Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

My computer is full of virus and I am not able to removed them and hav


  • This topic is locked This topic is locked

#1
leahcase

leahcase

    Member

  • Member
  • PipPipPip
  • 229 posts

I have download spybot and ccleaner as well avast and it still says that I still have virus.. and no matter what I do I can not removed them.. I hook up my other computer up to my TV.. and still are having issues with virus...Please help me....Thank you for all of your help..... :yes:


  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi, first I need to see what you have

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Select additions at the bottom
  • Press Scan button.
    frst.JPG
  • It will produce a log called FRST.txt in the same directory the tool is run from.
  • Please attach both logs generated.
THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it.
You may be offered the option of using virtualisation, accept that
When it offers to download the virus database allow that as well
Click the "Scan" button to start scan

AswMBR%20scan.JPG


On completion of the scan click save log, save it to your desktop and post in your next reply
  • 0

#3
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-09-2014
Ran by JIMS (administrator) on JIM-PC on 17-09-2014 11:22:56
Running from C:\Users\JIMS\Downloads
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(ShopAtHome.com) C:\Users\JIMS\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe
(ShopAtHome.com) C:\Users\JIMS\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\ehome\mcupdate.exe
(Microsoft Corporation) C:\Windows\ehome\mcupdate.exe
(Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\ielowutil.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [ShopAtHomeWatcher] => C:\Users\JIMS\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe [128656 2013-11-15] (ShopAtHome.com)
HKLM\...\Run: [ShopAtHomeUpdater] => C:\Users\JIMS\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe [201872 2013-11-15] (ShopAtHome.com)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-12] (AVAST Software)
HKU\.DEFAULT\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil32_11_9_900_117_ActiveX.exe -update activex
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-311414978-4222158670-3689117363-1000\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-311414978-4222158670-3689117363-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-311414978-4222158670-3689117363-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
URLSearchHook: HKCU - (No Name) - {5fdb0cd8-5760-44d1-8d13-a78bf558c3c7} - C:\Program Files\InboxAce_1g\bar\1.bin\1gSrcAs.dll No File
SearchScopes: HKLM - {8fe8d013-c3fd-4802-af48-79274e9f969e} URL = http://search.tb.ask...r={searchTerms}
SearchScopes: HKCU - {8fe8d013-c3fd-4802-af48-79274e9f969e} URL = http://search.tb.ask...r={searchTerms}
BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: No Name -> {66516A07-F617-488A-90CF-4E690CFB3C5F} ->  No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: No Name -> {9359da42-06fb-46f2-9e4a-05c05b98a5ef} ->  No File
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: No Name -> {d5a1d22b-9e17-454f-8ecd-83c578fb3983} ->  No File
Toolbar: HKLM - No Name - {3775afd7-5921-4571-968f-85a631203d1c} -  No File
Toolbar: HKLM - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} -  No File
Toolbar: HKCU - No Name - {3775AFD7-5921-4571-968F-85A631203D1C} -  No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 208.180.42.68 208.180.42.100
 
FireFox:
========
FF Plugin: @InboxAce_1g.com/Plugin -> C:\Program Files\InboxAce_1g\bar\1.bin\NP1gStub.dll No File
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-06-22]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-09-12]
 
Chrome: 
=======
CHR StartupUrls: Default -> "https://www.yahoo.co...st&type=odc089"
CHR DefaultSearchKeyword: Default -> BF9FDF94B686A30B00ABC5AEBB1105D50529DF966E100F6AED89973D28AFD89D
CHR DefaultSearchProvider: Default -> FDCFAFDDDFCD49C0FD554001CC4E10F4FC4B959CB4B851EE14F178C6191EA135
CHR DefaultSearchURL: Default -> BF1A2D1DD1E04FC5DA5C9E49EC7EA3206102D5A44622F52A71684AF2D4653270
CHR CustomProfile: C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-12]
CHR Extension: (Google Docs) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-12]
CHR Extension: (Google Drive) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-12]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-12]
CHR Extension: (YouTube) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-12]
CHR Extension: (Google Search) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-12]
CHR Extension: (Google Sheets) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-12]
CHR Extension: (avast! Online Security) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-09-12]
CHR Extension: (Google Wallet) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-12]
CHR Extension: (Gmail) - C:\Users\JIMS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-12]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-09-12]
 
