Spyware / Malware / Virus Removal

Random Script Errors [Solved]

2 min read

Looking for the outcome? Ask AI

TheCatMan Topic Starter

Post #1April 13, 2016, 9:45 PM UTC

Hello. This is The Cat Man I have been trying to help a friend with his Dell Desktop PC. He was getting random script errors and had major virus issues. The details are in my previous post on the Windows 10 help forum. There is a lot of information so I will just provide the link to my previous post. Here is the link.

https://forums.whatthetech.com/index.php?showtopic=130593&hl;=

A complete reformat / reinstall was recently done from the on board backup partition. I thought this would take care of any infection but script errors are still occurring. I tried steps 1 and 2 as suggested in the above post but errors are still occurring. I am concerned that some sort of infection may have lingered some how or that a new infection has been installed. So, I have followed the steps for scanning this system and have created the needed logs. They are posted below. Also, here are the specifics on this PC.

O/S: Windows 10 Home 64 Bit

Dell Desktop PC Inspiron 3646

Intel Pentium CPU J2900 @2.41GHz

4GB Intalled RAM

aswMBR Scan #1

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2016-04-13 16:48:41
—————————–
16:48:41.962    OS Version: Windows x64 6.2.9200
16:48:41.962    Number of processors: 4 586 0x3708
16:48:41.962    ComputerName: RADCON UserName: Robert
16:48:43.118    Initialize success
16:48:43.212    VM: initialized successfully
16:48:43.212    VM: Intel CPU supported
16:48:51.626    VM: disk I/O storahci.sys
16:50:30.058    AVAST engine defs: 16033102
16:51:10.012    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000021
16:51:10.012    Disk 0 Vendor: ST500DM002-1BD142 KC48 Size: 476940MB BusType: 11
16:51:10.137    Disk 0 MBR read successfully
16:51:10.153    Disk 0 MBR scan
16:51:10.169    Disk 0 unknown MBR code
16:51:10.184    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
16:51:10.278    Disk 0 scanning C:\WINDOWS\system32\drivers
16:51:33.685    Service scanning
16:52:21.610    Modules scanning
16:52:21.625    Disk 0 trace - called modules:
16:52:21.657    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
16:52:21.672    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe001fd534060]
16:52:21.672    3 CLASSPNP.SYS[fffff800768e7d95] -> nt!IofCallDriver -> \Device\00000021[0xffffe001fd538060]
16:52:24.766    AVAST engine scan C:\WINDOWS
16:52:30.095    AVAST engine scan C:\WINDOWS\system32
16:58:59.645    AVAST engine scan C:\WINDOWS\system32\drivers
16:59:55.366    AVAST engine scan C:\Users\Robert
17:05:50.835    AVAST engine scan C:\ProgramData
17:07:13.932    File: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{171EEBA9-5DD8-4A81-B314-91C10C159528} **SUSPICIOUS**
17:07:32.871    Disk 0 statistics 3401469/0/0 @ 239.32 MB/s
17:07:32.886    Scan finished successfully
17:07:52.387    Disk 0 MBR has been saved successfully to "C:\Users\Robert\Desktop\MBR.dat"
17:07:52.403    The log file has been saved successfully to "C:\Users\Robert\Desktop\aswMBR.txt"

FRST64 'Addition' Scan # 1

Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-04-2016
Ran by [removed] (2016-04-13 17:11:37)
Running from C:\Users\[removed]\Desktop
Windows 10 Home Version 1511 (X64) (2016-04-02 02:32:10)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1303108898-69141127-2366230325-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1303108898-69141127-2366230325-503 - Limited - Disabled)
Guest (S-1-5-21-1303108898-69141127-2366230325-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1303108898-69141127-2366230325-1005 - Limited - Enabled)
Robert (S-1-5-21-1303108898-69141127-2366230325-1001 - Administrator - Enabled) => C:\Users\Robert

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

CyberLink Media Suite Essentials (HKLM-x32\…\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Dell Backup and Recovery (HKLM-x32\…\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.8.0.66 - Dell Inc.)
Dell Customer Connect (HKLM-x32\…\{2A07BB79-284C-4C61-B8D5-4E146FAC91FB}) (Version: 1.0.0.8 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\…\{693A23FB-F28B-4F7A-A720-4C1263F97F43}) (Version: 3.1.1002.0 - Dell Products, LP)
Dell Foundation Services (HKLM\…\{AE5E3C86-2633-4DAF-A7F4-C43D1E738BAE}) (Version: 3.1.3300.0 - Dell Inc.)
Dell Product Registration (HKLM-x32\…\{17FFE63C-6734-4950-B488-134B5A2505F7}) (Version: 2.04.0280 - Aviata Inc.)
Dell Update (HKLM-x32\…\{865DEA2F-E2A1-4A23-8CB7-5C2C322DE3D9}) (Version: 1.8.1136.0 - Dell Inc.)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\…\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)
DSC/AA Factory Installer (Version: 3.5.6426.22 - PC-Doctor, Inc.) Hidden
HP Dropbox Plugin (HKLM-x32\…\{23617173-F935-4C17-A323-EB1207F3ED49}) (Version: 36.0.31.53050 - Hewlett-Packard Co.)
HP ENVY 5540 series Basic Device Software (HKLM\…\{44CE34C3-7B6A-44CA-BD7F-73E053BBAEC8}) (Version: 36.0.72.54013 - Hewlett-Packard Co.)
HP ENVY 5540 series Help (HKLM-x32\…\{3B1BE080-D477-4B94-AAE4-8B0BEC5D0CE3}) (Version: 35.0.0 - Hewlett Packard)
HP Google Drive Plugin (HKLM-x32\…\{AFF80405-E56A-48E7-98FC-8E46E261949F}) (Version: 36.0.31.53050 - Hewlett-Packard Co.)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.9572 - HP)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 45.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 45.0.2 (x86 en-US)) (Version: 45.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 45.0.2 - Mozilla)
My Dell (HKLM\…\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
My Dell Learning Center (HKLM\…\{DC451A89-545E-4297-AC2C-9F239CE7D695}) (Version: 1.0.510.0 - Dell Inc.)
Product Improvement Study for HP ENVY 5540 series (HKLM\…\{4F9AAF2D-42E6-4BD0-A295-842BC068CC4B}) (Version: 36.0.72.54013 - Hewlett-Packard Co.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\…\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.308 - Qualcomm Atheros Communications)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.30174 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7188 - Realtek Semiconductor Corp.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1303108898-69141127-2366230325-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Robert\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1303108898-69141127-2366230325-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {17415277-B970-45DC-A27E-2BBBE6394DF3} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {2D3BFF03-2616-4481-86D3-672A8CF9755F} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {2FBC24DE-568C-493B-AD89-2E95AFE58ED0} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {30177850-8871-4881-8873-34EA7A16BD40} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {ACFF5411-5272-4227-A424-2FDE76C1A174} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-22] (CyberLink Corp.)
Task: {B02C9F88-FF76-4585-A31A-84A65E1E6D71} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-03-04] (CyberLink)
Task: {B0FFEFA6-0401-4C67-B508-E8BC00A2D1D0} - System32\Tasks\UninstallDDS-C960901F-CE14-4DE1-9729-1305F719A337 => C:\WINDOWS\TEMP\DeleteFolderTask.exe [2016-04-13] ()
Task: {B364C08E-F7DF-4185-9CCE-4F0A2667E0F6} - \PCDoctorBackgroundMonitorTask -> No File <==== ATTENTION
Task: {B3C1C9D7-C857-4724-B822-6B0747BB5B2C} - \PCDEventLauncherTask -> No File <==== ATTENTION
Task: {C2319BAE-C2CB-4B1B-B934-4169C4594766} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {D09A5577-EE5F-42E0-8552-97518EA7118E} - System32\Tasks\Dell\Dell Product Registration => C:\Program Files (x86)\Dell Product Registration\prodreg.exe [2014-04-01] (Aviata Inc)
Task: {DF0DAF59-88C0-467F-B3B6-BF82AB8C9005} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {EC34AE09-76DE-44C3-B15C-7977CE061996} - \SystemToolsDailyTest -> No File <==== ATTENTION
Task: {EFEFE698-3920-421B-81FD-B2CE1A719762} - System32\Tasks\HPCustParticipation HP ENVY 5540 series => C:\Program Files\HP\HP ENVY 5540 series\Bin\HPCustPartic.exe [2015-03-09] (Hewlett-Packard Development Company, LP)
Task: {F00A6955-A45B-4DC6-B23C-7F91E28F6994} - System32\Tasks\Dell\Dell Product Registration Update => C:\Program Files (x86)\Dell Product Registration\prodreg.exe [2014-04-01] (Aviata Inc)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\RunDFS.job => IH cmd /c sc start Dell Foundation Services WORKGROUP RADCON
Task: C:\WINDOWS\Tasks\RunDLC.job => QKCH cmd /c sc start My Dell Learning Center WORKGROUP RADCON

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 03:18 - 2015-10-30 03:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-04-12 16:46 - 2016-03-29 06:20 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-12 16:46 - 2016-03-29 06:20 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-04-01 23:22 - 2016-04-01 23:22 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-02-13 08:54 - 2016-02-13 08:54 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-04-12 16:44 - 2016-04-01 23:25 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-04-12 16:45 - 2016-04-01 23:03 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-04-12 16:45 - 2016-04-01 22:58 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-04-12 16:45 - 2016-04-01 22:59 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-04-12 16:46 - 2016-04-01 23:02 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-01-22 17:37 - 2015-01-22 17:37 - 00022528 _____ () C:\Program Files\Dell\My Dell Learning Center\MDLCSvc.exe
2016-04-01 23:22 - 2016-04-01 23:22 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-01 23:22 - 2016-04-01 23:22 - 22330368 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2015-03-16 11:28 - 2015-03-16 11:28 - 00155528 _____ () C:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2016-03-24 17:47 - 2016-03-24 17:47 - 00127488 _____ () C:\Program Files (x86)\Dell Update\ServiceTagPlusPlus.dll
2015-06-03 03:22 - 2013-03-04 23:40 - 00626240 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-03-05 12:41 - 2013-03-05 12:41 - 00015424 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-06-03 03:35 - 2015-01-27 11:26 - 01905904 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\STRestoreAPI.dll
2015-06-03 03:35 - 2012-11-25 23:19 - 01153384 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\libxml2.dll
2015-06-03 03:34 - 2014-02-18 15:12 - 00117568 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\zlib1.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1303108898-69141127-2366230325-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Robert\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1303108898-69141127-2366230325-1001\…\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{E449C25A-1F87-4B11-A509-EB207439280B}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD Cinema\PowerDVDCinema12.exe
FirewallRules: [{7911E4E7-BD88-4AF2-B327-5F8121CEA4B6}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{6EE7A478-A424-47DF-9952-112C13763402}] => (Allow) C:\Program Files\HP\HP ENVY 5540 series\Bin\DeviceSetup.exe
FirewallRules: [{6CDD1640-8FA9-4B43-9320-DB9A4683E777}] => (Allow) LPort=5357
FirewallRules: [{37B7B7F6-7C1B-4958-91FF-DFA9EE38D07D}] => (Allow) C:\Program Files\HP\HP ENVY 5540 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{69D3515C-CE28-4045-99AC-53942F5193DB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{041AE8F1-A126-4140-892A-37F92D35EE88}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

05-04-2016 10:14:57 Dell Update: Dell Foundation Services
08-04-2016 08:56:51 Dell Update: eDellRoot Removal
08-04-2016 08:58:07 Dell Update: DSD Cert Removal
09-04-2016 09:11:17 Windows Modules Installer
12-04-2016 16:49:44 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (04/12/2016 05:16:45 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.