Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

trojan.generickd

Started by gregahoffman , Aug 07 2017 08:22 PM

infection found using esisoft

Please log in to reply

#31
gregahoffman

Posted 05 September 2017 - 11:35 AM

Member

Topic Starter
Member
400 posts

MiniToolBox by Farbar Version: 17-06-2016

Ran by greg & jacki (administrator) on 05-09-2017 at 12:34:02

Running from "C:\Users\greg & jacki\Downloads"

Microsoft Windows 7 Home Premium Service Pack 1 (X64)

Model: HP Pavilion dv7 Notebook PC Manufacturer: Hewlett-Packard

Boot Mode: Normal

***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.

No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= Hosts content: =================================

127.0.0.1 localhost

========================= IP Configuration: ================================

Intel® Centrino® Wireless-N 6150 = Wireless Network Connection (Connected)

Realtek PCIe GBE Family Controller = Local Area Connection (Media disconnected)

Intel® Centrino® WiMAX 6150 = Local Area Connection 2 (Media disconnected)

Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 2 (Media disconnected)

Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 3 (Media disconnected)

# ----------------------------------

# IPv4 Configuration

# ----------------------------------

pushd interface ipv4

reset

set global taskoffload=disabled

popd

# End of IPv4 configuration

Windows IP Configuration

Host Name . . . . . . . . . . . . : hplaptop

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : hsd1.mn.comcast.net.

Ethernet adapter Local Area Connection 2:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Intel® Centrino® WiMAX 6150

Physical Address. . . . . . . . . : 64-D4-DA-5D-81-E9

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter #2

Physical Address. . . . . . . . . : 40-25-C2-53-4D-15

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter

Physical Address. . . . . . . . . : 40-25-C2-53-4D-15

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : hsd1.mn.comcast.net.

Description . . . . . . . . . . . : Intel® Centrino® Wireless-N 6150

Physical Address. . . . . . . . . : 40-25-C2-53-4D-14

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IPv6 Address. . . . . . . . . . . : 2601:448:100:ea2c:682c:48c2:fea6:e17b(Preferred)

IPv6 Address. . . . . . . . . . . : 2601:448:100:ea2c:8949:35fe:89ee:6154(Preferred)

Lease Obtained. . . . . . . . . . : Tuesday, September 05, 2017 9:21:15 AM

Lease Expires . . . . . . . . . . : Thursday, September 07, 2017 5:46:22 PM

Temporary IPv6 Address. . . . . . : 2601:448:100:ea2c:e8fd:7a42:1334:1162(Preferred)

Link-local IPv6 Address . . . . . : fe80::682c:48c2:fea6:e17b%12(Preferred)

IPv4 Address. . . . . . . . . . . : 10.0.0.15(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Lease Obtained. . . . . . . . . . : Tuesday, September 05, 2017 9:20:30 AM

Lease Expires . . . . . . . . . . : Tuesday, September 12, 2017 12:33:53 PM

Default Gateway . . . . . . . . . : fe80::7acd:8eff:fe0d:62a2%12

10.0.0.1

DHCP Server . . . . . . . . . . . : 10.0.0.1

DHCPv6 IAID . . . . . . . . . . . : 306193858

DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-BD-BB-F1-10-1F-74-17-57-8A

DNS Servers . . . . . . . . . . . : 2001:558:feed::2

2001:558:feed::1

75.75.76.76

75.75.75.75

NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller

Physical Address. . . . . . . . . : 10-1F-74-17-57-8A

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 17:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface

Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.hsd1.mn.comcast.net.:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Microsoft ISATAP Adapter

Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Server: cdns02.comcast.net

Address: 2001:558:feed::2

Name: google.com

Addresses: 2607:f8b0:4009:816::200e

172.217.1.46

Pinging google.com [2607:f8b0:4009:802::200e] with 32 bytes of data:

Reply from 2607:f8b0:4009:802::200e: time=24ms

Reply from 2607:f8b0:4009:802::200e: time=20ms

Ping statistics for 2607:f8b0:4009:802::200e:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 20ms, Maximum = 24ms, Average = 22ms