========================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-12] (AVAST Software)
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-09-12] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-09-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55112 2014-09-12] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-09-12] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-09-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-09-12] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57800 2014-09-12] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-09-12] ()
R3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE1200vista.sys [1073216 2013-02-06] (Broadcom Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-09-17 11:22 - 2014-09-17 11:24 - 00011104 _____ () C:\Users\JIMS\Downloads\FRST.txt
2014-09-17 11:21 - 2014-09-17 11:23 - 00000000 ____D () C:\FRST
2014-09-17 11:21 - 2014-09-17 11:21 - 01097728 _____ (Farbar) C:\Users\JIMS\Downloads\FRST.exe
2014-09-17 11:18 - 2014-09-17 11:19 - 00017708 _____ () C:\Users\JIMS\Desktop\RTS ..FIBAR..FIRST...htm
2014-09-17 11:17 - 2014-09-17 11:17 - 02105856 _____ (Farbar) C:\Users\JIMS\Downloads\FRST64 (1).exe
2014-09-17 11:16 - 2014-09-17 11:17 - 02105856 _____ (Farbar) C:\Users\JIMS\Downloads\FRST64.exe
2014-09-15 20:58 - 2014-09-17 11:10 - 00000438 _____ () C:\Windows\Tasks\SparkTrust Registration3.job
2014-09-15 20:53 - 2014-09-15 20:53 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\SparkTrust
2014-09-15 20:53 - 2014-09-15 20:53 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\DriverCure
2014-09-15 20:52 - 2014-09-17 11:10 - 00000619 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00001117 _____ () C:\Users\JIMS\Desktop\SparkTrust PC Cleaner Plus.lnk
2014-09-15 20:52 - 2014-09-15 20:52 - 00000572 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus Startup.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3_triggeronce.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\ProgramData\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Program Files\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Program Files\Common Files\SparkTrust
2014-09-15 20:51 - 2014-09-15 20:51 - 06764848 _____ (SparkTrust) C:\Users\JIMS\Downloads\SparkTrust PC Cleaner Plus Setup_da1e7de_.exe
2014-09-15 20:30 - 2014-09-15 20:30 - 00043432 _____ () C:\Windows\PFRO.log
2014-09-15 20:14 - 2014-09-15 20:14 - 00001844 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-09-13 04:14 - 2014-06-26 17:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-09-13 04:14 - 2014-06-26 17:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-09-13 04:14 - 2014-06-26 17:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-09-13 04:14 - 2014-06-05 23:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-09-13 04:12 - 2014-08-15 09:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-13 04:12 - 2014-08-15 09:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-13 04:12 - 2014-08-15 09:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-13 04:12 - 2014-08-15 09:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-13 04:12 - 2014-08-15 09:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-13 04:12 - 2014-08-15 09:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-13 04:12 - 2014-08-15 09:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-13 04:12 - 2014-08-15 09:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-13 04:12 - 2014-08-15 09:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-13 04:12 - 2014-08-15 09:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-13 04:12 - 2014-08-15 09:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-13 04:12 - 2014-08-15 09:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-13 04:12 - 2014-08-15 09:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-13 04:12 - 2014-08-15 09:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-13 04:06 - 2014-08-22 20:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-13 04:06 - 2014-08-22 18:26 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-12 22:48 - 2014-09-12 22:48 - 00000775 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-09-12 22:48 - 2014-09-12 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-09-12 22:48 - 2014-09-12 22:48 - 00000000 ____D () C:\Program Files\CCleaner
2014-09-12 22:47 - 2014-09-12 22:48 - 04901352 _____ (Piriform Ltd) C:\Users\JIMS\Downloads\ccsetup417 (2).exe
2014-09-12 22:41 - 2014-09-12 22:42 - 04901352 _____ (Piriform Ltd) C:\Users\JIMS\Downloads\ccsetup417 (1).exe
2014-09-12 22:41 - 2014-09-12 22:41 - 04901352 _____ (Piriform Ltd) C:\Users\JIMS\Downloads\ccsetup417.exe
2014-09-12 22:22 - 2014-09-12 22:22 - 00000000 ____D () C:\ProgramData\Cisco Systems
2014-09-12 17:56 - 2014-09-12 17:56 - 00001048 _____ () C:\Users\JIMS\Desktop\Spybot - Search & Destroy (for blind users).lnk
2014-09-12 17:56 - 2014-09-12 17:56 - 00001026 _____ () C:\Users\JIMS\Desktop\Spybot - Search & Destroy.lnk
2014-09-12 17:56 - 2014-09-12 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2014-09-12 17:55 - 2014-09-12 22:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-09-12 17:55 - 2014-09-12 17:56 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy
2014-09-12 17:53 - 2014-09-12 17:54 - 16409960 _____ (Safer Networking Limited ) C:\Users\JIMS\Downloads\spybotsd162.exe
2014-09-12 17:35 - 2014-09-12 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopAtHome.com Helper
2014-09-12 17:25 - 2014-09-12 17:25 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\AVAST Software
2014-09-12 17:19 - 2014-06-02 05:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-12 17:19 - 2014-04-26 11:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-09-12 17:19 - 2014-03-25 08:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-09-12 17:18 - 2014-06-02 05:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-09-12 17:18 - 2014-06-02 05:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-12 17:18 - 2014-06-02 05:30 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-09-12 17:18 - 2014-06-02 03:56 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-09-12 17:17 - 2014-04-04 21:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-09-12 17:17 - 2013-10-29 21:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2014-09-12 17:17 - 2013-10-29 20:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-09-12 17:17 - 2013-10-29 19:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-09-12 17:16 - 2014-09-15 20:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-09-12 17:16 - 2014-06-13 19:44 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-09-12 17:16 - 2014-06-13 19:33 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-09-12 17:16 - 2014-06-06 03:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-09-12 17:15 - 2014-09-12 17:15 - 00000000 ____D () C:\ProgramData\Google
2014-09-12 17:15 - 2014-07-07 19:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-12 17:13 - 2014-09-12 17:34 - 00001970 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-12 17:13 - 2014-09-12 17:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-09-12 17:13 - 2014-05-30 01:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-09-12 17:11 - 2014-09-17 11:11 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-12 17:11 - 2014-09-17 11:10 - 00000878 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-12 17:11 - 2014-09-12 17:26 - 00000000 ____D () C:\Users\JIMS\AppData\Local\Google
2014-09-12 17:11 - 2014-09-12 17:15 - 00000000 ____D () C:\Program Files\Google
2014-09-12 17:11 - 2014-03-09 20:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-09-12 17:11 - 2014-03-09 20:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-09-12 17:10 - 2014-09-12 17:15 - 00414520 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00779536 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00276432 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-09-12 17:10 - 2014-09-12 17:10 - 00192352 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00057800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00055112 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-09-12 17:10 - 2014-09-12 17:10 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-09-12 17:10 - 2014-02-05 20:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-09-12 17:10 - 2013-10-22 02:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-09-12 17:10 - 2013-10-10 21:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-09-12 17:10 - 2013-10-10 21:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-09-12 17:10 - 2013-10-10 21:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2014-09-12 17:10 - 2013-10-10 19:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-09-12 17:10 - 2013-10-10 19:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-09-12 17:09 - 2014-09-12 17:09 - 00000000 ____D () C:\Program Files\AVAST Software
2014-09-12 17:07 - 2014-09-12 17:09 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-09-12 17:04 - 2014-09-12 17:04 - 91906368 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup.exe
2014-09-12 17:04 - 2014-09-12 17:04 - 91906368 _____ (AVAST Software) C:\Users\JIMS\Desktop\avast_free_antivirus_setup.exe
2014-09-12 17:00 - 2014-09-12 17:02 - 91906368 _____ (AVAST Software) C:\Users\JIMS\Downloads\avast_free_antivirus_setup.exe
2014-09-12 16:53 - 2014-01-30 02:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-09-12 16:45 - 2014-09-12 16:45 - 00000000 ____D () C:\Program Files\Microsoft.NET
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-09-17 11:24 - 2014-09-17 11:22 - 00011104 _____ () C:\Users\JIMS\Downloads\FRST.txt
2014-09-17 11:23 - 2014-09-17 11:21 - 00000000 ____D () C:\FRST
2014-09-17 11:21 - 2014-09-17 11:21 - 01097728 _____ (Farbar) C:\Users\JIMS\Downloads\FRST.exe
2014-09-17 11:19 - 2014-09-17 11:18 - 00017708 _____ () C:\Users\JIMS\Desktop\RTS ..FIBAR..FIRST...htm
2014-09-17 11:17 - 2014-09-17 11:17 - 02105856 _____ (Farbar) C:\Users\JIMS\Downloads\FRST64 (1).exe
2014-09-17 11:17 - 2014-09-17 11:16 - 02105856 _____ (Farbar) C:\Users\JIMS\Downloads\FRST64.exe
2014-09-17 11:17 - 2008-01-20 20:35 - 01306780 _____ () C:\Windows\WindowsUpdate.log
2014-09-17 11:11 - 2014-09-12 17:11 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-17 11:11 - 2006-11-02 06:18 - 00000000 ____D () C:\Windows\tracing
2014-09-17 11:10 - 2014-09-15 20:58 - 00000438 _____ () C:\Windows\Tasks\SparkTrust Registration3.job
2014-09-17 11:10 - 2014-09-15 20:52 - 00000619 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D.job
2014-09-17 11:10 - 2014-09-12 17:11 - 00000878 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-17 11:10 - 2013-02-15 18:34 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-16 04:56 - 2006-11-02 07:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-16 04:56 - 2006-11-02 07:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-15 20:53 - 2014-09-15 20:53 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\SparkTrust
2014-09-15 20:53 - 2014-09-15 20:53 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\DriverCure
2014-09-15 20:52 - 2014-09-15 20:52 - 00001117 _____ () C:\Users\JIMS\Desktop\SparkTrust PC Cleaner Plus.lnk
2014-09-15 20:52 - 2014-09-15 20:52 - 00000572 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus Startup.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3_triggeronce.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\ProgramData\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Program Files\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Program Files\Common Files\SparkTrust
2014-09-15 20:51 - 2014-09-15 20:51 - 06764848 _____ (SparkTrust) C:\Users\JIMS\Downloads\SparkTrust PC Cleaner Plus Setup_da1e7de_.exe
2014-09-15 20:36 - 2013-09-28 04:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-15 20:31 - 2013-02-01 22:06 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-09-15 20:31 - 2006-11-02 08:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-15 20:30 - 2014-09-15 20:30 - 00043432 _____ () C:\Windows\PFRO.log
2014-09-15 20:20 - 2006-11-02 08:01 - 00023604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-15 20:14 - 2014-09-15 20:14 - 00001844 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-09-15 20:14 - 2014-09-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-09-13 05:05 - 2006-11-02 06:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-13 04:41 - 2006-11-02 05:33 - 00703388 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-13 04:35 - 2006-11-02 07:47 - 00228936 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-13 04:32 - 2006-11-02 07:37 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-12 22:59 - 2013-02-19 23:36 - 00000000 ____D () C:\Users\JIMS\Desktop\JIM
2014-09-12 22:50 - 2014-09-12 17:55 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-09-12 22:50 - 2013-07-20 04:02 - 00000000 ____D () C:\Windows\Minidump
2014-09-12 22:50 - 2013-02-01 22:26 - 00000000 ____D () C:\Windows\Panther
2014-09-12 22:48 - 2014-09-12 22:48 - 00000775 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-09-12 22:48 - 2014-09-12 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-09-12 22:48 - 2014-09-12 22:48 - 00000000 ____D () C:\Program Files\CCleaner
2014-09-12 22:48 - 2014-09-12 22:47 - 04901352 _____ (Piriform Ltd) C:\Users\JIMS\Downloads\ccsetup417 (2).exe
2014-09-12 22:42 - 2014-09-12 22:41 - 04901352 _____ (Piriform Ltd) C:\Users\JIMS\Downloads\ccsetup417 (1).exe
2014-09-12 22:41 - 2014-09-12 22:41 - 04901352 _____ (Piriform Ltd) C:\Users\JIMS\Downloads\ccsetup417.exe
2014-09-12 22:22 - 2014-09-12 22:22 - 00000000 ____D () C:\ProgramData\Cisco Systems
2014-09-12 22:11 - 2013-11-30 17:19 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\ShopAtHome
2014-09-12 22:11 - 2013-11-19 02:37 - 00000000 ____D () C:\Program Files\InboxAce_1g
2014-09-12 17:56 - 2014-09-12 17:56 - 00001048 _____ () C:\Users\JIMS\Desktop\Spybot - Search & Destroy (for blind users).lnk
2014-09-12 17:56 - 2014-09-12 17:56 - 00001026 _____ () C:\Users\JIMS\Desktop\Spybot - Search & Destroy.lnk
2014-09-12 17:56 - 2014-09-12 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2014-09-12 17:56 - 2014-09-12 17:55 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy
2014-09-12 17:54 - 2014-09-12 17:53 - 16409960 _____ (Safer Networking Limited ) C:\Users\JIMS\Downloads\spybotsd162.exe
2014-09-12 17:35 - 2014-09-12 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopAtHome.com Helper
2014-09-12 17:34 - 2014-09-12 17:13 - 00001970 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-12 17:34 - 2013-02-15 18:34 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-12 17:34 - 2013-02-15 18:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-12 17:26 - 2014-09-12 17:11 - 00000000 ____D () C:\Users\JIMS\AppData\Local\Google
2014-09-12 17:25 - 2014-09-12 17:25 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\AVAST Software
2014-09-12 17:15 - 2014-09-12 17:15 - 00000000 ____D () C:\ProgramData\Google
2014-09-12 17:15 - 2014-09-12 17:11 - 00000000 ____D () C:\Program Files\Google
2014-09-12 17:15 - 2014-09-12 17:10 - 00414520 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-09-12 17:13 - 2014-09-12 17:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-09-12 17:10 - 2014-09-12 17:10 - 00779536 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00276432 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-09-12 17:10 - 2014-09-12 17:10 - 00192352 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00057800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00055112 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-09-12 17:10 - 2014-09-12 17:10 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-09-12 17:10 - 2014-09-12 17:10 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-09-12 17:09 - 2014-09-12 17:09 - 00000000 ____D () C:\Program Files\AVAST Software
2014-09-12 17:09 - 2014-09-12 17:07 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-09-12 17:04 - 2014-09-12 17:04 - 91906368 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup.exe
2014-09-12 17:04 - 2014-09-12 17:04 - 91906368 _____ (AVAST Software) C:\Users\JIMS\Desktop\avast_free_antivirus_setup.exe
2014-09-12 17:02 - 2014-09-12 17:00 - 91906368 _____ (AVAST Software) C:\Users\JIMS\Downloads\avast_free_antivirus_setup.exe
2014-09-12 16:45 - 2014-09-12 16:45 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-08-29 13:01 - 2006-11-02 05:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-25 06:53 - 2013-02-15 17:50 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-22 20:03 - 2014-09-13 04:06 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-22 18:26 - 2014-09-13 04:06 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
TDL4: custom:26000022 <===== ATTENTION!
 
 
LastRegBack: 2014-09-15 20:36
 

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-09-2014
Ran by JIMS at 2014-09-17 11:25:04
Running from C:\Users\JIMS\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
avast! Free Antivirus (HKLM\...\Avast) (Version: 9.0.2021 - AVAST Software)
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
ShopAtHome.com Helper (HKLM\...\ShopAtHome.com Helper) (Version: 7.0.4.14 - ShopAtHome.com) <==== ATTENTION
SparkTrust PC Cleaner Plus (HKLM\...\{35827710-D042-428B-A1E5-E20E12D2FEB9}) (Version: 3.2.10.0 - SparkTrust) <==== ATTENTION
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
CustomCLSID: HKU\S-1-5-21-311414978-4222158670-3689117363-1000_Classes\CLSID\{5fdb0cd8-5760-44d1-8d13-a78bf558c3c7}\InprocServer32 -> C:\Program Files\InboxAce_1g\bar\1.bin\1gSrcAs.dll No File
 
==================== Restore Points  =========================
 
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2006-11-02 05:23 - 2006-09-18 16:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: {1111951B-B867-45B1-AA77-DC81EED7B132} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-12] (Adobe Systems Incorporated)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {48533AD9-35B3-41D6-9A33-E209AF4896B1} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-12] (AVAST Software)
Task: {4C6338C2-BBC2-4B08-BA04-FE7090E74FC5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd)
Task: {7D5193CB-F8D1-444B-9741-79553B00398B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-09-12] (Google Inc.)
Task: {9D88B2C9-57C2-45EB-B375-6E4FF6D2F3D1} - System32\Tasks\SparkTrust Update Version3 => c:\program files\common files\sparktrust\uus3\Update3.exe [2014-07-31] (SparkTrust Systems) <==== ATTENTION
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {C6A38807-0D1C-4C2D-B613-39EF2C27FCE0} - System32\Tasks\SparkTrust Registration3 => Rundll32.exe "C:\Program Files\Common Files\SparkTrust\UUS3\UUS3.dll" RunUns <==== ATTENTION
Task: {CE17A388-51AF-4EE6-863B-DEB2372B06B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-09-12] (Google Inc.)
Task: {D1813E9B-3C54-4F19-8FB8-8CF75424DF4B} - System32\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe [2014-07-31] (SparkTrust) <==== ATTENTION
Task: {D9F32586-21E9-4B05-BE83-439BBE9E8AB8} - System32\Tasks\SparkTrust Update Version3_triggeronce => c:\program files\common files\sparktrust\uus3\Update3.exe [2014-07-31] (SparkTrust Systems) <==== ATTENTION
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: {EEDB06D4-8D65-45AE-897D-80E8906A9ED2} - System32\Tasks\SparkTrust PC Cleaner Plus Startup => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe [2014-07-31] (SparkTrust) <==== ATTENTION
Task: {F028371E-323D-48E5-B0F0-F1F8CD2CA1B8} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SparkTrust PC Cleaner Plus Startup.job => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D.job => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust Registration3.job => C:\Program Files\Common Files\SparkTrust\UUS3\UUS3.dll <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust Update Version3.job => c:\program files\common files\sparktrust\uus3\Update3.exe <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust Update Version3_triggeronce.job => c:\program files\common files\sparktrust\uus3\Update3.exe <==== ATTENTION
 
==================== Loaded Modules (whitelisted) =============
 
2014-09-12 17:09 - 2014-09-12 17:09 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-09-15 16:44 - 2014-09-15 16:44 - 02862592 _____ () C:\Program Files\AVAST Software\Avast\defs\14091501\algo.dll
2014-09-17 11:11 - 2014-09-17 11:11 - 02865152 _____ () C:\Program Files\AVAST Software\Avast\defs\14091701\algo.dll
2006-11-02 05:25 - 2006-11-02 04:46 - 00061440 _____ () C:\Windows\system32\igfxTMM.dll
2014-09-12 17:09 - 2014-09-12 17:10 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-09-12 17:13 - 2014-09-03 22:01 - 08577864 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-12 17:13 - 2014-09-03 22:01 - 00331592 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-12 17:13 - 2014-09-03 22:01 - 01660232 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (whitelisted) =============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
(Currently there is no automatic fix for this section.)
 
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (09/16/2014 02:39:13 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point on volume (Process = C:\Windows\system32\svchost.exe -k netsvcs; Descripton = Windows Update; Hr = 0x800423f4).
 
Error: (09/16/2014 02:39:13 AM) (Source: SPP) (EventID: 16387) (User: )
Description: Shadow copy creation failed because of error reported by ASR Writer.
 
More info: The parameter is incorrect. (0x80070057).
 
Error: (09/16/2014 00:06:59 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: The scheduled restore point could not be created.  Additional information: (0x800423f4).
 
Error: (09/16/2014 00:06:59 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point on volume (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Descripton = Scheduled Checkpoint; Hr = 0x800423f4).
 
Error: (09/16/2014 00:06:59 AM) (Source: SPP) (EventID: 16387) (User: )
Description: Shadow copy creation failed because of error reported by ASR Writer.
 
More info: The parameter is incorrect. (0x80070057).
 
Error: (09/15/2014 11:34:40 PM) (Source: System Restore) (EventID: 8210) (User: )
Description: The scheduled restore point could not be created.  Additional information: (0x800423f4).
 
Error: (09/15/2014 11:34:40 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point on volume (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Descripton = Scheduled Checkpoint; Hr = 0x800423f4).
 
Error: (09/15/2014 11:34:40 PM) (Source: SPP) (EventID: 16387) (User: )
Description: Shadow copy creation failed because of error reported by ASR Writer.
 
More info: The parameter is incorrect. (0x80070057).
 
Error: (09/15/2014 08:32:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/15/2014 08:13:59 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point on volume (Process = C:\Program Files\AVAST Software\Avast\setup\New\instup.exe Files\AVAST Software\Avast\setup\New\instup.exe" /instop:update_vps_and_program /session_id:12 /wait; Descripton = avast! antivirus system restore point; Hr = 0x800423f4).
 
 
System errors:
=============
Error: (09/15/2014 10:55:46 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {6295DF2D-35EE-11D1-8707-00C04FD93327}
 
Error: (09/15/2014 08:32:22 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
 
Error: (09/13/2014 04:35:57 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
 
Error: (09/13/2014 04:01:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070643Security Update for Windows Vista (KB2859537){992E6C42-7B83-4B97-8A93-F05D0859B149}201
 
Error: (09/13/2014 04:01:00 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070643Security Update for Windows Vista (KB2676562){70AAD413-AAB4-4C9D-B963-F4F3B1F6D3F9}108
 
Error: (09/12/2014 11:53:21 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
 
Error: (09/12/2014 11:32:35 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
 
Error: (09/12/2014 10:13:03 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
 
Error: (09/12/2014 04:43:31 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070643Security Update for Windows Vista (KB2859537){992E6C42-7B83-4B97-8A93-F05D0859B149}201
 
Error: (09/12/2014 04:43:31 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070643Security Update for Windows Vista (KB2676562){70AAD413-AAB4-4C9D-B963-F4F3B1F6D3F9}108
 
 
Microsoft Office Sessions:
=========================
Error: (09/16/2014 02:39:13 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x800423f4
 
Error: (09/16/2014 02:39:13 AM) (Source: SPP) (EventID: 16387) (User: )
Description: ASR WriterThe parameter is incorrect. (0x80070057)
 
Error: (09/16/2014 00:06:59 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: 0x800423f4
 
Error: (09/16/2014 00:06:59 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationScheduled Checkpoint0x800423f4
 
Error: (09/16/2014 00:06:59 AM) (Source: SPP) (EventID: 16387) (User: )
Description: ASR WriterThe parameter is incorrect. (0x80070057)
 
Error: (09/15/2014 11:34:40 PM) (Source: System Restore) (EventID: 8210) (User: )
Description: 0x800423f4
 
Error: (09/15/2014 11:34:40 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationScheduled Checkpoint0x800423f4
 
Error: (09/15/2014 11:34:40 PM) (Source: SPP) (EventID: 16387) (User: )
Description: ASR WriterThe parameter is incorrect. (0x80070057)
 
Error: (09/15/2014 08:32:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/15/2014 08:13:59 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files\AVAST Software\Avast\setup\New\instup.exe Files\AVAST Software\Avast\setup\New\instup.exe" /instop:update_vps_and_program /session_id:12 /waitavast! antivirus system restore point0x800423f4
 
 
CodeIntegrity Errors:
===================================
  Date: 2013-11-07 11:43:52.130
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-11-07 11:43:51.958
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-10-25 23:58:07.117
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-10-25 23:58:06.945
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-10-11 20:54:55.037
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-10-11 20:54:54.866
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-10-03 04:03:01.940
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-10-03 04:03:01.753
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-09-30 21:02:29.965
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2013-09-30 21:02:29.763
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Pentium® Dual CPU E2180 @ 2.00GHz
Percentage of memory in use: 55%
Total physical RAM: 2038.83 MB
Available physical RAM: 913.24 MB
Total Pagefile: 4322.91 MB
Available Pagefile: 2892.95 MB
Total Virtual: 2047.88 MB
Available Virtual: 1932.5 MB
 
==================== Drives ================================
 
Drive c: (Partition_1) (Fixed) (Total:254.94 GB) (Free:140.37 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:42.74 GB) (Free:21.62 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 2527A2C7)
Partition 1: (Not Active) - (Size=42.7 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=254.9 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================

  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Did you run AswMBR at all ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

URLSearchHook: HKCU - (No Name) - {5fdb0cd8-5760-44d1-8d13-a78bf558c3c7} - C:\Program Files\InboxAce_1g\bar\1.bin\1gSrcAs.dll No File
BHO: No Name -> {66516A07-F617-488A-90CF-4E690CFB3C5F} -> No File
BHO: No Name -> {9359da42-06fb-46f2-9e4a-05c05b98a5ef} -> No File
BHO: No Name -> {d5a1d22b-9e17-454f-8ecd-83c578fb3983} -> No File
Toolbar: HKLM - No Name - {3775afd7-5921-4571-968f-85a631203d1c} - No File
Toolbar: HKLM - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} - No File
Toolbar: HKCU - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} - No File
Toolbar: HKCU - No Name - {3775AFD7-5921-4571-968F-85A631203D1C} - No File
FF Plugin: @InboxAce_1g.com/Plugin -> C:\Program Files\InboxAce_1g\bar\1.bin\NP1gStub.dll No File
2014-09-15 20:58 - 2014-09-17 11:10 - 00000438 _____ () C:\Windows\Tasks\SparkTrust Registration3.job
2014-09-15 20:53 - 2014-09-15 20:53 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\SparkTrust
2014-09-15 20:53 - 2014-09-15 20:53 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\DriverCure
2014-09-15 20:52 - 2014-09-17 11:10 - 00000619 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00001117 _____ () C:\Users\JIMS\Desktop\SparkTrust PC Cleaner Plus.lnk
2014-09-15 20:52 - 2014-09-15 20:52 - 00000572 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus Startup.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3_triggeronce.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Users\JIMS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\ProgramData\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Program Files\SparkTrust
2014-09-15 20:52 - 2014-09-15 20:52 - 00000000 ____D () C:\Program Files\Common Files\SparkTrust
2014-09-15 20:51 - 2014-09-15 20:51 - 06764848 _____ (SparkTrust) C:\Users\JIMS\Downloads\SparkTrust PC Cleaner Plus Setup_da1e7de_.exe
2014-09-17 11:10 - 2014-09-15 20:58 - 00000438 _____ () C:\Windows\Tasks\SparkTrust Registration3.job
2014-09-17 11:10 - 2014-09-15 20:52 - 00000619 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000572 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus Startup.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3_triggeronce.job
2014-09-15 20:52 - 2014-09-15 20:52 - 00000396 _____ () C:\Windows\Tasks\SparkTrust Update Version3.job
2014-09-12 22:11 - 2013-11-19 02:37 - 00000000 ____D () C:\Program Files\InboxAce_1g
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {9D88B2C9-57C2-45EB-B375-6E4FF6D2F3D1} - System32\Tasks\SparkTrust Update Version3 => c:\program files\common files\sparktrust\uus3\Update3.exe [2014-07-31] (SparkTrust Systems) <==== ATTENTION
Task: {C6A38807-0D1C-4C2D-B613-39EF2C27FCE0} - System32\Tasks\SparkTrust Registration3 => Rundll32.exe "C:\Program Files\Common Files\SparkTrust\UUS3\UUS3.dll" RunUns <==== ATTENTION
Task: {D1813E9B-3C54-4F19-8FB8-8CF75424DF4B} - System32\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe [2014-07-31] (SparkTrust) <==== ATTENTION
Task: {D9F32586-21E9-4B05-BE83-439BBE9E8AB8} - System32\Tasks\SparkTrust Update Version3_triggeronce => c:\program files\common files\sparktrust\uus3\Update3.exe [2014-07-31] (SparkTrust Systems) <==== ATTENTION
Task: {EEDB06D4-8D65-45AE-897D-80E8906A9ED2} - System32\Tasks\SparkTrust PC Cleaner Plus Startup => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe [2014-07-31] (SparkTrust) <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust PC Cleaner Plus Startup.job => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust PC Cleaner Plus_sch_2A40F175-3D44-11E4-88A4-001E903ED46D.job => C:\Program Files\SparkTrust\SparkTrust PC Cleaner Plus\SparkTrustPCCleanerPlus.exe <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust Registration3.job => C:\Program Files\Common Files\SparkTrust\UUS3\UUS3.dll <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust Update Version3.job => c:\program files\common files\sparktrust\uus3\Update3.exe <==== ATTENTION
Task: C:\Windows\Tasks\SparkTrust Update Version3_triggeronce.job => c:\program files\common files\sparktrust\uus3\Update3.exe <==== ATTENTION
TDL4: custom:26000022 <===== ATTENTION!
EmptyTemp:
CMD: bitsadmin /reset /allusers


Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

  • 0

#5
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts
aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2014-09-17 12:18:54
-----------------------------
12:18:54.447    OS Version: Windows 6.0.6002 Service Pack 2
12:18:54.447    Number of processors: 2 586 0xF0D
12:18:54.449    ComputerName: JIM-PC  UserName: JIMS
12:19:23.028    Initialize success
12:19:23.029    VM: initialized successfully
12:19:23.073    VM: Intel CPU virtualization not supported 
12:19:29.986    AVAST engine defs: 14091701
12:25:31.056    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
12:25:31.061    Disk 0 Vendor: WDC_WD3200AAJS-22B4A0 01.03A01 Size: 305245MB BusType: 3
12:25:31.335    Disk 0 MBR read successfully
12:25:31.339    Disk 0 MBR scan
12:25:32.001    Disk 0 Windows VISTA default MBR code
12:25:32.005    Disk 0 MBR hidden
12:25:32.035    Disk 0 Partition 1 00     07    HPFS/NTFS NTFS        43762 MB offset 63
12:25:32.776    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       261056 MB offset 89626642
12:25:32.803    Disk 0 scanning sectors +624269835
12:25:33.415    Disk 0 scanning C:\Windows\system32\drivers
12:25:51.890    Service scanning
12:26:24.340    Modules scanning
12:26:39.628    Disk 0 trace - called modules:
12:26:39.635    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x863ea4b1]<<
12:26:39.641    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x853de118]
12:26:39.648    3 CLASSPNP.SYS[883a68b3] -> nt!IofCallDriver -> [0x844469e0]
12:26:39.654    5 acpi.sys[826a16bc] -> nt!IofCallDriver -> [0x848675e0]
12:26:39.661    \Driver\atapi[0x86380ce0] -> IRP_MJ_CREATE -> 0x863ea4b1
12:26:42.898    AVAST engine scan C:\Windows
12:26:47.274    AVAST engine scan C:\Windows\system32
12:31:59.035    AVAST engine scan C:\Windows\system32\drivers
12:32:23.703    AVAST engine scan C:\Users\JIMS
12:33:49.155    AVAST engine scan C:\ProgramData
12:34:30.905    Scan finished successfully
12:37:30.592    Disk 0 MBR has been saved successfully to "C:\Users\JIMS\Desktop\MBR.dat"
12:37:30.615    The log file has been saved successfully to "C:\Users\JIMS\Desktop\aswMBRFRSTTEX.txt"

  • 0

#6
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts

do you want  me to click fix on Asswmbr..do not understand....

 

 

.. 


  • 0

#7
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts

do you want me to run frstlist again then hit fix..i have save the scan on desktop as frstfix like you mention ... but don;t understand what you wanted me to do next..i have not download ad-cleaner yet.. 


  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
No problem, it is best to ask if you are unsure. AswMBR has cleared your system of any rootkit or MBR activity so we can forget that programme now :)

Ensure that fixlist.txt is in the same location as FRST
Then start FRST and press fix
The script will run and should reboot on completion.

Post the log that it will generate and then run AdwCleaner

After AdwCleaner has finished then post that log and let me know how the computer is behaving
  • 0

#9
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts

i did that put it on notepad and saved on desktop.. now  going to run fiber first is that right..


  • 0

#10
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
That's correct :)
  • 0

Advertisements


#11
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts

Now after i run fber frst.. do I copy and past that fixlist into the  area where it shows the quote in fiber scan frst... that is what i don't understand.. or do I just hit fix when scan is finish..


  • 0

#12
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Start the FRST programme and then press Fix, there is no need to run a scan first :)


  • 0

#13
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts

when i tryed to fix it it says that the fixtlst is where the frst list is.. but i  have the fixt lst on note pad..


  • 0

#14
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
No problem let me do that part for you

Download the attached fixlist.txt to the same location as FRST
Attached File  fixlist.txt   4.76KB   155 downloads
Run FRST and press fix
  • 0

#15
leahcase

leahcase

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 229 posts

i did what you asked for me to do i download the attachment fixlist.txt.. and ran the frst and press fix.. it stills tell me the same message as before it is in the same place as before,,,no fixlist found...


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP