Computer Restarted from a Bug Check! BSOD crashes [Solved]

I did find items that need to be removed but, I don't know if it will have any influence on some of this your explaining.

*********************

Start Farbar Recovery Scan Tool (Please double-click on FRST/FRST64) with Administrator privileges
or Right click on the FRST icon and select Run as administrator
Highlight the below information then hit the Ctrl + C keys at the same time
or
Right click/highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-4212484089-3487115953-933115951-1004 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extension\nahhmpbckpgdidfnmfkfgiflpjijilce
CHR HKLM\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-4212484089-3487115953-933115951-1004\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
S3 ALSysIO; \??\C:\Users\JEFFM~1\AppData\Local\Temp\ALSysIO64.sys [X] <==== ATTENTION
2017-08-21 15:18 - 2012-09-27 03:15 - 000865424 _____ (CANON INC.) C:\Users\Jeff M\AppData\Local\Temp\MSETUP4.EXE
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


~~~~~~~~~~~~~~~

Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Here

• After the installation IS complete let it update if it asks.
• Go to the Setting Tab
• Under Setting go to Detection and Protection
• Under PUP and PUM make sure both are set to show Treat Detections as Malware
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
• Then on the Dashboard click on Scan
• Make sure to select THREAT SCAN
• Then click on Scan
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
  If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  Upon completion of the scan (or after the reboot), click the Reports tab.
  Double-click the Scan Log.
  At the bottom click Export and choose Text file.
  
  Save the file to your desktop and include its content in your next reply.
  
  You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here
  
  ~~~~~~~~~~~~~~~
  
  [external image: h3qKPnn.png]Malwarebytes AdwCleaner
• Please download Malwarebytes AdwCleaner and save the file to your Desktop
• Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts.
• Click [external image: A49sxPr.png]Scan.
• Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
• Click [external image: MqHawIb.png]Clean.
• Follow the prompts and allow your computer to reboot.
• After the reboot, a log (AdwCleaner[C0].txt) will open. Copy the contents of the log and paste in your next reply.
  – File, folder and registry backups are made for items removed using this programme. Should a legitimate file, folder or registry item be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[S0].txt.

please post
Fixlog.txt
MBAM log
AdwCleanertxt

Ok so with the first step you indicate to just copy the text, but aren't i supposed to create a text file and title it with an extension and then paste the contents into notepad.  

Ok so with the first step you indicate to just copy the text, but aren't i supposed to create a text file and title it with an extension and then paste the contents into notepad.

You can still do that but, the creator/developer of the tool made fixes to allow victims to use this method too.
At times it's easier this way due to code.

if you want to do it the other way:

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text below.



Start:
CloseProcesses:
CreateRestorePoint:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-4212484089-3487115953-933115951-1004 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extension\nahhmpbckpgdidfnmfkfgiflpjijilce
CHR HKLM\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-4212484089-3487115953-933115951-1004\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
S3 ALSysIO; \??\C:\Users\JEFFM~1\AppData\Local\Temp\ALSysIO64.sys [X] <==== ATTENTION
2017-08-21 15:18 - 2012-09-27 03:15 - 000865424 _____ (CANON INC.) C:\Users\Jeff M\AppData\Local\Temp\MSETUP4.EXE
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Emptytemp:
End:

Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

[external image: 15wKX7o.jpg]

In addition, it seems its not saving any of my settings and it says my google chrome settings are corrupted. You know i had an issue some what similar like this before years ago and it turned out it was pretty nasty virus of some sort. I am not sure if that is the case currently, but i do know some viruses do intentionally lock you into safe mode. Well this is a real nuisance. Whats even worse is the fact is i don't no longer have a windows 10 OS disk cause the one i did have turned out to be a counterfeit from a company illegally distributing the same serial numbers.

 

So i have to get my self another windows 10 disk. But if all else fails ill have to use a free download so i can initiate the proper tools if need be. Anyways any suggestions on how to get me out of safe mode so i can run my virus scan programs?

Well i manage to get the scan, here ya go: Also ADW cleaner found nothing so i don't think its necessary to post the log for that one.

 

 

Not really pointing to malware.

For safe mode try following the below
https://www.pcworld.com/article/3085034/windows/how-to-get-out-of-windows-safe-mode.html

Looking back over logs to see if something stood out among the listed errors
Cloud Files Mini Filter Driver. I have no idea if this would have any influence here
https://www.tenforums.com/general-support/90593-why-no-cldflt-service.html

~~

Please Download Tweaking.com - Windows Repair from Here
OR
Windows Repair (all in one) from here.

• Install and then run the program
• Execute the instructions on Step 1 Important
• Click Next on Step 2 Optional, do the Pre Scan skip Step 3 and 4 Optional for now.
• On Step 5 Backup System Restore Do a Registry backup. When you have completed this click Next
• Click Repairs - Open Repairs in the bottom right corner
• Uncheck the All repair button then select just the item(s) listed below
  
  01 - Repair Registry Permissions
  03 - Reset Service permissions
  04 - Register System Files
  05 - Repair WMI
  06 - Repair Windows Firewall
  07 - Repair Internet Explorer
  10 - Remove Policies Set By Infections
  17 - Repair Windows Updates
  19 - Repair Volume Shadow Copy Service
  21 - Repair MSI (Windows Installer)
  26 - Restore Important Windows Services
  27 - Set Windows Service to Default Startup
• Click the Start button and let the process run to completion. Copy any error messages into Notepad, Save it on your Desktop. ( Reboot if asked to do so)
• Please copy and paste the Contents of this file on your next reply.

Restart the computer normally.

I am currently running the repairs for this but just to give you a heads up. Some of the instructions that you list for these steps, tweaking software, malewarebytes and the farbar recovery scan tool are not up to date. Especially the tweaking program which had numbers that did not coincide with the exact numbers listed. I did how ever follow the wordings and text of each instruction to make sure i utilized the right function. But this is something you will have to go back and look at, not only for my benefit but for others as well. It can be a little confusing if someone is trying to follow exact instructions to a tea.

 

In any case, i hope i did everything correctly here.

 

Here is the log:

 

 

How do you access the deeper log files? After the repairs were finished it did not give me any time and instead prompted me to restart. 

Thanks for the heads up on the tool.
Developers tweak their tools and no notifications go out on that.

I'm thinking logs are only created if error messages were found. I'll have to ask around about that tho.

By default Windows Repair All-In-One will create a "Logs" folder in its folder on the Desktop.



Go to Step 3, then click Check in the See If Check Disk Is Needed.

- If Windows Repair stated that errors are found, click Open Check Disk At Next Boot. Choose (/R) Fixes errors on the disk also locate bad sectors and recovers readable information, then click Add To Next Boot. Reboot the computer to let Windows check the disk.
[external image: Ymy7crZ.png]

- Go to Step 4, then click Do It.
[external image: zDtdN75.png]

- Go to Step 5. Under System Restore click Create.
[external image: f7lEe1N.png]

There were no errors in the hard disk drive. The system checker also didn't find any integrity violations. How ever here is a log that did find some errors in the system during the Pre-scan. Also i am able to reboot back into "normal start-up" mode again. How ever fire walls all are turned off so i turned them back on. What sort of errors was i experiencing and how did this happen in the first place?

 

 

 

What sort of errors was i experiencing and how did this happen in the first place?

 

Thats the million dollar question, and I'll have to guess.

First thought is a bad update from Microsoft then again which one?, very hard to say since it seems something is reported monthly as in going wrong with their rollup updates now.

 

for an example, scroll down to post #3

https://forums.whatthetech.com/index.php?showtopic=131265

 

Also, somehow system settings changed,  and from what, why, how?

it's a mystery.

 

People have encountered these types of mishaps who allowed Microsoft to update the computers operating system to Windows 10.

 

We can run an online scan if you wish,

Yeah go for it, just make sure there is no other errors. So far its looking pretty good. The machine has been on for 24 hrs at least with out rebooting.

yeah, good news

Emsisoft Emergency Kit

Please download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click the Extract button at the bottom. A folder named EEK will be created in the root of the drive (usually c:\).

• After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
• The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates. Please click Yes so that it downloads the latest database updates.
• When update is complete, click Malware Scan. When asked if you want the scanner to scan for Potentially Unwanted Programs, click Yes. Emsisoft Emergency Kit will start scanning.
• When the scan is completed click Quarantine selected objects. Note, this option is only available if malicious objects were detected during the scan.
• When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
• Please save the log in Notepad on your desktop and post the contents in your next reply.
• When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.