Server: cdns02.comcast.net

Address: 2001:558:feed::2

Name: yahoo.com

Addresses: 2001:4998:58:c02::a9

2001:4998:c:a06::2:4008

2001:4998:44:204::a7

206.190.36.45

98.139.180.149

98.138.253.109

Pinging yahoo.com [2001:4998:44:204::a7] with 32 bytes of data:

Reply from 2001:4998:44:204::a7: time=37ms

Reply from 2001:4998:44:204::a7: time=34ms

Ping statistics for 2001:4998:44:204::a7:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 34ms, Maximum = 37ms, Average = 35ms

Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================

Interface List

15...64 d4 da 5d 81 e9 ......Intel® Centrino® WiMAX 6150

14...40 25 c2 53 4d 15 ......Microsoft Virtual WiFi Miniport Adapter #2

13...40 25 c2 53 4d 15 ......Microsoft Virtual WiFi Miniport Adapter

12...40 25 c2 53 4d 14 ......Intel® Centrino® Wireless-N 6150

11...10 1f 74 17 57 8a ......Realtek PCIe GBE Family Controller

1...........................Software Loopback Interface 1

25...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface

24...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter

===========================================================================

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 10.0.0.1 10.0.0.15 25

10.0.0.0 255.255.255.0 On-link 10.0.0.15 281

10.0.0.15 255.255.255.255 On-link 10.0.0.15 281

10.0.0.255 255.255.255.255 On-link 10.0.0.15 281

127.0.0.0 255.0.0.0 On-link 127.0.0.1 306

127.0.0.1 255.255.255.255 On-link 127.0.0.1 306

127.255.255.255 255.255.255.255 On-link 127.0.0.1 306

224.0.0.0 240.0.0.0 On-link 127.0.0.1 306

224.0.0.0 240.0.0.0 On-link 10.0.0.15 281

255.255.255.255 255.255.255.255 On-link 127.0.0.1 306

255.255.255.255 255.255.255.255 On-link 10.0.0.15 281

===========================================================================

Persistent Routes:

None

IPv6 Route Table

===========================================================================

Active Routes:

If Metric Network Destination Gateway

12 281 ::/0 fe80::7acd:8eff:fe0d:62a2

1 306 ::1/128 On-link

12 33 2601:448:100:ea2c::/64 On-link

12 281 2601:448:100:ea2c:682c:48c2:fea6:e17b/128

On-link

12 281 2601:448:100:ea2c:8949:35fe:89ee:6154/128

On-link

12 281 2601:448:100:ea2c:e8fd:7a42:1334:1162/128

On-link

12 281 fe80::/64 On-link

12 281 fe80::682c:48c2:fea6:e17b/128

On-link

1 306 ff00::/8 On-link

12 281 ff00::/8 On-link

===========================================================================

Persistent Routes:

None

========================= Winsock entries =====================================

Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)

Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)

Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)

Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)

Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)

Catalog5 07 C:\Windows\SysWOW64\wshbth.dll [36352] (Microsoft Corporation)

Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)

x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)

x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)

x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)

x64-Catalog5 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)

x64-Catalog5 07 C:\Windows\System32\wshbth.dll [47104] (Microsoft Corporation)

x64-Catalog9 01 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 02 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 03 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 04 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 06 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 07 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 08 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 09 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 10 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:

==================

System errors:

=============

Error: (09/05/2017 10:50:09 AM) (Source: Service Control Manager) (User: )

Description: The TrueSuiteService service terminated unexpectedly. It has done this 1 time(s).

Error: (09/05/2017 09:38:40 AM) (Source: Service Control Manager) (User: )

Description: The AVG Theme Extension service failed to start due to the following error:

%%1083 = The executable program that this service is configured to run in does not implement the service.

Error: (09/05/2017 08:52:45 AM) (Source: Service Control Manager) (User: )

Description: The AVG Theme Extension service failed to start due to the following error:

%%1083 = The executable program that this service is configured to run in does not implement the service.

Error: (09/05/2017 08:35:00 AM) (Source: volsnap) (User: )

Description: The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Error: (09/05/2017 07:30:11 AM) (Source: Service Control Manager) (User: )

Description: The AVG Theme Extension service failed to start due to the following error:

%%1083 = The executable program that this service is configured to run in does not implement the service.

Error: (09/04/2017 10:15:06 PM) (Source: iaStor) (User: )

Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

Error: (09/04/2017 08:37:59 PM) (Source: Service Control Manager) (User: )

Description: The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error:

%%1068 = The dependency service or group failed to start.

Error: (09/04/2017 08:37:15 PM) (Source: Service Control Manager) (User: )

Description: The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error:

%%1068 = The dependency service or group failed to start.

Error: (09/04/2017 08:33:32 PM) (Source: DCOM) (User: )

Description: 1068lltdsvc{5BF9AA75-D7FF-4AEE-AA2C-96810586456D}

Error: (09/04/2017 08:24:12 PM) (Source: DCOM) (User: )

Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F}

Microsoft Office Sessions:

=========================

=========================== Installed Programs ============================

Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{0F347A49-E36C-4639-8D2E-003AD408B8B2}) (Version: 1.5 - Eyeo GmbH)

Adobe Flash Player 22 NPAPI (HKLM-x32\...\{DD6BBCC0-0CF8-4972-86DC-17437AFEE6C3}) (Version: 22.0.0.192 - Adobe Systems Incorporated)

Adobe Flash Player 23 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 23.0.0.207 - Adobe Systems Incorporated)

Adobe Reader X (10.1.16) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.16 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.3.183 - Adobe Systems, Inc.)

AOMEI Partition Assistant Standard Edition 5.8 (HKLM-x32\...\{02F850ED-FD0E-4ED1-BE0B-54981f5BD3D4}_is1) (Version: - AOMEI Technology Co., Ltd.)

ATI Catalyst Install Manager (HKLM\...\{DA0D8FDA-D538-1145-8BA2-6F22C4EB4F75}) (Version: 3.0.816.0 - ATI Technologies, Inc.)

AuthenTec TrueAPI (HKLM\...\{054EF02F-95D8-48F4-9EEB-2F9CE3072ED8}) (Version: 1.2.1.33 - AuthenTec, Inc.) Hidden

AVG (HKLM\...\{BA40B3B4-7707-437E-84FF-8C18BE5AD9B6}) (Version: 1.211.2 - AVG Technologies) Hidden

AVG AntiVirus FREE (HKLM-x32\...\AVG Antivirus) (Version: 17.5.3022 - AVG Technologies)

CryptoPrevent (HKLM-x32\...\{5C5B24E7-4694-4049-A222-CCE7D3FAC63F}_is1) (Version: 8.0.4.2 - Foolish IT LLC)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.3908 - CyberLink Corp.)

Driver Booster 4.3 (HKLM-x32\...\Driver Booster_is1) (Version: 4.3.0 - IObit)

Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)

ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)

Evernote v. 4.2.2 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.2.3979 - Evernote Corp.)

FMW 1 (HKLM\...\{F64508FE-73C8-4C27-9CCA-3799C428B70B}) (Version: 1.223.1 - AVG Technologies) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 60.0.3112.113 - Google Inc.)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden

HP 3D DriveGuard (HKLM\...\{0128D231-B23B-409C-A531-39D8D8774BA1}) (Version: 4.1.5.1 - Hewlett-Packard Company)

HP Connection Manager (HKLM-x32\...\{B65FCAA5-F3A6-4B3F-ABEE-CBC2B085796B}) (Version: 4.1.25.1 - Hewlett-Packard Company)

HP Deskjet 3050A J611 series Basic Device Software (HKLM\...\{B6A3EAE4-3727-46A4-A659-8576BF7C8C8D}) (Version: 23.0.504.0 - Hewlett-Packard Co.)

HP Deskjet 3050A J611 series Help (HKLM-x32\...\{97DDCAB8-B770-4089-A10F-67568069D78A}) (Version: 140.0.2.2 - Hewlett Packard)

HP Deskjet 3050A J611 series Product Improvement Study (HKLM\...\{F638F65B-B435-44E0-9382-7F90BDB003E2}) (Version: 23.0.504.0 - Hewlett-Packard Co.)

HP Documentation (HKLM-x32\...\{83A375B6-6FC2-4F8A-948E-E506DB9DCDF0}) (Version: 1.1.0.0 - Hewlett-Packard)

HP On Screen Display (HKLM-x32\...\{9B9B8EE4-2EDB-41C2-AF2E-63E75D37CDDF}) (Version: 1.1.2 - Hewlett-Packard Company)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.5192 - HP Photo Creations)

HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)

HP Quick Launch (HKLM-x32\...\{285F722C-0E45-47DE-B38E-5B3B10FA4A7C}) (Version: 2.5.2 - Hewlett-Packard Company)

HP Setup (HKLM-x32\...\{210A03F5-B2ED-4947-B27E-516F50CBB292}) (Version: 8.6.4530.3651 - Hewlett-Packard Company)

HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13231.3673 - Hewlett-Packard Company)

HP SimplePass 2011 (HKLM-x32\...\{BCFAA37D-A6DB-43BF-A351-43F183E52D07}) (Version: 5.1.0.495 - Hewlett-Packard)

HP Software Framework (HKLM-x32\...\{28FE073B-1230-4BF6-830C-7434FD0C0069}) (Version: 4.1.13.1 - Hewlett-Packard Company)

HP Support Solutions Framework (HKLM-x32\...\{2B5A1E68-6617-406D-B797-5DAB5B4630B8}) (Version: 12.7.27.15 - HP Inc.)

HP Update (HKLM-x32\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)

IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6345.0 - IDT)

inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)

Intel WiMAX Tutorial (HKLM\...\{4F26C164-9373-4974-8F43-E0F2176AF937}) (Version: 1.5.3.1 - Intel Corporation)

Intel® Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3074 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel® PROSet/Wireless WiFi Software (HKLM\...\{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}) (Version: 14.0.2000 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)

Intel® Wireless Display (HKLM-x32\...\{5B46CEC7-DAD0-46A2-BCD6-B46A3CFD9B61}) (Version: 2.0.30.0 - Intel Corporation)

Intel® PROSet/Wireless WiMAX Software (HKLM\...\{5F588B19-C575-4750-86FD-6ED2B76E61F1}) (Version: 7.50.0000 - Intel Corporation)

Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)

PX Profile Update (HKLM-x32\...\{1C34B2AF-0D61-1784-8BC8-219F969BEFD6}) (Version: 1.00.1. - AMD) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.14393.28161 - Realtek Semiconduct Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.41.216.2011 - Realtek)

Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.74 - Realtek Semiconductor Corp.)

Recovery Manager (HKLM-x32\...\{DBCD5E64-7379-4648-9444-8A6558DCB614}) (Version: 2.0.0 - Hewlett-Packard) Hidden

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.19.0 - Renesas Electronics Corporation) Hidden

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.19.0 - Renesas Electronics Corporation)

RoxioNow Player (HKLM-x32\...\{0EDEB615-1A60-425E-8306-0E10519C7B55}) (Version: 1.9.5.103 - RoxioNow)

Seagate Dashboard (HKLM-x32\...\{EA266F00-A8E7-43A0-8DED-FBFE3F076934}) (Version: 4.8.5.0 - Seagate)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Skype™ 7.39 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.39.102 - Skype Technologies S.A.)

Speccy (HKLM\...\Speccy) (Version: 1.29 - Piriform)

SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )

swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)

Tweaking.com - Windows Repair (HKLM-x32\...\Tweaking.com - Windows Repair) (Version: 3.9.9 - Tweaking.com)

Validity WBF DDK (HKLM\...\{79174AF2-6CB1-42F5-981E-66DCA49391D0}) (Version: 4.3.205.0 - Validity Sensors, Inc.)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VMware Horizon Client (HKLM\...\{C7F8E8FA-0832-427E-B2B1-ABF6F8495C35}) (Version: 3.5.2.30397 - VMware, Inc.)

========================= Memory info: ===================================

Percentage of memory in use: 33%

Total physical RAM: 8139.86 MB

Available physical RAM: 5400.88 MB

Total Virtual: 16277.9 MB

Available Virtual: 13504.11 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:916.54 GB) (Free:827.45 GB) NTFS

2 Drive d: (RECOVERY) (Fixed) (Total:14.68 GB) (Free:1.63 GB) NTFS

3 Drive e: () (Fixed) (Total:230.31 GB) (Free:16.73 GB) NTFS

4 Drive f: () (Fixed) (Total:468.32 GB) (Free:308.62 GB) NTFS

========================= Users: ========================================

User accounts for \\HPLAPTOP

Administrator greg & jacki Guest

========================= Minidump Files ==================================

No minidump file found

**** End of log ****

#32
RKinner

Posted 05 September 2017 - 02:29 PM

Malware Expert

Expert
24,625 posts

Error: (09/04/2017 10:15:06 PM) (Source: iaStor) (User: )

Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

This is:

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)

It controls your hard drive so very important that it work correctly. You can look on your PC maker's website and see if they have a newer version or you can try intel:

https://downloadcent...-?product=55005

(Make sure you get the one for Win 7)

Error: (09/05/2017 10:50:09 AM) (Source: Service Control Manager) (User: )

Description: The TrueSuiteService service terminated unexpectedly. It has done this 1 time(s).

This is your fingerprint scanner.

HP SimplePass 2011 (HKLM-x32\...\{BCFAA37D-A6DB-43BF-A351-43F183E52D07}) (Version: 5.1.0.495 - Hewlett-Packard)

See if there is a newer version on HP's site.

Error: (09/04/2017 08:37:15 PM) (Source: Service Control Manager) (User: )

Description: The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error:

%%1068 = The dependency service or group failed to start.

This is sort of odd. There are only two dependencies usually. HTTP and RPC. Search for services.msc and hit Enter

Then find the Function Discovery Provider Host service and right click and select Properties then Dependencies.

Do you have anything besides HTTP and RPC? Are both Started?

#33
gregahoffman

Posted 05 September 2017 - 11:41 PM

Member

Topic Starter
Member
400 posts

it looks like it is started and only the 2 services

#34
RKinner

Posted 06 September 2017 - 03:49 AM

Malware Expert

Expert
24,625 posts

Guess it was just slow starting. I can see from your screenshot that the The HomeGroup Provider service was also running. Were you able to update the

Intel® Rapid Storage Technology?

#35
gregahoffman

Posted 06 September 2017 - 06:43 AM

Member

Topic Starter
Member
400 posts

i updated the driver to whatever was the most recent (2011) from the hp website, going to try to update the fingerprint scanner now.

fingerprint driver also downloaded.

Edited by gregahoffman, 06 September 2017 - 06:55 AM.

#36
RKinner

Posted 06 September 2017 - 07:30 AM

Malware Expert

Expert
24,625 posts

What version of Intel® Rapid Storage Technology did they give you?

#37
gregahoffman

Posted 06 September 2017 - 08:11 AM

Member

Topic Starter
Member
400 posts

#38
RKinner

Posted 06 September 2017 - 09:38 AM

Malware Expert

Expert
24,625 posts

Not the latest but if it works it will do. Let's see if it helped.

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

1. Please download the Event Viewer Tool by Vino Rosso

http://images.malwar...om/vino/VEW.exe

and save it to your Desktop:

2. Right-click VEW.exe and Run AS Administrator

3. Under 'Select log to query', select:

* System

4. Under 'Select type to list', select:

* Error

* Warning

Then use the 'Number of events' as follows:

1. Click the radio button for 'Number of events'

Type 20 in the 1 to 20 box

Then click the Run button.

Notepad will open with the output log.

Please post the Output log in your next reply then repeat but select Application. (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)

#39
gregahoffman

Posted 06 September 2017 - 10:17 AM

Member

Topic Starter
Member
400 posts

application log

Vino's Event Viewer v01c run on Windows 2008 in English

Report run at 06/09/2017 11:15:42 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'Application' Date/Time: 06/09/2017 4:10:49 PM

Type: Error Category: 100

Event: 1000 Source: Application Error

Faulting application name: DSATray.exe, version: 2.9.0.2, time stamp: 0x598ca911 Faulting module name: KERNELBASE.dll, version: 6.1.7601.23864, time stamp: 0x595fa536 Exception code: 0xe0434352 Fault offset: 0x0000c54f Faulting process id: 0xd14 Faulting application start time: 0x01d3272a8f429d13 Faulting application path: C:\Program Files (x86)\Intel Driver Update Utility\DSATray.exe Faulting module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: f22d044f-931d-11e7-8ee9-101f7417578a

Log: 'Application' Date/Time: 06/09/2017 4:10:33 PM

Type: Error Category: 0

Event: 1026 Source: .NET Runtime

Application: DSATray.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.Exception

at DSAUtility.LoggingController.TraceError(System.String, Boolean, System.Nullable`1<System.DateTime>)

at DSATray.App.Dispatcher_UnhandledException(System.Object, System.Windows.Threading.DispatcherUnhandledExceptionEventArgs)

at System.Windows.Threading.Dispatcher.CatchException(System.Exception)

at System.Windows.Threading.Dispatcher.CatchExceptionStatic(System.Object, System.Exception)

at System.Windows.Threading.ExceptionWrapper.CatchException(System.Object, System.Exception, System.Delegate)

at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)

at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)

at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)

at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)

at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)

at System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)

at System.Windows.Application.RunDispatcher(System.Object)

at System.Windows.Application.RunInternal(System.Windows.Window)

at System.Windows.Application.Run(System.Windows.Window)

at DSATray.App.Main()

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Warning Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'Application' Date/Time: 06/09/2017 4:07:16 PM

Type: Warning Category: 0

Event: 1530 Source: Microsoft-Windows-User Profiles Service

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 2 user registry handles leaked from \Registry\User\S-1-5-21-2642546764-1993480236-4026764921-1001:

Process 1912 (\Device\HarddiskVolume2\Program Files (x86)\AVG\Antivirus\AVGSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-2642546764-1993480236-4026764921-1001

Process 712 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-2642546764-1993480236-4026764921-1001

system log

Vino's Event Viewer v01c run on Windows 2008 in English

Report run at 06/09/2017 11:17:07 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 06/09/2017 4:07:53 PM

Type: Error Category: 0

Event: 7043 Source: Service Control Manager

The Energy Server Service queencreek service did not shut down properly after receiving a preshutdown control.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Warning Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 06/09/2017 4:07:56 PM

Type: Warning Category: 0

Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig

WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 06/09/2017 4:07:56 PM

Type: Warning Category: 0

Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig

WLAN Extensibility Module has stopped. Module Path: C:\Windows\System32\IWMSSvc.dll

#40
RKinner

Posted 06 September 2017 - 10:34 AM

Malware Expert

Expert
24,625 posts

Intel Driver Update Utility is not working correctly so I would uninstall it.

How is it running now?

#41
gregahoffman

Posted 06 September 2017 - 11:49 AM

Member

Topic Starter
Member
400 posts

seems ok, somehow the fb purity is gone too

#42
RKinner

Posted 06 September 2017 - 12:16 PM

Malware Expert

Expert
24,625 posts

Try installing FBP again. There was a recent code change by facebook that broke it.

#43
gregahoffman

Posted 06 September 2017 - 12:55 PM

Member

Topic Starter
Member
400 posts

i did that, still didn't work. also checked the developer box and still not enabled.

too bad, i liked it

#44
RKinner

Posted 06 September 2017 - 03:56 PM

Malware Expert

Expert
24,625 posts

I use it on Chrome and it still works but I went to Firefox and tried to get it and it said: "This add-on is not compatible with your version of Firefox." No doubt it will get updated in a few days.