What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Kids computer is sluggish [Solved]

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

I tried running FARBAR but got an error message.  It disappeared to fast to read it.  Here is the results of ASWMBR scan

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-06-20 18:57:40
—————————–
18:57:40.266    OS Version: Windows x64 6.1.7601 Service Pack 1
18:57:40.266    Number of processors: 2 586 0x170A
18:57:40.266    ComputerName: AUSTINANDLOGAN  UserName:
18:57:41.280    Initialize success
18:57:41.280    VM: initialized successfully
18:57:41.280    VM: Intel CPU virtualization not supported
19:02:39.836    AVAST engine defs: 17030301
19:02:48.026    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:02:48.026    Disk 0 Vendor: Hitachi_ PB3O Size: 305245MB BusType: 3
19:02:48.166    Disk 0 MBR read successfully
19:02:48.166    Disk 0 MBR scan
19:02:48.182    Disk 0 Windows 7 default MBR code
19:02:48.197    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        13312 MB offset 2048
19:02:48.213    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 27265024
19:02:48.229    Disk 0 Boot: NTFS     code=1
19:02:48.244    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       291831 MB offset 27469824
19:02:48.369    Disk 0 scanning C:\Windows\system32\drivers
19:03:11.285    Service scanning
19:04:02.142    Modules scanning
19:04:02.157    Disk 0 trace - called modules:
19:04:02.188    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
19:04:02.188    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003f03060]
19:04:02.204    3 CLASSPNP.SYS[fffff880013be43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8002f5e050]
19:04:03.187    AVAST engine scan C:\Windows
19:04:06.478    AVAST engine scan C:\Windows\system32
19:07:27.750    AVAST engine scan C:\Windows\system32\drivers
19:07:47.999    AVAST engine scan C:\Users\Austin and Logan
19:09:02.192    File: C:\Users\Austin and Logan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQPUNB80\SporeSetup.exe  **INFECTED** Win32:Adware-gen [Adw]
19:17:14.061    Disk 0 MBR has been saved successfully to "C:\Users\Austin and Logan\Desktop\Scan\MBR.dat"
19:17:14.093    The log file has been saved successfully to "C:\Users\Austin and Logan\Desktop\Scan\aswMBR.txt"

 

Post #2
No idea what is interfering with Farbar, so, a couple of things we can try.

Since I don't know which antivirus you have, I can supply a link for you to locate instructions on how to temporarily disable it to see if you can run and scan with Farbar Recovery Scan Tool
here

Next
Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 6 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.
  • rkill.exe
  • rkill.com
  • rkill.scr
  • rkill.pif
  • WiNlOgOn.exe
  • uSeRiNiT.exe
**
Don't reboot, try to run the tool now.

Next**

If those above ideas didn't work, try booting into safe mode and run run Farbar Recovery Scan Tool again.

****

Let me know how you make out.
Post #3
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-06-2017 01
Ran by [removed] (21-06-2017 17:50:14)
Running from C:\Users\[removed]\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2015-02-08 17:22:56)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2493444446-161572686-3881217994-500 - Administrator - Disabled)
Austin and Logan (S-1-5-21-2493444446-161572686-3881217994-1000 - Administrator - Enabled) => C:\Users\Austin and Logan
Guest (S-1-5-21-2493444446-161572686-3881217994-501 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: COMODO Cloud Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2}
AS: COMODO Sandbox (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 26 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 26.0.0.131 - Adobe Systems Incorporated)
Adobe Reader 9.1 MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink Power2Go (HKLM-x32\…\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM-x32\…\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.3524.50 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\…\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
Gateway Games (HKLM-x32\…\WildTangent gateway Master Uninstall) (Version: 1.0.0.71 - WildTangent)
Gateway InfoCentre (HKLM-x32\…\Gateway InfoCentre) (Version: 3.02.3000 - Gateway Incorporated)
Gateway MyBackup (HKLM-x32\…\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Gateway Power Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Gateway Incorporated)
Gateway Recovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3006 - Gateway Incorporated)
Gateway Registration (HKLM-x32\…\Gateway Registration) (Version: 1.02.3006 - Gateway Incorporated)
Gateway Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Gateway Incorporated)
Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.2.183.13 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\…\CNXT_MODEM_HDA_HSF) (Version: 7.80.4.56 - Conexant Systems)
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3003 - Gateway Incorporated)
Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: 8.15.10.2202 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\…\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
JMicron Flash Media Controller Driver (HKLM-x32\…\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.32.1 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\…\LManager) (Version: 3.0.03 - Gateway)
MEGAsync (HKLM-x32\…\MEGAsync) (Version:  - Mega Limited)
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\…\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\…\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\…\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
Norton Online Backup (HKLM-x32\…\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 14.0.4.0 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Video Web Camera (HKLM-x32\…\{12A1B519-5934-4508-ADBD-335347B0DC87}) (Version: 1.7.139.715 - Chicony Electronics Co.,Ltd.)
Welcome Center (HKLM-x32\…\Gateway Welcome Center) (Version: 1.00.3009 - Gateway Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {15C213E1-82F1-4AA4-A0D7-E6C0A2B123EE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
Task: {9A548DF8-C152-447C-A26B-A889338F3F93} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-06-20] (Adobe Systems Incorporated)
Task: {C908649A-DD83-44A8-8CFC-A3FA7DD0710E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2014-05-01 10:13 - 2014-05-01 10:13 - 00470016 _____ () C:\Users\Austin and Logan\AppData\Local\MEGAsync\ShellExtX64.dll
2015-02-08 12:59 - 2010-06-09 06:54 - 00206208 _____ () C:\Windows\PLFSetI.exe
2009-02-02 20:33 - 2009-02-02 20:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\sqlite3.dll
2008-09-28 20:55 - 2008-09-28 20:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\ACE.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00619816 ____N () C:\Program Files (x86)\Cyberlink\Power2Go\CLMediaLibrary.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Austin and Logan\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{A76FC778-EDDB-4FA1-BCB3-DFAD212DCC81}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{BFBF772E-08A3-4E9A-9E45-962B82E55241}] => (Allow) svchost.exe
FirewallRules: [{0F637DAD-DC07-4D16-9F7D-09486C5EC982}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{8B4F51A6-0604-4B4B-A9E2-B6BC7C35A755}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{8B694B4F-C9CC-4DE1-87CA-3284A1A951AD}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{D0952FFA-475A-4800-BC4F-278F313D4E2F}] => (Allow) LPort=2869
FirewallRules: [{0C61C174-23D8-4030-B011-688DC40435A1}] => (Allow) LPort=1900
 
==================== Restore Points =========================
 
14-01-2017 20:16:47 Installed COMODO Cloud Antivirus
20-01-2017 16:27:16 Installed COMODO Cloud Antivirus
05-02-2017 08:12:32 Installed COMODO Cloud Antivirus
18-02-2017 21:40:38 Installed COMODO Cloud Antivirus
13-03-2017 13:57:50 Installed COMODO Cloud Antivirus
20-06-2017 18:30:21 Removed Cogeco Security Services
20-06-2017 18:33:35 Removed Minecraft
21-06-2017 17:42:07 Removed COMODO Cloud Antivirus
21-06-2017 17:44:32 Removed Atheros Communications Inc.(R) AR81Family Gigabit/Fast E¶>~
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (06/21/2017 05:44:33 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddWin32ServiceFiles: Unable to back up image of service isesrv since QueryServiceConfig API failed
 
System Error:
The system cannot find the file specified.
.
 
Error: (06/21/2017 05:44:33 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Internet Security Essentials.
 
System Error:
The system cannot find the file specified.
.
 
Error: (06/21/2017 05:36:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 18.6.2017.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: cb8
 
Start Time: 01d2ea1d4c231fe2
 
Termination Time: 0
 
Application Path: C:\Users\Austin and Logan\Downloads\FRST64.exe
 
Report Id:
 
Error: (06/21/2017 05:35:07 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 05:35:02 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 08:07:23 AM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 08:07:22 AM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:58:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:58:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:28:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
 
System errors:
=============
Error: (06/21/2017 05:42:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ccavsrv service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (06/21/2017 05:35:08 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 20.
 
Error: (06/20/2017 06:54:58 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0x0000100000060901, 0x0000000000000002, 0x0000000000000000, 0xfffff80002c971e4). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062017-26910-01.
 
Error: (06/20/2017 06:54:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 6:53:45 PM on ‎20/‎06/‎2017 was unexpected.
 
Error: (06/20/2017 06:22:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 4:42:07 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 04:24:19 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 4:23:14 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 04:14:26 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 3:53:52 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 03:40:34 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
 
Error: (06/14/2017 03:36:39 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 40.
 
Error: (06/14/2017 03:30:42 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 8:24:13 PM on ‎13/‎06/‎2017 was unexpected.
 
 
CodeIntegrity:
===================================
  Date: 2017-06-21 17:36:09.596
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 19:31:06.753
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 19:17:16.604
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:55:11.632
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:46:18.860
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:23:07.376
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:32:10.133
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:24:53.842
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:15:01.265
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 15:38:20.253
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
 
 
 
 
Farbar Scan Results
 
 
 
 
 
==================== Memory info =========================== 
 
Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
Percentage of memory in use: 34%
Total physical RAM: 3001.98 MB
Available physical RAM: 1969.88 MB
Total Virtual: 6002.16 MB
Available Virtual: 4736 MB
 
==================== Drives ================================
 
Drive c: (Gateway) (Fixed) (Total:284.99 GB) (Free:213.65 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: E9B315AB)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
Post #6

Sorry

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-06-2017 01
Ran by [removed] (21-06-2017 17:50:14)
Running from C:\Users\[removed]\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2015-02-08 17:22:56)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2493444446-161572686-3881217994-500 - Administrator - Disabled)
Austin and Logan (S-1-5-21-2493444446-161572686-3881217994-1000 - Administrator - Enabled) => C:\Users\Austin and Logan
Guest (S-1-5-21-2493444446-161572686-3881217994-501 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: COMODO Cloud Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2}
AS: COMODO Sandbox (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 26 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 26.0.0.131 - Adobe Systems Incorporated)
Adobe Reader 9.1 MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink Power2Go (HKLM-x32\…\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM-x32\…\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.3524.50 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\…\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
Gateway Games (HKLM-x32\…\WildTangent gateway Master Uninstall) (Version: 1.0.0.71 - WildTangent)
Gateway InfoCentre (HKLM-x32\…\Gateway InfoCentre) (Version: 3.02.3000 - Gateway Incorporated)
Gateway MyBackup (HKLM-x32\…\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Gateway Power Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Gateway Incorporated)
Gateway Recovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3006 - Gateway Incorporated)
Gateway Registration (HKLM-x32\…\Gateway Registration) (Version: 1.02.3006 - Gateway Incorporated)
Gateway Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Gateway Incorporated)
Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.2.183.13 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\…\CNXT_MODEM_HDA_HSF) (Version: 7.80.4.56 - Conexant Systems)
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3003 - Gateway Incorporated)
Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: 8.15.10.2202 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\…\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
JMicron Flash Media Controller Driver (HKLM-x32\…\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.32.1 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\…\LManager) (Version: 3.0.03 - Gateway)
MEGAsync (HKLM-x32\…\MEGAsync) (Version:  - Mega Limited)
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\…\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\…\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\…\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
Norton Online Backup (HKLM-x32\…\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 14.0.4.0 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Video Web Camera (HKLM-x32\…\{12A1B519-5934-4508-ADBD-335347B0DC87}) (Version: 1.7.139.715 - Chicony Electronics Co.,Ltd.)
Welcome Center (HKLM-x32\…\Gateway Welcome Center) (Version: 1.00.3009 - Gateway Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {15C213E1-82F1-4AA4-A0D7-E6C0A2B123EE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
Task: {9A548DF8-C152-447C-A26B-A889338F3F93} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-06-20] (Adobe Systems Incorporated)
Task: {C908649A-DD83-44A8-8CFC-A3FA7DD0710E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2014-05-01 10:13 - 2014-05-01 10:13 - 00470016 _____ () C:\Users\Austin and Logan\AppData\Local\MEGAsync\ShellExtX64.dll
2015-02-08 12:59 - 2010-06-09 06:54 - 00206208 _____ () C:\Windows\PLFSetI.exe
2009-02-02 20:33 - 2009-02-02 20:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\sqlite3.dll
2008-09-28 20:55 - 2008-09-28 20:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\ACE.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00619816 ____N () C:\Program Files (x86)\Cyberlink\Power2Go\CLMediaLibrary.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Austin and Logan\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{A76FC778-EDDB-4FA1-BCB3-DFAD212DCC81}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{BFBF772E-08A3-4E9A-9E45-962B82E55241}] => (Allow) svchost.exe
FirewallRules: [{0F637DAD-DC07-4D16-9F7D-09486C5EC982}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{8B4F51A6-0604-4B4B-A9E2-B6BC7C35A755}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{8B694B4F-C9CC-4DE1-87CA-3284A1A951AD}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{D0952FFA-475A-4800-BC4F-278F313D4E2F}] => (Allow) LPort=2869
FirewallRules: [{0C61C174-23D8-4030-B011-688DC40435A1}] => (Allow) LPort=1900
 
==================== Restore Points =========================
 
14-01-2017 20:16:47 Installed COMODO Cloud Antivirus
20-01-2017 16:27:16 Installed COMODO Cloud Antivirus
05-02-2017 08:12:32 Installed COMODO Cloud Antivirus
18-02-2017 21:40:38 Installed COMODO Cloud Antivirus
13-03-2017 13:57:50 Installed COMODO Cloud Antivirus
20-06-2017 18:30:21 Removed Cogeco Security Services
20-06-2017 18:33:35 Removed Minecraft
21-06-2017 17:42:07 Removed COMODO Cloud Antivirus
21-06-2017 17:44:32 Removed Atheros Communications Inc.(R) AR81Family Gigabit/Fast E¶>~
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (06/21/2017 05:44:33 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddWin32ServiceFiles: Unable to back up image of service isesrv since QueryServiceConfig API failed
 
System Error:
The system cannot find the file specified.
.
 
Error: (06/21/2017 05:44:33 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Internet Security Essentials.
 
System Error:
The system cannot find the file specified.
.
 
Error: (06/21/2017 05:36:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 18.6.2017.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: cb8
 
Start Time: 01d2ea1d4c231fe2
 
Termination Time: 0
 
Application Path: C:\Users\Austin and Logan\Downloads\FRST64.exe
 
Report Id:
 
Error: (06/21/2017 05:35:07 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 05:35:02 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 08:07:23 AM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 08:07:22 AM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:58:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:58:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:28:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
 
System errors:
=============
Error: (06/21/2017 05:42:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ccavsrv service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (06/21/2017 05:35:08 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 20.
 
Error: (06/20/2017 06:54:58 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0x0000100000060901, 0x0000000000000002, 0x0000000000000000, 0xfffff80002c971e4). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062017-26910-01.
 
Error: (06/20/2017 06:54:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 6:53:45 PM on ‎20/‎06/‎2017 was unexpected.
 
Error: (06/20/2017 06:22:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 4:42:07 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 04:24:19 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 4:23:14 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 04:14:26 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 3:53:52 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 03:40:34 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
 
Error: (06/14/2017 03:36:39 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 40.
 
Error: (06/14/2017 03:30:42 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 8:24:13 PM on ‎13/‎06/‎2017 was unexpected.
 
 
CodeIntegrity:
===================================
  Date: 2017-06-21 17:36:09.596
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 19:31:06.753
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 19:17:16.604
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:55:11.632
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:46:18.860
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:23:07.376
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:32:10.133
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:24:53.842
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:15:01.265
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 15:38:20.253
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
Percentage of memory in use: 34%
Total physical RAM: 3001.98 MB
Available physical RAM: 1969.88 MB
Total Virtual: 6002.16 MB
Available Virtual: 4736 MB
 
==================== Drives ================================
 
Drive c: (Gateway) (Fixed) (Total:284.99 GB) (Free:213.65 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: E9B315AB)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
Post #7
This is the Addition.txt

OK, we'll come back to FRST soon.

[external image: h3qKPnn.png]Malwarebytes AdwCleaner
    • Please download Malwarebytes AdwCleaner and save the file to your Desktop
    • Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
    • Follow the prompts.
    • Click [external image: A49sxPr.png]Scan.
    • Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S0].txt) will open. Briefly check the log for anything you know to be legitimate.
    • Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
    • Click [external image: MqHawIb.png]Clean.
    • Follow the prompts and allow your computer to reboot.
    • After the reboot, a log (AdwCleaner[C0].txt) will open. Copy the contents of the log and paste in your next reply.
      – File, folder and registry backups are made for items removed using this programme. Should a legitimate file, folder or registry item be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[S0].txt.

      ~~~~~~~~~~~~~~`

      Please download the Malwarebytes Anti-Malware setup file to your Desktop.

      OR from this location Here

    • Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
    • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
      [external image: MBAM3_zpsw0f8rn9n.jpg]




    • After the installation IS complete let it update if it asks. If not please click on the update now button.

    • Under SETTINGS…..APPLICATIONS leave everything at default

    • Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on.

    • Then go to the Dashboard and click on SCAN NOW

    • When the scan is finished click on EXPORT SUMMARY……COPY TO CLIPBOARD

    • Then come back to this thread and and under REPLY TO THIS TOPIC, right click in the reply and select Paste

    • Then click on POST


    • Exit Malwarebytes



Post #8
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-06-2017 01
Ran by [removed] (21-06-2017 17:50:14)
Running from C:\Users\[removed]\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2015-02-08 17:22:56)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2493444446-161572686-3881217994-500 - Administrator - Disabled)
Austin and Logan (S-1-5-21-2493444446-161572686-3881217994-1000 - Administrator - Enabled) => C:\Users\Austin and Logan
Guest (S-1-5-21-2493444446-161572686-3881217994-501 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: COMODO Cloud Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2}
AS: COMODO Sandbox (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 26 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 26.0.0.131 - Adobe Systems Incorporated)
Adobe Reader 9.1 MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink Power2Go (HKLM-x32\…\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM-x32\…\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.3524.50 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\…\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
Gateway Games (HKLM-x32\…\WildTangent gateway Master Uninstall) (Version: 1.0.0.71 - WildTangent)
Gateway InfoCentre (HKLM-x32\…\Gateway InfoCentre) (Version: 3.02.3000 - Gateway Incorporated)
Gateway MyBackup (HKLM-x32\…\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Gateway Power Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Gateway Incorporated)
Gateway Recovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3006 - Gateway Incorporated)
Gateway Registration (HKLM-x32\…\Gateway Registration) (Version: 1.02.3006 - Gateway Incorporated)
Gateway Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Gateway Incorporated)
Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.2.183.13 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\…\CNXT_MODEM_HDA_HSF) (Version: 7.80.4.56 - Conexant Systems)
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3003 - Gateway Incorporated)
Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: 8.15.10.2202 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\…\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
JMicron Flash Media Controller Driver (HKLM-x32\…\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.32.1 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\…\LManager) (Version: 3.0.03 - Gateway)
MEGAsync (HKLM-x32\…\MEGAsync) (Version:  - Mega Limited)
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\…\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\…\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\…\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
Norton Online Backup (HKLM-x32\…\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 14.0.4.0 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Video Web Camera (HKLM-x32\…\{12A1B519-5934-4508-ADBD-335347B0DC87}) (Version: 1.7.139.715 - Chicony Electronics Co.,Ltd.)
Welcome Center (HKLM-x32\…\Gateway Welcome Center) (Version: 1.00.3009 - Gateway Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {15C213E1-82F1-4AA4-A0D7-E6C0A2B123EE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
Task: {9A548DF8-C152-447C-A26B-A889338F3F93} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-06-20] (Adobe Systems Incorporated)
Task: {C908649A-DD83-44A8-8CFC-A3FA7DD0710E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-08] (Google Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2014-05-01 10:13 - 2014-05-01 10:13 - 00470016 _____ () C:\Users\Austin and Logan\AppData\Local\MEGAsync\ShellExtX64.dll
2015-02-08 12:59 - 2010-06-09 06:54 - 00206208 _____ () C:\Windows\PLFSetI.exe
2009-02-02 20:33 - 2009-02-02 20:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\sqlite3.dll
2008-09-28 20:55 - 2008-09-28 20:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\ACE.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00619816 ____N () C:\Program Files (x86)\Cyberlink\Power2Go\CLMediaLibrary.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Austin and Logan\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{A76FC778-EDDB-4FA1-BCB3-DFAD212DCC81}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{BFBF772E-08A3-4E9A-9E45-962B82E55241}] => (Allow) svchost.exe
FirewallRules: [{0F637DAD-DC07-4D16-9F7D-09486C5EC982}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{8B4F51A6-0604-4B4B-A9E2-B6BC7C35A755}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{8B694B4F-C9CC-4DE1-87CA-3284A1A951AD}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{D0952FFA-475A-4800-BC4F-278F313D4E2F}] => (Allow) LPort=2869
FirewallRules: [{0C61C174-23D8-4030-B011-688DC40435A1}] => (Allow) LPort=1900
 
==================== Restore Points =========================
 
14-01-2017 20:16:47 Installed COMODO Cloud Antivirus
20-01-2017 16:27:16 Installed COMODO Cloud Antivirus
05-02-2017 08:12:32 Installed COMODO Cloud Antivirus
18-02-2017 21:40:38 Installed COMODO Cloud Antivirus
13-03-2017 13:57:50 Installed COMODO Cloud Antivirus
20-06-2017 18:30:21 Removed Cogeco Security Services
20-06-2017 18:33:35 Removed Minecraft
21-06-2017 17:42:07 Removed COMODO Cloud Antivirus
21-06-2017 17:44:32 Removed Atheros Communications Inc.(R) AR81Family Gigabit/Fast E¶>~
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (06/21/2017 05:44:33 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddWin32ServiceFiles: Unable to back up image of service isesrv since QueryServiceConfig API failed
 
System Error:
The system cannot find the file specified.
.
 
Error: (06/21/2017 05:44:33 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Internet Security Essentials.
 
System Error:
The system cannot find the file specified.
.
 
Error: (06/21/2017 05:36:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 18.6.2017.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: cb8
 
Start Time: 01d2ea1d4c231fe2
 
Termination Time: 0
 
Application Path: C:\Users\Austin and Logan\Downloads\FRST64.exe
 
Report Id:
 
Error: (06/21/2017 05:35:07 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 05:35:02 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 08:07:23 AM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/21/2017 08:07:22 AM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:58:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:58:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
Error: (06/20/2017 07:28:29 PM) (Source: ESENT) (EventID: 454) (User: )
Description: wuaueng.dll (356) SUS20ClientDataStore: Database recovery/restore failed with unexpected error -1011.
 
 
System errors:
=============
Error: (06/21/2017 05:42:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ccavsrv service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (06/21/2017 05:35:08 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 20.
 
Error: (06/20/2017 06:54:58 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0x0000100000060901, 0x0000000000000002, 0x0000000000000000, 0xfffff80002c971e4). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062017-26910-01.
 
Error: (06/20/2017 06:54:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 6:53:45 PM on ‎20/‎06/‎2017 was unexpected.
 
Error: (06/20/2017 06:22:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 4:42:07 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 04:24:19 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 4:23:14 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 04:14:26 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 3:53:52 PM on ‎14/‎06/‎2017 was unexpected.
 
Error: (06/14/2017 03:40:34 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
 
Error: (06/14/2017 03:36:39 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 40.
 
Error: (06/14/2017 03:30:42 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 8:24:13 PM on ‎13/‎06/‎2017 was unexpected.
 
 
CodeIntegrity:
===================================
  Date: 2017-06-21 17:36:09.596
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 19:31:06.753
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 19:17:16.604
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:55:11.632
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:46:18.860
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-20 18:23:07.376
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:32:10.133
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:24:53.842
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 16:15:01.265
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-06-14 15:38:20.253
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CcavGuard64.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
Percentage of memory in use: 34%
Total physical RAM: 3001.98 MB
Available physical RAM: 1969.88 MB
Total Virtual: 6002.16 MB
Available Virtual: 4736 MB
 
==================== Drives ================================
 
Drive c: (Gateway) (Fixed) (Total:284.99 GB) (Free:213.65 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: E9B315AB)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
 
 
Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 6/22/17
Scan Time: 6:10 PM
Log File: mwb.txt
Administrator: Yes
 
-Software Information-
Version: 3.1.2.1733
Components Version: 1.0.141
Update Package Version: 1.0.2211
License: Trial
 
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: AustinandLogan\Austin and Logan
 
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 329568
Threats Detected: 32
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 8 min, 50 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
-Scan Details-
Process: 1
PUP.Optional.GeekBuddy, C:\PROGRAM FILES (X86)\COMMON FILES\COMODO\LAUNCHER_SERVICE.EXE, No Action By User, [1945], [342293],1.0.2211
 
Module: 1
PUP.Optional.GeekBuddy, C:\PROGRAM FILES (X86)\COMMON FILES\COMODO\LAUNCHER_SERVICE.EXE, No Action By User, [1945], [342293],1.0.2211
 
Registry Key: 3
PUP.Optional.GeekBuddy, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CLPSLAUNCHER, No Action By User, [1945], [342293],1.0.2211
PUP.Optional.GeekBuddy, HKLM\SOFTWARE\GeekBuddyRSP, No Action By User, [1945], [342277],1.0.2211
PUP.Optional.GeekBuddy, HKLM\SOFTWARE\WOW6432NODE\GeekBuddyRSP, No Action By User, [1945], [342277],1.0.2211
 
Registry Value: 3
PUP.Optional.GeekBuddy, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\PROGRAM FILES (X86)\COMMON FILES\COMODO\GeekBuddyRSP.exe, No Action By User, [1945], [366013],1.0.2211
PUP.Optional.GeekBuddy, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CLPSLAUNCHER|DISPLAYNAME, No Action By User, [1945], [342293],1.0.2211
PUP.Optional.GeekBuddy, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\PROGRAM FILES (X86)\COMMON FILES\COMODO\LAUNCHER_SERVICE.EXE, No Action By User, [1945], [342293],1.0.2211
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 2
PUP.Optional.Winsock.WnskRST, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\PlayPopGames, No Action By User, [2695], [181013],1.0.2211
PUP.Optional.Winsock.WnskRST, C:\USERS\AUSTIN AND LOGAN\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PLAYPOPGAMES, No Action By User, [2695], [181020],1.0.2211
 
File: 22
PUP.Optional.Winsock.WnskRST, C:\Users\Austin and Logan\AppData\Local\PlayPopGames\collapse.dll, No Action By User, [2695], [181013],1.0.2211
PUP.Optional.Winsock.WnskRST, C:\Users\Austin and Logan\AppData\Local\PlayPopGames\stargames.dll, No Action By User, [2695], [181013],1.0.2211
PUP.Optional.Winsock.WnskRST, C:\Users\Austin and Logan\AppData\Local\PlayPopGames\starinfo, No Action By User, [2695], [181013],1.0.2211
PUP.Optional.Winsock.WnskRST, C:\Users\Austin and Logan\AppData\Local\PlayPopGames\starwatch.dll, No Action By User, [2695], [181013],1.0.2211
PUP.Optional.MindSpark, C:\USERS\AUSTIN AND LOGAN\DESKTOP\MAPSGALAXY.16CEBB3F4CAD418298408F1FE7A65526.EXE, No Action By User, [276], [365288],1.0.2211
PUP.Optional.DownloadSponsor, C:\USERS\AUSTIN AND LOGAN\DESKTOP\MINECRAFT.EXE, No Action By User, [525], [349501],1.0.2211
PUP.Optional.MindSpark, C:\USERS\AUSTIN AND LOGAN\DESKTOP\PDFCONVERTERHQ.FF7347AE624A45E2AA949D387C19B390.EXE, No Action By User, [276], [365288],1.0.2211
PUP.Optional.GeekBuddy, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\TEMP\IN5081608C\043E0B8E_STP\LPS-GB-VT-X64.EXE, No Action By User, [1945], [342282],1.0.2211
PUP.Optional.DealPly, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\TEMP\INH973666255883\ENIGMAENCODE.EXE, No Action By User, [232], [327616],1.0.2211
PUP.Optional.InstallCore, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\TEMP\ICSW1.23\ICSW1.23_0I0M0D1F2W1G1I1F1T1Q1P1C1V0B1L1G1N1.23.EXE, No Action By User, [3], [339313],1.0.2211
PUP.Optional.MindSpark, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\TEMP\NSOC745.TMP\NSDIALOGS.DLL, No Action By User, [276], [301125],1.0.2211
PUP.Optional.MindSpark, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\TEMP\NSPFAE.TMP\NSDIALOGS.DLL, No Action By User, [276], [301125],1.0.2211
PUP.Optional.MindSpark, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\TEMP\NSPA9A8.TMP\NSDIALOGS.DLL, No Action By User, [276], [301125],1.0.2211
PUP.Optional.MindSpark, C:\USERS\AUSTIN AND LOGAN\APPDATA\LOCAL\TEMP\NSPC8FA.TMP\NSDIALOGS.DLL, No Action By User, [276], [301125],1.0.2211
PUP.Optional.InstallCore, C:\USERS\AUSTIN AND LOGAN\DOWNLOADS\FIVE-NIGHTS-AT-FREDDYS (1).EXE, No Action By User, [3], [301065],1.0.2211
PUP.Optional.DriverUpdate, C:\USERS\AUSTIN AND LOGAN\DOWNLOADS\DRIVERUPDATE-SETUP.EXE, No Action By User, [978], [331447],1.0.2211
PUP.Optional.MindSpark, C:\USERS\AUSTIN AND LOGAN\DOWNLOADS\ONLINEMAPFINDER.17895FC6005F4097B9DF8F08648F8DA5.EXE, No Action By User, [276], [365288],1.0.2211
PUP.Optional.InstallCore, C:\USERS\AUSTIN AND LOGAN\DOWNLOADS\FIVE-NIGHTS-AT-FREDDYS (2).EXE, No Action By User, [3], [301065],1.0.2211
PUP.Optional.InstallCore, C:\USERS\AUSTIN AND LOGAN\DOWNLOADS\FIVE-NIGHTS-AT-FREDDYS.EXE, No Action By User, [3], [301065],1.0.2211
PUP.Optional.InstallCore, C:\USERS\AUSTIN AND LOGAN\DOWNLOADS\FIVE-NIGHTS-AT-FREDDYS-3.EXE, No Action By User, [3], [301065],1.0.2211
PUP.Optional.GeekBuddy, C:\PROGRAM FILES (X86)\COMMON FILES\COMODO\GeekBuddyRSP.exe, No Action By User, [1945], [366013],1.0.2211
PUP.Optional.GeekBuddy, C:\PROGRAM FILES (X86)\COMMON FILES\COMODO\LAUNCHER_SERVICE.EXE, No Action By User, [1945], [342293],1.0.2211
 
Physical Sector: 0
(No malicious items detected)
 
 
(end)
Post #9
Thank you for the logs

When you ran MalwareBytes, did you allow it to quarantine what it found?

Also, did you run AdwCleaner? and allow it to quarantine?
If so, a log file would had been created AdwCleaner[C0].txt <– can you look for this and post it please.
Post #10
Zemana AntiMalware Free

download it from here:


Double-click on the file named “Zemana.AntiMalware.Portable” to perform a system scan with Zemana AntiMalware Free.


You may be presented with a User Account Control dialog asking you if you want to run this program. If this happens, you should click “Yes” to allow Zemana AntiMalware to run.

When Zemana AntiMalware starts, click on the “Scan” button to perform a system scan.
without changing any options, press Scan


When Zemana has finished finished scanning it will show a screen that displays any malware that has been detected. To remove all the malicious files, click on the “Next” button.

Zemana AntiMalware will now start to remove all the malicious programs from your computer.

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
  • open Zemana AntiMalware again and locate the latest report
  • please paste the contents into your reply
When the process is complete, you can close Zemana AntiMalware
Post #11

Could have sworn I attached this but I guess not

 

# AdwCleaner v6.047 - Logfile created 22/06/2017 at 18:00:11
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-06-22.1 [Server]
# Operating System : Windows 7 Home Premium Service Pack 1 (X64)
# Username : Austin and Logan - AUSTINANDLOGAN
# Running from : C:\Users\Austin and Logan\Downloads\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support
 
 
 
***** [ Services ] *****
 
 
 
***** [ Folders ] *****
 
[-] Folder deleted: C:\Users\Austin and Logan\AppData\Local\slimware utilities inc
[#] Folder deleted on reboot: C:\Users\Austin and Logan\AppData\Local\SlimWare Utilities Inc
[-] Folder deleted: C:\Program Files\slimcleaner plus
[-] Folder deleted: C:\Program Files\slimservice
[#] Folder deleted on reboot: C:\Program Files\SlimCleaner Plus 
[#] Folder deleted on reboot: C:\Program Files\SlimService
[-] Folder deleted: C:\ProgramData\Partner
[-] Folder deleted: C:\ProgramData\slimware utilities inc
[#] Folder deleted on reboot: C:\ProgramData\SlimWare Utilities Inc
[#] Folder deleted on reboot: C:\ProgramData\Application Data\Partner
[#] Folder deleted on reboot: C:\ProgramData\Application Data\slimware utilities inc
[#] Folder deleted on reboot: C:\ProgramData\Application Data\SlimWare Utilities Inc
[-] Folder deleted: C:\Program Files (x86)\driverupdate
[#] Folder deleted on reboot: C:\Program Files (x86)\DriverUpdate
 
 
***** [ Files ] *****
 
[-] File deleted: C:\Users\Public\Desktop\eBay.lnk
 
 
***** [ DLL ] *****
 
 
 
***** [ WMI ] *****
 
 
 
***** [ Shortcuts ] *****
 
 
 
***** [ Scheduled Tasks ] *****
 
 
 
***** [ Registry ] *****
 
[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\geekbuddyrsp
[#] Key deleted on reboot: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\geekbuddyrsp
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[-] Key deleted: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\PRODUCTSETUP
[-] Key deleted: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\csastats
[-] Key deleted: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\MapsGalaxy
[-] Key deleted: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\ICSW1.23
[-] Key deleted: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\MapsGalaxyTooltab Uninstall Internet Explorer
[-] Key deleted: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyTransitGuideTooltab Uninstall Internet Explorer
[#] Key deleted on reboot: HKCU\Software\PRODUCTSETUP
[#] Key deleted on reboot: HKCU\Software\csastats
[#] Key deleted on reboot: HKCU\Software\MapsGalaxy
[#] Key deleted on reboot: HKCU\Software\ICSW1.23
[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MapsGalaxyTooltab Uninstall Internet Explorer
[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyTransitGuideTooltab Uninstall Internet Explorer
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[#] Key deleted on reboot: [x64] HKCU\Software\PRODUCTSETUP
[#] Key deleted on reboot: [x64] HKCU\Software\csastats
[#] Key deleted on reboot: [x64] HKCU\Software\MapsGalaxy
[#] Key deleted on reboot: [x64] HKCU\Software\ICSW1.23
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MapsGalaxyTooltab Uninstall Internet Explorer
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyTransitGuideTooltab Uninstall Internet Explorer
[-] Key deleted: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0AA24E16-07B3-4694-8357-3C21ACC5F516}
[-] Data restored: HKU\S-1-5-21-2493444446-161572686-3881217994-1000\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0AA24E16-07B3-4694-8357-3C21ACC5F516}
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0AA24E16-07B3-4694-8357-3C21ACC5F516}
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\b4.playsushi.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\cmptch.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\driverupdate.net
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\en.softonic.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\fromdoctopdf.dl.tb.ask.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mmotraffic.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mobogenie.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\playsushi.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\shop.unicef.ca
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\static.cmptch.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\staticimgfarm.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\the-joy-of-creation-reborn.en.softonic.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ttdetect.staticimgfarm.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\unicef.ca
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.driverupdate.net
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.mobogenie.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\b4.playsushi.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\cmptch.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\driverupdate.net
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\en.softonic.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\fromdoctopdf.dl.tb.ask.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mmotraffic.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mobogenie.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\playsushi.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\shop.unicef.ca
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\static.cmptch.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\staticimgfarm.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\the-joy-of-creation-reborn.en.softonic.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ttdetect.staticimgfarm.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\unicef.ca
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.driverupdate.net
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.mobogenie.com
 
 
***** [ Web browsers ] *****
 
 
 
*************************
 
:: "Tracing" keys deleted
:: Winsock settings cleared
 
*************************
 
C:\AdwCleaner\AdwCleaner[C0].txt - [9314 Bytes] - [22/06/2017 18:00:11]
C:\AdwCleaner\AdwCleaner[S0].txt - [8713 Bytes] - [22/06/2017 17:59:15]
 
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [9460 Bytes] ##########
Post #12
When you ran MalwareBytes, did you allow it to quarantine what it found?

Also, have you had a chance to run Zemana AntiMalware?

Tell me what the computer is doing now.
Post #13

MalwareBytes was already defaulted to allow quarantine.

 

The computer seems to reboot a lot faster now.

 

Here is the Zemana results

 

Zemana AntiMalware 2.74.2.76 (Installed)
 
——————————————————-
Scan Result            : Completed
Scan Date              : 2017/6/23
Operating System       : Windows 7 64-bit
Processor              : 2X Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
BIOS Mode              : Legacy
CUID                   : 126A28A4A9D1173416E155
Scan Type              : System Scan
Duration               : 10m 56s
Scanned Objects        : 65815
Detected Objects       : 11
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Enabled
Detect All Extensions  : Disabled
Scan Documents         : Disabled
Domain Info            : WORKGROUP,0,2
 
Detected Objects
——————————————————-
 
Internet Explorer URL
Status             : Scanned
Object             : http://homepage.gateway.com/rdr.aspx?b=ACGW&l=1009&m=tc73&r=273602154875l04d4z125a4772520o
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Suspicious Browser Setting
Cleaning Action    : Repair
Related Objects    :
                Browser Setting - Internet Explorer URL
 
PDFConverterHQ.ff7347ae624a45e2aa949d387c19b390.exe
Status             : Scanned
Object             : %userprofile%\desktop\pdfconverterhq.ff7347ae624a45e2aa949d387c19b390.exe
MD5                : DE6DD955C09F7A5B30D80CA5F63EC90C
Publisher          : Mindspark Interactive Network
Size               : 374064
Version            : 2.7.1.1000
Detection          : Adware:Win32/Mindspark!Ep
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\desktop\pdfconverterhq.ff7347ae624a45e2aa949d387c19b390.exe
 
minecraft.exe
Status             : Scanned
Object             : %userprofile%\desktop\minecraft.exe
MD5                : CB68AB4AE8CF8B92B7A74225FA3520B8
Publisher          : CHIP Digital GmbH
Size               : 1496584
Version            : 2.1.3.1
Detection          : PUA:Win32/CHIP.AdsDownloader!Ep
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\desktop\minecraft.exe
 
MapsGalaxy.16cebb3f4cad418298408f1fe7a65526.exe
Status             : Scanned
Object             : %userprofile%\desktop\mapsgalaxy.16cebb3f4cad418298408f1fe7a65526.exe
MD5                : 58A3CC36F8F069280810CA588F8D87CD
Publisher          : Mindspark Interactive Network
Size               : 378120
Version            : 2.7.1.1000
Detection          : Adware:Win32/Mindspark!Ep
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\desktop\mapsgalaxy.16cebb3f4cad418298408f1fe7a65526.exe
 
driverupdate-setup.exe
Status             : Scanned
Object             : NE->c:\users\austin and logan\downloads\driverupdate-setup.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : PUA:Win32/SlimCleaner.E!Neng
Cleaning Action    : Quarantine
Related Objects    :
                (null) - (null)
 
five-nights-at-freddys-3.exe
Status             : Scanned
Object             : %userprofile%\downloads\five-nights-at-freddys-3.exe
MD5                : 406720C269200B8ADBD7F04478312361
Publisher          : Funnel Agile  (New Media Holdings Ltd.)
Size               : 1671584
Version            : 0.0.0.0
Detection          : Adware:Win32/InstallCore.Variant!Sig
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\downloads\five-nights-at-freddys-3.exe
 
five-nights-at-freddys.exe
Status             : Scanned
Object             : %userprofile%\downloads\five-nights-at-freddys.exe
MD5                : 128CFC6B86C34ACC0943F439F8311EAC
Publisher          : Funnel Agile  (New Media Holdings Ltd.)
Size               : 1671584
Version            : 0.0.0.0
Detection          : Adware:Win32/InstallCore.Variant!Sig
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\downloads\five-nights-at-freddys.exe
 
OnlineMapFinder.17895fc6005f4097b9df8f08648f8da5.exe
Status             : Scanned
Object             : %userprofile%\downloads\onlinemapfinder.17895fc6005f4097b9df8f08648f8da5.exe
MD5                : 848E238B73BE79C76B3580A3F91731FD
Publisher          : Mindspark Interactive Network
Size               : 374744
Version            : 2.7.1.1000
Detection          : Adware:Win32/Mindspark!Ep
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\downloads\onlinemapfinder.17895fc6005f4097b9df8f08648f8da5.exe
 
five-nights-at-freddys (1).exe
Status             : Scanned
Object             : %userprofile%\downloads\five-nights-at-freddys (1).exe
MD5                : 158372EC3FF60C3BFF3BA49D5798D1BD
Publisher          : Funnel Agile  (New Media Holdings Ltd.)
Size               : 1671584
Version            : 0.0.0.0
Detection          : Adware:Win32/InstallCore.Variant!Sig
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\downloads\five-nights-at-freddys (1).exe
 
DriverUpdate-setup.exe
Status             : Scanned
Object             : %userprofile%\downloads\driverupdate-setup.exe
MD5                : 04C164F316826A21E3AB4886C8C7D035
Publisher          : Slimware Utilities Holdings, Inc.
Size               : 990952
Version            : 2.7.1.0
Detection          : Scareware:Win32/FakeOptimizer!Ep
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\downloads\driverupdate-setup.exe
 
five-nights-at-freddys (2).exe
Status             : Scanned
Object             : %userprofile%\downloads\five-nights-at-freddys (2).exe
MD5                : 158372EC3FF60C3BFF3BA49D5798D1BD
Publisher          : Funnel Agile  (New Media Holdings Ltd.)
Size               : 1671584
Version            : 0.0.0.0
Detection          : Adware:Win32/InstallCore.Variant!Sig
Cleaning Action    : Quarantine
Related Objects    :
                File - %userprofile%\downloads\five-nights-at-freddys (2).exe
 
 
Cleaning Result
——————————————————-
Cleaned               : 11
Reported as safe      : 0
Failed                : 0
Post #14

 

MalwareBytes was already defaulted to allow quarantine.
The computer seems to reboot a lot faster now.

 

Yes, sometimes there are people who forget to allow it to remove items found or mess with default settings.

 

Rebooting faster,  it's music to my ears.

 

***

 

Looking over the logs I can see items related to a bunch of malware and I'm very glad to see it being removed.

 

~~

This might be our last scan unless your still seeing problems.

 

 

  • Download Emsisoft Emergency Kit and save it to your desktop.
  • Double-click icon then click Install
  • A Window should open highlighting Start Emergency Kit Scanner
  • Right click on the icon and select Run as administrator
  • Click 1. Update now!
  • Once the update is completed select Settings under Scan
  • Uncheck Join the Emsisoft Anti-Malware Network
  • Click Scan at the top
  • Click On scan completion
  • Click Quarantine detected objects, then click OK
  • Click Malware Scan
  • Once completed click View Report
  • Save the file to your Desktop using the default file name
  • Copy and paste the report in your reply

=============

 

 

Post #15

Here is the Emsisoft scan

 

Emsisoft Emergency Kit - Version 2017.4

Last update: 24/06/2017 12:20:41 PM
User account: AustinandLogan\Austin and Logan
Computer name: AUSTINANDLOGAN
OS version: Windows 7x64 Service Pack 1
 
Scan settings:
 
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
 
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Direct disk access: Off
 
Scan start: 24/06/2017 12:23:47 PM
C:\$Recycle.Bin\S-1-5-21-2493444446-161572686-3881217994-1000\$RWV2WRI\minecraft-setup-173177019.exe detected: Application.Bundler.DownloadAdmin.AK (B) [krnl.xmd]
C:\Users\Austin and Logan\AppData\Local\Temp\nsoC745.tmp\nsDialogs.dll detected: Application.Toolbar (A) [285181]
C:\Users\Austin and Logan\AppData\Local\Temp\nspA9A8.tmp\nsDialogs.dll detected: Application.Toolbar (A) [285181]
C:\Users\Austin and Logan\AppData\Local\Temp\nspC8FA.tmp\nsDialogs.dll detected: Application.Toolbar (A) [285181]
C:\Users\Austin and Logan\AppData\Local\Temp\nspFAE.tmp\nsDialogs.dll detected: Application.Toolbar (A) [285181]
 
Scanned 83863
Found 5
 
Scan end: 24/06/2017 12:33:00 PM
Scan time: 0:09:13
 
C:\Users\Austin and Logan\AppData\Local\Temp\nsoC745.tmp\nsDialogs.dll Application.Toolbar (A)
C:\Users\Austin and Logan\AppData\Local\Temp\nspA9A8.tmp\nsDialogs.dll Application.Toolbar (A)
C:\Users\Austin and Logan\AppData\Local\Temp\nspC8FA.tmp\nsDialogs.dll Application.Toolbar (A)
C:\$Recycle.Bin\S-1-5-21-2493444446-161572686-3881217994-1000\$RWV2WRI\minecraft-setup-173177019.exe Application.Bundler.DownloadAdmin.AK (B)
C:\Users\Austin and Logan\AppData\Local\Temp\nspFAE.tmp\nsDialogs.dll Application.Toolbar (A)
 
Quarantined 5

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI