Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

RegSvr32 error on startup - The specified module could not be found.


  • Please log in to reply

#1
kash111

kash111

    New Member

  • Member
  • Pip
  • 6 posts
I installed a game a few days ago and realized I started having some issues with my computer - Windows defender said it caught some virus' several. I then installed Adwcleaner and it seems to have cleaned a lot out. I'm running Avast now as well.
 
But now I'm having an issue I saw someone else have on this forum.
 
 
9ag2fwh.jpg
 
 
 
I have attached the txt files that I believe are relevant to this error...
 
Any suggestions would be greatly appreciated. Thanks.
 

Attached Files


  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
 
Download the attached fixlist.txt to the same location as FRST
 
Attached File  fixlist.txt   18.39KB   38 downloads
 
Run FRST and press Fix
A fix log will be generated please post that 
 
 
Run FRST again as before.  Make sure Addition.txt is checked and hit Scan.  Post both logs.
 
That should take care of your error and also clean up a lot of deadwood.
 
Since you have Avast have it run a boot-time scan tonight.
 
 
It takes like 6 hours so I usually let it run at night.
 
Open Avast, Scan, Scan for Viruses, Change the Quick Scan (in the box in the center of the page) to Boot-time Scan.  Then at the bottom of the page click on Scan Settings.
 
Make sure both boxes are checked and click on the gray box to the right of the orange ones.  It should turn orange.  Change where it says "Fix Automatically" to "Move to
Chest."  OK.  Now click on Start and then close Avast.  Mute your speakers so it doesn't wake you up when Windows boots.
 
When you reboot you will see the scan start.  It will tell you where it saves its log.  Usually it's C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.   This is a hidden location so you will need to tell Windows to let you see it:
 
 
Copy and paste the text from the log to a Reply when done.
 

 


  • 0

#3
kash111

kash111

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts

Incredible, no error on startup. Thank you...

 

I've attached the two logs. I will do the Avast boot scan and post the log tomorrow.

Thanks again.

Attached Files


  • 0

#4
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

OK.  You have a bad driver:

 


Name: Unknown USB Device (Device Descriptor Request Failed)
Description: Unknown USB Device (Device Descriptor Request Failed)
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 
 

 

 

Do a Search for:
 
Device Manager 
 
and hit Enter.
 
then View, Show Hidden Drivers.  Now look in the right pane for yellow flagged devices.  Right click on one and select properties then click on the Details tab.  Change Property to Hardware IDs.  Click on the top one then right click and copy.  Paste that into a reply.  Repeat for all yellow flagged devices.

  • 0

#5
kash111

kash111

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
USB\DEVICE_DESCRIPTOR_FAILURE

  • 0

#6
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

No you forgot to:

 

Change Property to Hardware IDs

 

That should give you something like this:

 

USB\VID_17EF&PID_602D&REV_0130

USB\VID_17EF&PID_602D

  • 0

#7
kash111

kash111

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts

4XlrG73.jpg

 

 

When I select the "driver version" property it shows 10.0.10586.0

 

Google shows that number as a microsoft audio driver version, maybe sound board related?


  • 0

#8
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

OK.  Right click on the device and Uninstall then reboot.  Perhaps it will do better when it gets reinstalled.

 

Do you have anything plugged in to a USB jack that isn't working?


  • 0

#9
kash111

kash111

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts

Something very odd happened. I was checking what USB devices were plugged in, and accidentally unplugged my nettalkduo (a voip device), so I plugged it back in.

 

When I went to uninstall the "Unknown USB Device", it is no longer there...

 

 

I sometimes have problems with the device and need to reset it, so that actually makes sense now that I think about it.


Edited by kash111, 07 August 2016 - 09:29 PM.

  • 0

#10
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

OK.  Problem solved.  Do we need to fix anything else?  If not it's time to cleanup:

 

We usually clean up with Delfix.  This removes our tools and their logs and quarantines and also removes all but the latest System Restore point so there is no chance of the malware coming back with a system restore. Delfix has been a tad too aggressive recently and seems to dislike pdf files in the Downloads folder so if you have any you should move them to a different folder before running Delfix.
 
Ensure Remove disinfection tools is ticked
Also tick:
Create registry backup
Purge system restore
 
Click Run
The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply
 
If we installed Speccy it needs to be uninstalled.  Process Explorer, VEW  and their logs and Speccy's log can just be deleted.
 
Also make sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat.  Flash is now the most malware targeted program so it must be kept up to date.  Be careful with Adobe.  They are fond of offering optional downloads like yahoo or Ask toolbars or that worthless McAfee Security Scan.  Go slow and uncheck the optional stuff.
 
Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program.  There is an exploit out there now that can use it to get on your PC.  For Adobe Reader:  Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript.  OK Close program.  It's the same for Foxit reader except you uncheck Enable Javascript Actions. 
 
 
If you use Chrome/Firefox/IE then get the AdBlock Plus Add-on.  Go to adblockplus.org with each browser and get the add-on.  (It's actually a program for IE)
 
If Chrome/Firefox is slow loading make sure it only has the current Java add-on.  Then download and run Speedy Fox.
http://www.crystalidea.com/speedyfox.  Close Chrome/Firefox/Skpe. Hit Optimize.   You can run it any time that Chrome/Firefox seems slow starting..
 
Be warned:  If you use Limewire, utorrent or any of the other P2P programs you will probably be coming back to the Malware Removal forum.  If you must use P2P then submit any files you get to http://virustotal.combeforeyou open them.
 
Due to a recent rise in the number of Crytolocker infections I am now recommending you install:
 
CryptoPrevent
 
 
Last time I downloaded it you had to give them your IP address and they would send you the link to download it.  When it ran it asked if you were sure your PC was clean then it would try to allow everything on your PC to continue running.  The free version does not update on its own so you should check for updated versions once in a while.  If you have problems after installing CryptoPrevent you can just uninstall it.
 
If you have a router, log on to it today and change the default password!  If using a Wireless router you really should be using encryption on the link.  Use the strongest (newest) encryption method that your router and PC wireless adapter support especially if you own a business.  See http://www.king5.com...0637284.htmlandhttp://www.seattlepi...ted-1344185.php for why encryption is important.  If you don't know how, visit the router maker's website.  They all have detailed step by step instructions or a wizard you can download.
 
Special note on Java.  Old Java versions should be removed after first clearing the Java Cache by following the instructions in:
Then remove the old versions by going to Control Panel, Programs and Features and Uninstall all Java programs which are not Java Version 7 update 25 or better.  These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE.  Get the latest version from Java.com.  They will usually attempt to foist some garbage like the Ask toolbar, Yahoo toolbar or McAfee Security Scan on you as part of the download.  Just uncheck the garbage before the download (or install) starts.  If you use a 64-bit browser and want the 64-bit version of Java you need to use it to visit java.com.
Due to multiple security problems with Java we are now recommending that it not be installed unless you absolutely know you need it.  IF that is the case then go to Control Panel, Java, Security and slide it up to the highest level.  OK.
 
 
My help is free but if you wish to show your appreciation, please donate to Kwiaht instead of me. It's an Orcas Island environmental organization that I volunteered with: http://www.kwiaht.org/donate.htm
(The name means something like "clean place" in one of the local native-American dialects)

  • 0

#11
kash111

kash111

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts

This is from the Avast boot-scan:

 

08/07/2016 23:18
Scan of C:
 
Scan of *STARTUP
 
File C:\Users\Main\Dropbox\Folder Share\WEBSITES\pristine-exteriors.com\Backup\June 24 2012\backup-pristine-exteriors.com-6-24-2012.tar.gz|>backup-pristine-exteriors.com-6-24-2012.tar|>.\public_html\wp-content\plugins\add-to-any\add-to-any.php is infected by VBS:Malware-gen, Moved to chest
File C:\Users\Main\Dropbox\Folder Share\WEBSITES\Wordpress\add-to-any.zip|>add-to-any\add-to-any.php is infected by VBS:Malware-gen, Moved to chest
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\2[3].exe|>$INSTDIR\Kinship.T Error 42145 {Installer archive is corrupted.}
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\2[3].exe is infected by Win32:Trojan-gen, Moved to chest
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_NetworkManager[1].exe is infected by Win32:Malware-gen, Moved to chest
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_NetworkManager[2].exe is infected by Win32:Malware-gen, Moved to chest
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_NetworkManager[3].exe is infected by Win32:Malware-gen, Moved to chest
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_SnapDoNew[1].exe is infected by Win32:Malware-gen, Moved to chest
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_SnapDoNew[2].exe is infected by Win32:Malware-gen, Moved to chest
File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_SnapDoNew[3].exe is infected by Win32:Malware-gen, Moved to chest
File C:\Windows\SysWOW64\gs\gs8.71\bin\gswin32.exe is infected by Win32:WrongInf-A [Susp], Moved to chest
Number of searched folders: 60859
Number of tested files: 1572275
Number of infected files: 10
 
 
 
 
 
This is the log from delfix:
 
# DelFix v1.013 - Logfile created 08/08/2016 at 08:14:50
# Updated 17/04/2016 by Xplode
# Username : Main - MAIN
# Operating System : Windows 10 Pro  (64 bits)
 
~ Removing disinfection tools ...
 
Deleted : C:\FRST
Deleted : C:\AdwCleaner
 
~ Creating registry backup ... OK
 
~ Cleaning system restore ...
 
Deleted : RP #13 [Scheduled Checkpoint | 08/06/2016 13:31:37]
Deleted : RP #14 [JRT Pre-Junkware Removal | 08/06/2016 18:11:42]
Deleted : RP #15 [Removed SketchUp Import for AutoCAD 2014. | 08/07/2016 20:00:09]
 
New restore point created !
 
########## - EOF - ##########
 
 
 
 

  • 0

#12
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

Looks good


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP