[panther74]

Farbar Recovery Scan Tool (x86) Version: 10-12-2013
Ran by SYSTEM at 2013-12-15 15:42:00
Running from F:\
Boot Mode: Recovery

================== Search: "hkcmd.exe" ===================

C:\Windows\System32\hkcmd.exe
[2013-11-07 17:13] - [2013-11-07 17:13] - 0173592 ____A (Intel Corporation) 13B671D7253F29DA148569288CECF74B

C:\Windows\System32\DriverStore\FileRepository\kit25730.inf_x86_neutral_ad99d83b86226390\hkcmd.exe
[2010-09-02 23:48] - [2010-06-16 06:33] - 0173592 ____A (Intel Corporation) BE2A9AB3C18AF1A712AAF8E86A5F959D

C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_x86_neutral_7e023b84287ce181\hkcmd.exe
[2013-11-07 17:13] - [2013-11-07 17:13] - 0173592 ____A (Intel Corporation) 13B671D7253F29DA148569288CECF74B

C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Graphics\hkcmd.exe
[2010-09-02 23:48] - [2010-06-16 06:33] - 0173592 ____A (Intel Corporation) BE2A9AB3C18AF1A712AAF8E86A5F959D

=== End Of Search ===

[Advertisements]

The file seems legit, although his signature was not present in the FRST log.

Tap on F8 during startup to reach the Advanced Menu. Select "Enable boot logging" and let the computer reach the error. If able to do it twice, much better. This should produce a file ntbtlog.txt in the Windows folder.

Once done, download the enclosed file.

Save it in the location FRST is.

Run FRST and click on the Fix button. Wait until finished.

The tool will make a log in the location FRST is, (Fixlog.txt). Please post it to your reply.

This will let us know if the file was produced.

[JSntgRvr]

The file seems legit, although his signature was not present in the FRST log.

Tap on F8 during startup to reach the Advanced Menu. Select "Enable boot logging" and let the computer reach the error. If able to do it twice, much better. This should produce a file ntbtlog.txt in the Windows folder.

Once done, download the enclosed file.

Save it in the location FRST is.

Run FRST and click on the Fix button. Wait until finished.

The tool will make a log in the location FRST is, (Fixlog.txt). Please post it to your reply.

This will let us know if the file was produced.

[panther74]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 10-12-2013
Ran by SYSTEM at 2013-12-15 17:50:52 Run:8
Running from F:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
Start
File: C:\Windows\ntbtlog.txt
end
*****************


========================= File: C:\Windows\ntbtlog.txt ========================

"C:\Windows\ntbtlog.txt" not found.
====== End Of File: ======


==== End of Fixlog ====

[JSntgRvr]

I have gone up and down this topic and see no reason for this behavior. IE cannot be the problem as we recover the registry of 12/02/2013, while IE was installed on the 7th.

In your position I would re-image the computer to factory settings. This, however, will erase all your data and third party software. If I am not mistaken, the procedure starts by pressing CTRL+F10 or ALT+F10 on an ACER during startup. If you wish to backup important documents, you may try Puppy Linux. There still a few commands we can try, but these will affect your ability to recover to factory settings.

Let me know your decision.

[panther74]

I am not sure what you are suggeting? How do I do a factory setting replace? Should I first try to replace fvevol.sys

[JSntgRvr]

I had already checked it (check page 2).

S0 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [196328 2013-01-23] (Microsoft Corporation)

It is signed by microsoft, but lets see every other copy.

Run FRST as you did before.

Type the following in the edit box on FRST, after "Search:".

fvevol.sys

It then should look like:

Search: fvevol.sys

Click Search button and post the log (Search.txt) it makes on the USB drive in your next reply.

[panther74]

Farbar Recovery Scan Tool (x86) Version: 10-12-2013
Ran by SYSTEM at 2013-12-15 23:15:27
Running from F:\
Boot Mode: Recovery

================== Search: "frevol.sys" ===================

=== End Of Search ===

[JSntgRvr]

Not frevol.sys, fvevol.sys.

[panther74]

Sorry about that.


Farbar Recovery Scan Tool (x86) Version: 10-12-2013
Ran by SYSTEM at 2013-12-16 08:19:43
Running from F:\
Boot Mode: Recovery

================== Search: "fvevol.sys" ===================

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7601.22230_none_30fbbed257615dfd\fvevol.sys
[2013-04-09 22:35] - [2013-01-23 20:28] - 0196328 ____A (Microsoft Corporation) 992C319BBB646EB966928ACC455B1968

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7601.18062_none_3053b0f13e5a478d\fvevol.sys
[2013-04-09 22:35] - [2013-01-23 20:47] - 0196328 ____A (Microsoft Corporation) D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7601.17514_none_308be1673e2fc6a8\fvevol.sys
[2011-04-29 17:57] - [2010-11-20 04:24] - 0194800 ____A (Microsoft Corporation) 8A73E79089B282100B9393B644CB853B

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.21432_none_2f1762605a3924bf\fvevol.sys
[2013-04-09 22:35] - [2013-01-23 20:53] - 0196328 ____A (Microsoft Corporation) 2EC6C877018403ADB075C3EFCD182092

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.20536_none_2f1b7c365a356da1\fvevol.sys
[2011-02-01 17:10] - [2009-09-25 22:14] - 0194488 ____A (Microsoft Corporation) 49476EFC1B61248749B2E254CBA7C84E

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.17221_none_2e97935141145286\fvevol.sys
[2013-04-09 22:35] - [2013-01-23 20:51] - 0195816 ____A (Microsoft Corporation) 4732E596BB1C50D9F9188C5074EE7782

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.16429_none_2e9fb035410cfdeb\fvevol.sys
[2011-02-01 17:10] - [2009-09-25 21:58] - 0194488 ____A (Microsoft Corporation) DAFBD9FE39197495AED6D51F3B85B5D2

C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.16385_none_2e5acd9f4141430e\fvevol.sys
[2009-07-13 15:13] - [2009-07-13 17:17] - 0194488 ____A (Microsoft Corporation) 5592F5DBA26282D24D2B080EB438A4D7

C:\Windows\System32\drivers\fvevol.sys
[2013-04-09 22:35] - [2013-01-23 20:47] - 0196328 ____A (Microsoft Corporation) D41D8CD98F00B204E9800998ECF8427E

X:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.16385_none_2e5acd9f4141430e\fvevol.sys
[2009-07-13 15:13] - [2009-07-13 17:17] - 0194488 ____A (Microsoft Corporation) 5592F5DBA26282D24D2B080EB438A4D7

X:\Windows\System32\drivers\fvevol.sys
[2009-07-13 15:13] - [2009-07-13 17:17] - 0194488 ____A (Microsoft Corporation) 5592F5DBA26282D24D2B080EB438A4D7

=== End Of Search ===

[JSntgRvr]

Lets replace that file with a new copy.

Download the enclosed file.

Save it in the location FRST is.

Run FRST and click on the Fix button. Wait until finished.

The tool will make a log in the location FRST is, (Fixlog.txt). Please post it to your reply.

Attempt to boot in Normal Mode and let me know the outcome.

[panther74]

I apologize for my delay in responing, but was out of all day yesterday.

That fix worked! It started normally. I started it twice. Thank you for not giving up. Oh happy day!

What did that fix do?

Do I need to anything else?


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 10-12-2013
Ran by SYSTEM at 2013-12-17 09:16:01 Run:9
Running from F:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
Start
Replace: C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.21432_none_2f1762605a3924bf\fvevol.sys C:\Windows\System32\drivers\fvevol.sys
end
*****************

C:\Windows\System32\drivers\fvevol.sys => Moved successfully.
C:\Windows\winsxs\x86_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_6.1.7600.21432_none_2f1762605a3924bf\fvevol.sys copied successfully to C:\Windows\System32\drivers\fvevol.sys

==== End of Fixlog ====

[JSntgRvr]

I replaced the file fvevol.sys, which by the way was reading legit. I didn't touch it before as there was no sign of being corrupted. But I am glad it did work.

I would reccomend AVAST as an antivirus and Malwarebytes as an anti-malware. You should remove all other security programs from the computer.

Would you like to perform a few scans to make sure there is no malware in the system?

[panther74]

Yes. I think it would help me to do a few more scans. I have kept the computer turned off since my message to you this morning, since I got a message that Comodo was not working.

[JSntgRvr]

You should remove Comodo and all other security program as we disabled all as part of a fix.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Download : ADWCleaner to your desktop.

NOTE: If using Internet Explorer and get an alert that stops the program downloading, click on the warning and allow the download to complete.

Close all programs and click on the AdwCleaner icon.



Click on Scan and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

The report will be saved in the C:\AdwCleaner folder, as AdwCleaner[S0].txt


Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

[panther74]

JRT scan results:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Starter x86
Ran by WWB on Tue 12/17/2013 at 20:18:49.75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{48A789BF-F6D6-4930-9C8B-77855A63EDE1}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\search settings
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_for_openoffice-org_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_for_openoffice-org_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48A789BF-F6D6-4930-9C8B-77855A63EDE1}



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\Program Files\secure speed dial"
Successfully deleted: [Folder] "C:\Program Files\Common Files\spigot"



~~~ Chrome

Successfully deleted: [Folder] C:\Users\WWB\appdata\local\Google\Chrome\User Data\Default\Extensions\iohgglcbddjknnemakghbjadinmopafl



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 12/17/2013 at 20:24:21.94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~