attached and try to reboot normally again etc.

[lruizm]

How long should I wait? it's still at the Dell logo screen and nothing seems to be you know... moving?

[lruizm]

Done that, I dettached everything...
nothing yet

[Dakeyras]

Hi.

Has your machine completed the repairs and or still doing so ? In the event it is the latter reboot your machine back into the System Recovery Environment >> Command Prompt

At the Command Prompt, type in sfc /scannow and depress the enter/return key. This may take some time to complete/process.

Once done so, then type in the following at the Command Prompt:-

chkdsk /r

This also may take some time to complete. Once it has type in exit and depress the enter/return key, then reboot your machine back into Normal Mode.

Let myself know the outcome in your next reply and if any problems encountered, thank you.

[lruizm]

Hi,

This is what it says:

X::\windows\system32>sic scannow
Windows Resource Protection could not start the repair service.

X:\windows\system32>chkdsk/r
The type of the file is NTFS.
Cannot lock current drive.
Windows cannot run disk checking on this volume because it is write protected.

[Dakeyras]

Hi.

Reboot your machine back into the System Recovery Environment >> Command Prompt

At the Command Prompt, type in Repair-WindowsImage -Online -RestoreHealth and depress the enter/return key. If this works, then try

sfc /scannow again. In the event both fail/do not work you could consider trying a Reset of Windows 8 . Not a lot else I can advise to be honest as it appears the Operating System may be damaged beyond any feasible repair and you just may have to consider invoking the Recovery Partition as I mentioned in a prior post.

[lruizm]

Hi,
It says that Repair-WindowsImage-Online-RestoreHealth is not recognized as an internal or external command, operable program or batch file.
Am I typing it incorrectly?

[Dakeyras]

Only other recourse I can advise I'm afraid is what I mentioned prior:-

consider trying a Reset of Windows 8 . Not a lot else I can advise to be honest as it appears the Operating System may be damaged beyond any feasible repair and you just may have to consider invoking the Recovery Partition as I mentioned in a prior post.

Or seek further assistance again with the IT Tech staff as these current problems are not malware related but specifically a damaged Operating System.

[lruizm]

Ok, thanks
Could the OS may have been damaged with the hit I mentioned before?

[Dakeyras]

You're welcome...

I doubt the actual Operating System per-say would have been damaged but feasible the actual Hard-Drive itself is and hence the current problem(s). Though either way Malware is not the culprit.