Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Only Qualified Seasoned Techs need to read, have I got a log for you&#

Started by canyouseeemenow , Nov 17 2014 12:41 AM

malware adware updates installation problems etc

This topic is locked

#16
canyouseeemenow

Posted 17 November 2014 - 01:56 PM

Member

Topic Starter
Member
24 posts

It shows I have an important update to install - for Silverlight. it will not install - the error message I posted up above is from that attempted update

#17
Essexboy

Posted 17 November 2014 - 02:02 PM

GeekU Moderator

Retired Staff
69,964 posts

Did you try the Silverlight fixit ? http://support.micro....com/kb/2608523

#18
canyouseeemenow

Posted 17 November 2014 - 02:39 PM

Member

Topic Starter
Member
24 posts

The fixit from microsoft for silverlight fixed it- system has been rebooted, the update installed and everything seems to be running great. Again, thank you for taking the time to assist me, I appreciate it.

#19
Essexboy

Posted 17 November 2014 - 02:44 PM

GeekU Moderator

Retired Staff
69,964 posts

Glad to help

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

#20
canyouseeemenow

Posted 17 November 2014 - 03:02 PM

Member

Topic Starter
Member
24 posts

wow. what is the difference of java versus the javara? What exactly is java used for? The user of this pc generally surfs youtube and wattpad-maybe some local stores and such, should I disable or will she need it to view video's? Also, what is cryptoransome for? (questioning only for understanding and learning, installing these applications as suggestions) here is log from delfix

# DelFix v10.8 - Logfile created 17/11/2014 at 12:57:43

# Updated 29/07/2014 by Xplode

# Username : nichellep7 - MYDELL-PC

# Operating System : Windows 8.1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST

Deleted : C:\AdwCleaner

Deleted : C:\Users\nichellep7\Desktop\Addition.txt

Deleted : C:\Users\nichellep7\Desktop\aswmbr.exe

Deleted : C:\Users\nichellep7\Desktop\aswMBR.txt

Deleted : C:\Users\nichellep7\Desktop\FRST.txt

Deleted : C:\Users\nichellep7\Desktop\FRST64 - Shortcut.lnk

Deleted : C:\Users\nichellep7\Downloads\Addition.txt

Deleted : C:\Users\nichellep7\Downloads\AdwCleaner.exe

Deleted : C:\Users\nichellep7\Downloads\Fixlog.txt

Deleted : C:\Users\nichellep7\Downloads\FRST.txt

Deleted : C:\Users\nichellep7\Downloads\FRST64.exe

Deleted : C:\Users\nichellep7\Downloads\FSS.exe

Deleted : C:\Users\nichellep7\Downloads\FSS.txt

Deleted : HKLM\SOFTWARE\AdwCleaner

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #42 [Windows Update | 11/15/2014 12:43:44]

Deleted : RP #43 [avast! antivirus system restore point | 11/17/2014 18:40:39]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

#21
Essexboy

Posted 17 November 2014 - 03:13 PM

GeekU Moderator

Retired Staff
69,964 posts

Java is generally used for custom built business programmes and Java games on facebook, I have not had it on my system now for about two years and never missed it. Javara is a programme specially designed to remove all traces of older java installations which can be compromised, once you have used it, it can be deleted.

Ransomware encrypts documents and pictures on an infected computer and the only decryption key is held by the malware writers, so if you want them back you have to pay http://www.bleepingc...are-information

Any further questions then just ask

#22
canyouseeemenow

Posted 17 November 2014 - 03:22 PM

Member

Topic Starter
Member
24 posts

wow!! Ok, I am doing the other uninstalling of java now- installing and running javara- installing crypto- and clicky is KEY.. never heard of it- excited to use it. ... must have lunch first .. .lol do you need anymore logs from me essex? otherwise I will do the aforementioned and will check back with you tomorrow to hopefully give you an a- ok with system and that all is running smoothly.

-- last question, I think.. is any of the information in all of these logs safe to keep in an open forum? as far as the information on this machine?

#23
Essexboy

Posted 17 November 2014 - 03:26 PM

GeekU Moderator

Retired Staff
69,964 posts

The only personal information is the user name otherwise it is all standard system and malware files

A lot of people when the install programmes use the standard install which is where all the sneaky adware gets in, unchecky will stop most of them installing

#24
canyouseeemenow

Posted 18 November 2014 - 12:20 PM

Member

Topic Starter
Member
24 posts

Good day Essex, well I almost made it through the 24 hour period without any glitches until -yep.. you guessed it.. java... the young person & her mother were impatient for javara yesterday - installed java direct from oracle and while that may or may not be the culprit, I think there is actually something on this machine again. What can I use as a quick scan just to check please?

#25
Essexboy

Posted 18 November 2014 - 12:21 PM

GeekU Moderator

Retired Staff
69,964 posts

For sure run a quick FRST and let me know what the symptoms are

#26
canyouseeemenow

Posted 18 November 2014 - 02:45 PM

Member

Topic Starter
Member
24 posts

oh my goodness! well now the scan tool is on a perpetual loop ! here is the frst scan log and really.. I'm just seeing a lot of those ads the web pages again .. not like before.. but more than when we first fixed... or perhaps i'm imagining things..

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2014

Ran by nichellep7 at 2014-11-18 12:41:08

Running from C:\Users\nichellep7\Downloads

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)

Amazon 1Button App for Windows Taskbar (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.2 - Amazon)

Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 4.5.4.0 - Auslogics Labs Pty Ltd)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)

BitTorrent (HKU\S-1-5-21-3695047611-1487521202-2779936226-1001\...\BitTorrent) (Version: 7.9.2.36047 - BitTorrent Inc.)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)

CryptoPrevent (HKLM-x32\...\{5C5B24E7-4694-4049-A222-CCE7D3FAC63F}_is1) (Version: - Foolish IT LLC)

CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dell Backup and Recovery - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 1.5.0.0 - Dell Inc.)

Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.5.0.0 - Dell Inc.)

Dell Digital Delivery (HKLM-x32\...\{4B3230C5-F069-416B-9169-1B84A216ED6A}) (Version: 2.5.1400.0 - Dell Products, LP)

Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.16.1 - Dell Inc.)

Dell System Detect (HKU\S-1-5-21-3695047611-1487521202-2779936226-1001\...\73f463568823ebbe) (Version: 5.12.0.3 - Dell)

Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 16.3.7.0 - Synaptics Incorporated)

Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)

DSC/AA Factory Installer (Version: 3.3.6261.27 - PC-Doctor, Inc.) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

iCloud (HKLM\...\{2AAF09D5-4B3F-4975-B6A9-ECE2631FC942}) (Version: 4.0.5.20 - Apple Inc.)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.7.0.1013 - Intel Corporation)

iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)

Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.4.6361.48 - PC-Doctor, Inc.)

Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.218 - Qualcomm Atheros Communications)

Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.15.018 - Dell Inc.)

QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6788 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)

SanDiskSecureAccess_Manager.exe (HKU\S-1-5-21-3695047611-1487521202-2779936226-1001\...\@@__UNKNOWN__@@SanDiskSecureAccess_Manager.exe) (Version: 1.1.19755 - Gemalto N.V.)

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

Unchecky v0.3.3 (HKLM-x32\...\Unchecky) (Version: 0.3.3 - RaMMicHaeL)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3695047611-1487521202-2779936226-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points =========================

17-11-2014 20:58:11 End of disinfection

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 05:25 - 2014-11-17 18:29 - 00001993 ____A C:\WINDOWS\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly

0.0.0.0 tracking.opencandy.com.s3.amazonaws.com

0.0.0.0 media.opencandy.com

0.0.0.0 cdn.opencandy.com

0.0.0.0 tracking.opencandy.com

0.0.0.0 api.opencandy.com

0.0.0.0 installer.betterinstaller.com

0.0.0.0 installer.filebulldog.com

0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net

0.0.0.0 inno.bisrv.com

0.0.0.0 nsis.bisrv.com

0.0.0.0 cdn.file2desktop.com

0.0.0.0 cdn.goateastcach.us

0.0.0.0 cdn.guttastatdk.us

0.0.0.0 cdn.inskinmedia.com

0.0.0.0 cdn.insta.oibundles2.com

0.0.0.0 cdn.insta.playbryte.com

0.0.0.0 cdn.llogetfastcach.us

0.0.0.0 cdn.montiera.com

0.0.0.0 cdn.msdwnld.com

0.0.0.0 cdn.mypcbackup.com

0.0.0.0 cdn.ppdownload.com

0.0.0.0 cdn.riceateastcach.us

0.0.0.0 cdn.shyapotato.us

0.0.0.0 cdn.solimba.com

0.0.0.0 cdn.tuto4pc.com

0.0.0.0 cdn.appround.biz

0.0.0.0 cdn.bigspeedpro.com

0.0.0.0 cdn.bispd.com

There are 4 more lines.

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0A1629B5-85CA-444A-B6EA-6B4D8F27F14C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-11-12] (Microsoft Corporation)

Task: {113B18BD-D5EF-4EDE-A46D-7E67AB10662F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner64.exe [2014-10-30] (Piriform Ltd)

Task: {17EF2A98-5A50-4E8D-92FC-56C93779DA87} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-11] (Google Inc.)

Task: {192E641C-3A60-408E-A368-C92E097D87BE} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-11-06] (PC-Doctor, Inc.)

Task: {2D3775F6-CAD8-41CE-999E-1C452B57B795} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-12-02] (CyberLink)

Task: {3884B375-7BD9-4EFF-921E-B56CCE3A97C1} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-3695047611-1487521202-2779936226-1001

Task: {45B3E2EA-77A3-42D4-9218-5670EC063DD3} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-11] (Adobe Systems Incorporated)

Task: {9A4D80D7-6075-48D6-B5F2-16D672425655} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-12-20] (Synaptics Incorporated)

Task: {B647156A-8DF8-47DE-BDC6-57D56A3A8A40} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-17] (AVAST Software)

Task: {C82F2535-9EBF-4312-96F4-8EF55B4AB7DB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {DB10705A-F216-4BBE-A9CF-A7DA5F50853C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-11] (Google Inc.)

Task: {DCE2FA30-2B1E-400B-9189-DAABD7B51A22} - System32\Tasks\Dell\Dell System Registration => C:\Program Files (x86)\System Registration\prodreg.exe [2012-07-09] (Dell, Inc.)

Task: {DF2B4FA0-9BAA-42EE-B72C-EA0D37AB6195} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe

Task: {E34C5A7E-9A85-4F15-BB18-A385D59ECE35} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2012-12-02] (CyberLink Corp.)

Task: {F139237A-F3BB-4C9A-90BE-33F1A4CA2BA1} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2014-10-17] (Apple Inc.)

Task: {FA6BCED6-5411-40F9-B80F-6AAD421DA2B1} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-05] (PC-Doctor, Inc.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) =============

2013-08-05 07:57 - 2012-04-24 18:43 - 00254512 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

2014-11-17 10:43 - 2014-11-17 10:43 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll

2014-11-17 10:43 - 2014-11-17 10:43 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll

2013-08-05 08:00 - 2013-04-19 14:51 - 00020256 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBROverlayIcon.dll

2013-08-05 08:00 - 2013-04-19 14:52 - 00049440 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\STCommonShellIntegration.dll

2013-08-05 08:00 - 2013-04-19 14:51 - 00019232 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBROverlayNotBackuped.dll

2013-08-05 08:00 - 2013-04-19 14:51 - 00034080 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRShellExtension.dll

2014-09-09 20:43 - 2014-09-09 20:43 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\ErrorReporting.dll

2012-12-28 12:39 - 2012-12-28 12:39 - 00011264 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll

2012-12-28 12:36 - 2012-12-28 12:36 - 00084480 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Modules\Map\MAP.dll

2012-12-28 12:41 - 2012-12-28 12:41 - 00012928 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\ActivateDesktop.exe

2013-08-05 08:00 - 2013-04-19 14:51 - 00023328 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe

2014-11-17 10:43 - 2014-11-17 10:43 - 02902528 _____ () C:\Program Files\AVAST Software\Avast\defs\14111701\algo.dll

2014-11-17 10:43 - 2014-11-17 10:43 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll

2014-11-18 03:24 - 2014-11-18 03:24 - 02902528 _____ () C:\Program Files\AVAST Software\Avast\defs\14111800\algo.dll

2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-11-17 10:43 - 2014-11-17 10:43 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2013-08-05 07:55 - 2012-06-07 19:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

2012-06-08 10:34 - 2012-06-08 10:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

2014-10-27 15:30 - 2014-10-27 15:30 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\2133a50009fa3b357bfbd29a218be0f6\PSIClient.ni.dll

2013-08-05 07:46 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

2013-08-05 08:00 - 2013-05-02 15:01 - 01813792 _____ () C:\Program Files (x86)\Dell Backup and Recovery\OLCoreWrapper.dll

2014-11-11 09:59 - 2014-10-21 20:04 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll

2014-11-11 09:59 - 2014-10-21 20:04 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll

2014-11-11 09:59 - 2014-10-21 20:04 - 08910664 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll

2014-11-11 09:59 - 2014-10-21 20:04 - 01681224 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll

2014-11-11 09:59 - 2014-10-21 20:05 - 14902600 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\nichellep7\SkyDrive:ms-properties

AlternateDataStreams: C:\Users\nichellep7\SkyDrive (2).old:ms-properties

AlternateDataStreams: C:\Users\nichellep7\SkyDrive (3).old:ms-properties

AlternateDataStreams: C:\Users\nichellep7\SkyDrive (4).old:ms-properties

AlternateDataStreams: C:\Users\nichellep7\SkyDrive (5).old:ms-properties

AlternateDataStreams: C:\Users\nichellep7\SkyDrive (6).old:ms-properties

AlternateDataStreams: C:\Users\nichellep7\SkyDrive (7).old:ms-properties

AlternateDataStreams: C:\Users\nichellep7\SkyDrive.old:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

HKLM\...\.exe: CryptoPreventEXE => "C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.CryptoPreventEXEC" /"%1" %* <===== ATTENTION!

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "BtPreLoad"

HKLM\...\StartupApproved\Run: => "QuickSet"

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKLM\...\StartupApproved\Run32: => "IAStorIcon"

HKLM\...\StartupApproved\Run32: => "GrooveMonitor"

HKLM\...\StartupApproved\Run32: => "iTunesHelper"

HKLM\...\StartupApproved\Run32: => "RemoteControl10"

HKLM\...\StartupApproved\Run32: => "QuickTime Task"

HKLM\...\StartupApproved\Run32: => "AVG_UI"

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"

HKCU\...\StartupApproved\StartupFolder: => "OneNote 2007 Screen Clipper and Launcher.lnk"

HKCU\...\StartupApproved\Run: => "SanDiskSecureAccess_Manager.exe"

HKCU\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_A738878360C0486FEE3419644487BA2F"

HKCU\...\StartupApproved\Run: => "PCSpeedUp"

HKCU\...\StartupApproved\Run: => "CCleaner Monitoring"

HKCU\...\StartupApproved\Run: => "iCloudServices"

========================= Accounts: ==========================

Administrator (S-1-5-21-3695047611-1487521202-2779936226-500 - Administrator - Disabled) => C:\Users\Administrator

Guest (S-1-5-21-3695047611-1487521202-2779936226-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3695047611-1487521202-2779936226-1003 - Limited - Enabled)

nichellep7 (S-1-5-21-3695047611-1487521202-2779936226-1001 - Administrator - Enabled) => C:\Users\nichellep7

nvrlk_000 (S-1-5-21-3695047611-1487521202-2779936226-1009 - Administrator - Enabled)

SophosSAUMYDELL-PC0 (S-1-5-21-3695047611-1487521202-2779936226-1004 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Bluetooth Audio Device

Description: Bluetooth Audio Device

Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}

Manufacturer: Qualcomm Atheros Communications

Service: BTATH_A2DP

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Virtual Bluetooth Support (Include Audio)

Description: Virtual Bluetooth Support (Include Audio)

Class Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5}

Manufacturer: Qualcomm Atheros Communications

Service: AthBTPort

Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

Resolution: Update the driver

Name: Bluetooth LWFLT Device

Description: Bluetooth LWFLT Device

Class Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5}

Manufacturer: Qualcomm Atheros Communications

Service: BTATH_LWFLT

Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

Resolution: Update the driver

==================== Event log errors: =========================

Application errors:

==================

Error: (11/18/2014 00:53:00 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (11/18/2014 00:53:00 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (11/18/2014 00:40:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 14031

Error: (11/18/2014 00:40:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 14031

Error: (11/18/2014 00:40:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/17/2014 06:37:15 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (11/17/2014 06:37:15 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Error: (11/17/2014 06:08:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (11/17/2014 06:08:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Error: (11/17/2014 06:02:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 3062

System errors:

=============

Error: (11/18/2014 00:49:20 AM) (Source: DCOM) (EventID: 10016) (User: MYDELL-PC)

Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}MyDell-PCnichellep7S-1-5-21-3695047611-1487521202-2779936226-1001LocalHost (Using LRPC)CapsuleDigital.PhotoFunia_4.10.0.0_neutral__yede6ekgzbztcS-1-15-2-3490798887-4175610012-4048354168-3993597651-1203629619-1240133896-111838046

Error: (11/17/2014 05:28:21 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 5:14:50 PM on ‎11/‎17/‎2014 was unexpected.

Error: (11/17/2014 04:51:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error:

%%1053

Error: (11/17/2014 04:51:16 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.

Error: (11/17/2014 04:50:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error:

%%1053

Error: (11/17/2014 04:50:46 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.

Error: (11/17/2014 04:49:10 PM) (Source: DCOM) (EventID: 10010) (User: MYDELL-PC)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (11/17/2014 04:48:40 PM) (Source: DCOM) (EventID: 10010) (User: MYDELL-PC)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (11/17/2014 04:48:10 PM) (Source: DCOM) (EventID: 10010) (User: MYDELL-PC)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (11/17/2014 04:47:40 PM) (Source: DCOM) (EventID: 10010) (User: MYDELL-PC)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Microsoft Office Sessions:

=========================

CodeIntegrity Errors:

===================================

Date: 2014-11-17 08:43:19.102

Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-11-17 04:04:24.407

Date: 2014-11-17 04:04:24.221

Date: 2014-11-17 04:04:24.045

Date: 2014-11-17 04:04:23.859

Date: 2014-11-17 04:04:23.672

Date: 2014-11-17 04:04:23.492

Date: 2014-11-17 04:04:23.303

Date: 2014-11-17 04:04:23.109

Date: 2014-11-17 04:04:22.940

==================== Memory info ===========================

Processor: Intel® Pentium® CPU 2127U @ 1.90GHz

Percentage of memory in use: 61%

Total physical RAM: 3965.27 MB

Available physical RAM: 1540.35 MB

Total Pagefile: 6257.12 MB

Available Pagefile: 2264.44 MB

Total Virtual: 131072 MB

Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:452.18 GB) (Free:387.58 GB) NTFS

Drive y: (WINRETOOLS) (Fixed) (Total:0.48 GB) (Free:0.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: F8DF98BD)

Partition: GPT Partition Type.

==================== End Of Log ============================

#27
Essexboy

Posted 18 November 2014 - 02:53 PM

GeekU Moderator

Retired Staff
69,964 posts

Could you post the main log please.... This may be the culprit "PCSpeedUp

#28
canyouseeemenow

Posted 18 November 2014 - 03:15 PM

Member

Topic Starter
Member
24 posts

I'm hoping you mean this one

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2014

Ran by nichellep7 at 2014-11-18 12:42:38