[kash111]

I installed a game a few days ago and realized I started having some issues with my computer - Windows defender said it caught some virus' several. I then installed Adwcleaner and it seems to have cleaned a lot out. I'm running Avast now as well.

 

But now I'm having an issue I saw someone else have on this forum.

 

 

 

 

 

I have attached the txt files that I believe are relevant to this error...

 

Any suggestions would be greatly appreciated. Thanks.

 

Attached Files

•  Addition.txt   156.66KB   7469 downloads
•  FRST.txt   136.37KB   208 downloads
•  aswMBR.txt   2.41KB   144 downloads

[Advertisements]

 

Download the attached fixlist.txt to the same location as FRST

 

 

Run FRST and press Fix

A fix log will be generated please post that 

 

 

Run FRST again as before.  Make sure Addition.txt is checked and hit Scan.  Post both logs.

 

That should take care of your error and also clean up a lot of deadwood.

 

Since you have Avast have it run a boot-time scan tonight.

 

 

It takes like 6 hours so I usually let it run at night.

 

Open Avast, Scan, Scan for Viruses, Change the Quick Scan (in the box in the center of the page) to Boot-time Scan.  Then at the bottom of the page click on Scan Settings.

 

Make sure both boxes are checked and click on the gray box to the right of the orange ones.  It should turn orange.  Change where it says "Fix Automatically" to "Move to

Chest."  OK.  Now click on Start and then close Avast.  Mute your speakers so it doesn't wake you up when Windows boots.

 

When you reboot you will see the scan start.  It will tell you where it saves its log.  Usually it's C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.   This is a hidden location so you will need to tell Windows to let you see it:

 

http://www.howtogeek...-windows-vista/

 

Copy and paste the text from the log to a Reply when done.

 

 

[RKinner]

 

Download the attached fixlist.txt to the same location as FRST

 

 

Run FRST and press Fix

A fix log will be generated please post that 

 

 

Run FRST again as before.  Make sure Addition.txt is checked and hit Scan.  Post both logs.

 

That should take care of your error and also clean up a lot of deadwood.

 

Since you have Avast have it run a boot-time scan tonight.

 

 

It takes like 6 hours so I usually let it run at night.

 

Open Avast, Scan, Scan for Viruses, Change the Quick Scan (in the box in the center of the page) to Boot-time Scan.  Then at the bottom of the page click on Scan Settings.

 

Make sure both boxes are checked and click on the gray box to the right of the orange ones.  It should turn orange.  Change where it says "Fix Automatically" to "Move to

Chest."  OK.  Now click on Start and then close Avast.  Mute your speakers so it doesn't wake you up when Windows boots.

 

When you reboot you will see the scan start.  It will tell you where it saves its log.  Usually it's C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.   This is a hidden location so you will need to tell Windows to let you see it:

 

http://www.howtogeek...-windows-vista/

 

Copy and paste the text from the log to a Reply when done.

 

 

[kash111]

Incredible, no error on startup. Thank you...

 

I've attached the two logs. I will do the Avast boot scan and post the log tomorrow.

Thanks again.

Attached Files

•  Addition.txt   140.5KB   255 downloads
•  FRST.txt   134.03KB   192 downloads

[RKinner]

OK.  You have a bad driver:

 

Name: Unknown USB Device (Device Descriptor Request Failed)

Description: Unknown USB Device (Device Descriptor Request Failed)

Class Guid: {36fc9e60-c465-11cf-8056-444553540000}

Manufacturer: (Standard USB Host Controller)

Service: 

Problem: : Windows has stopped this device because it has reported problems. (Code 43)

Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 

 

 

 

Do a Search for:

 

Device Manager 

 

and hit Enter.

 

then View, Show Hidden Drivers.  Now look in the right pane for yellow flagged devices.  Right click on one and select properties then click on the Details tab.  Change Property to Hardware IDs.  Click on the top one then right click and copy.  Paste that into a reply.  Repeat for all yellow flagged devices.

[kash111]

USB\DEVICE_DESCRIPTOR_FAILURE

[RKinner]

No you forgot to:

 

Change Property to Hardware IDs

 

That should give you something like this:

 

USB\VID_17EF&PID_602D&REV_0130

USB\VID_17EF&PID_602D

[kash111]

 

 

When I select the "driver version" property it shows 10.0.10586.0

 

Google shows that number as a microsoft audio driver version, maybe sound board related?

[RKinner]

OK.  Right click on the device and Uninstall then reboot.  Perhaps it will do better when it gets reinstalled.

 

Do you have anything plugged in to a USB jack that isn't working?

[kash111]

Something very odd happened. I was checking what USB devices were plugged in, and accidentally unplugged my nettalkduo (a voip device), so I plugged it back in.

 

When I went to uninstall the "Unknown USB Device", it is no longer there...

 

 

I sometimes have problems with the device and need to reset it, so that actually makes sense now that I think about it.

Edited by kash111, 07 August 2016 - 09:29 PM.

[RKinner]

OK.  Problem solved.  Do we need to fix anything else?  If not it's time to cleanup:

 

We usually clean up with Delfix.  This removes our tools and their logs and quarantines and also removes all but the latest System Restore point so there is no chance of the malware coming back with a system restore. Delfix has been a tad too aggressive recently and seems to dislike pdf files in the Downloads folder so if you have any you should move them to a different folder before running Delfix.

 

Download Delfix from http://general-chang...xplode/9-delfix

Ensure Remove disinfection tools is ticked

Also tick:

Create registry backup

Purge system restore

 

Click Run

The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply

 

If we installed Speccy it needs to be uninstalled.  Process Explorer, VEW  and their logs and Speccy's log can just be deleted.

 

Also make sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat.  Flash is now the most malware targeted program so it must be kept up to date.  Be careful with Adobe.  They are fond of offering optional downloads like yahoo or Ask toolbars or that worthless McAfee Security Scan.  Go slow and uncheck the optional stuff.

 

Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program.  There is an exploit out there now that can use it to get on your PC.  For Adobe Reader:  Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript.  OK Close program.  It's the same for Foxit reader except you uncheck Enable Javascript Actions. 

 

 

If you use Chrome/Firefox/IE then get the AdBlock Plus Add-on.  Go to adblockplus.org with each browser and get the add-on.  (It's actually a program for IE)

 

If Chrome/Firefox is slow loading make sure it only has the current Java add-on.  Then download and run Speedy Fox.

http://www.crystalidea.com/speedyfox.  Close Chrome/Firefox/Skpe. Hit Optimize.   You can run it any time that Chrome/Firefox seems slow starting..

 

Be warned:  If you use Limewire, utorrent or any of the other P2P programs you will probably be coming back to the Malware Removal forum.  If you must use P2P then submit any files you get to http://virustotal.combeforeyou open them.

 

Due to a recent rise in the number of Crytolocker infections I am now recommending you install:

 

CryptoPrevent

 

http://www.foolishIT.../cryptoprevent/

 

Last time I downloaded it you had to give them your IP address and they would send you the link to download it.  When it ran it asked if you were sure your PC was clean then it would try to allow everything on your PC to continue running.  The free version does not update on its own so you should check for updated versions once in a while.  If you have problems after installing CryptoPrevent you can just uninstall it.

 

If you have a router, log on to it today and change the default password!  If using a Wireless router you really should be using encryption on the link.  Use the strongest (newest) encryption method that your router and PC wireless adapter support especially if you own a business.  See http://www.king5.com...0637284.htmlandhttp://www.seattlepi...ted-1344185.php for why encryption is important.  If you don't know how, visit the router maker's website.  They all have detailed step by step instructions or a wizard you can download.

 

Special note on Java.  Old Java versions should be removed after first clearing the Java Cache by following the instructions in:

http://www.java.com/...lugin_cache.xml

Then remove the old versions by going to Control Panel, Programs and Features and Uninstall all Java programs which are not Java Version 7 update 25 or better.  These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE.  Get the latest version from Java.com.  They will usually attempt to foist some garbage like the Ask toolbar, Yahoo toolbar or McAfee Security Scan on you as part of the download.  Just uncheck the garbage before the download (or install) starts.  If you use a 64-bit browser and want the 64-bit version of Java you need to use it to visit java.com.

Due to multiple security problems with Java we are now recommending that it not be installed unless you absolutely know you need it.  IF that is the case then go to Control Panel, Java, Security and slide it up to the highest level.  OK.

 

 

My help is free but if you wish to show your appreciation, please donate to Kwiaht instead of me. It's an Orcas Island environmental organization that I volunteered with: http://www.kwiaht.org/donate.htm

(The name means something like "clean place" in one of the local native-American dialects)

[kash111]

This is from the Avast boot-scan:

 

08/07/2016 23:18

Scan of C:

 

Scan of *STARTUP

 

File C:\Users\Main\Dropbox\Folder Share\WEBSITES\pristine-exteriors.com\Backup\June 24 2012\backup-pristine-exteriors.com-6-24-2012.tar.gz|>backup-pristine-exteriors.com-6-24-2012.tar|>.\public_html\wp-content\plugins\add-to-any\add-to-any.php is infected by VBS:Malware-gen, Moved to chest

File C:\Users\Main\Dropbox\Folder Share\WEBSITES\Wordpress\add-to-any.zip|>add-to-any\add-to-any.php is infected by VBS:Malware-gen, Moved to chest

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\2[3].exe|>$INSTDIR\Kinship.T Error 42145 {Installer archive is corrupted.}

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\2[3].exe is infected by Win32:Trojan-gen, Moved to chest

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_NetworkManager[1].exe is infected by Win32:Malware-gen, Moved to chest

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_NetworkManager[2].exe is infected by Win32:Malware-gen, Moved to chest

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_NetworkManager[3].exe is infected by Win32:Malware-gen, Moved to chest

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_SnapDoNew[1].exe is infected by Win32:Malware-gen, Moved to chest

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_SnapDoNew[2].exe is infected by Win32:Malware-gen, Moved to chest

File C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Bundle_SnapDoNew[3].exe is infected by Win32:Malware-gen, Moved to chest

File C:\Windows\SysWOW64\gs\gs8.71\bin\gswin32.exe is infected by Win32:WrongInf-A [Susp], Moved to chest

Number of searched folders: 60859

Number of tested files: 1572275

Number of infected files: 10

 

 

 

 

 

This is the log from delfix:

 

# DelFix v1.013 - Logfile created 08/08/2016 at 08:14:50

# Updated 17/04/2016 by Xplode

# Username : Main - MAIN

# Operating System : Windows 10 Pro  (64 bits)

 

~ Removing disinfection tools ...

 

Deleted : C:\FRST

Deleted : C:\AdwCleaner

 

~ Creating registry backup ... OK

 

~ Cleaning system restore ...

 

Deleted : RP #13 [Scheduled Checkpoint | 08/06/2016 13:31:37]

Deleted : RP #14 [JRT Pre-Junkware Removal | 08/06/2016 18:11:42]

Deleted : RP #15 [Removed SketchUp Import for AutoCAD 2014. | 08/07/2016 20:00:09]

 

New restore point created !

 

########## - EOF - ##########

 

 

 

 

[RKinner]

Looks good