kerrx4
Topic Starter
Hi, a bit of background info.
Not sure if its this forum I need , but had to start somewhere.
A couple of weeks ago I had power failure three times while the computer was on.
After the third i couldn't reboot as every time I tried to reboot i got a fatal error message about an overload with hardware. I disconnected everything and eventually got it to power up, but I always get a screen with this on it :-
1.0.12
Mail Processor : AMD Athlon™ 64 x 2 Duel Core Processor 4400+
Memory Testing : 3079168K OK + 64M shared memory (installed memory :3145728K)
SATA 0 : Samsung HD161HJ JF100-22
SATA 1 : NONE
SATA 2 : TSSTcorp DVD+/-RW TS-H653F D200
SATA 3 : ST3160815AS 4,ADA
Diskette drive 0 seek failure
Strike F1 to retry boot, F2 for setup utility
06/02/2008 - 1.0.12
press F1 and the computer boots up.
so I thought I'd try ans start here. If you think this is not the right forum, could you help me where to go next please.Also dont have any sound now, tried new speakers, nothing.
Ian.
Log file.
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2018-05-07 11:37:57
—————————–
11:37:57.456 OS Version: Windows 6.0.6002 Service Pack 2
11:37:57.456 Number of processors: 2 586 0x6B02
11:37:57.456 ComputerName: IAN-PC UserName: Ian
11:37:57.940 Initialize success
11:37:57.940 VM: initialized successfully
11:37:57.940 VM: Amd CPU virtualization not supported
11:48:28.668 AVAST engine defs: 17030301
11:53:16.290 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000050
11:53:16.290 Disk 0 Vendor: SAMSUNG_ JF10 Size: 152587MB BusType: 6
11:53:16.306 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000053
11:53:16.322 Disk 1 Vendor: ST316081 4.AD Size: 152587MB BusType: 6
11:53:16.462 Disk 0 MBR read successfully
11:53:16.478 Disk 0 MBR scan
11:53:16.556 Disk 0 Windows VISTA default MBR code
11:53:16.571 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 54 MB offset 63
11:53:16.618 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 112640
11:53:16.634 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 142291 MB offset 21084160
11:53:16.665 Disk 0 scanning sectors +312496128
11:53:16.743 Disk 0 scanning C:\Windows\system32\drivers
11:53:28.226 Service scanning
11:53:52.846 Modules scanning
11:53:52.846 Disk 0 trace - called modules:
11:53:52.877 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
11:53:52.877 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86667ac8]
11:53:52.877 3 CLASSPNP.SYS[8a3a08b3] -> nt!IofCallDriver -> [0x856b2a10]
11:53:52.893 5 acpi.sys[8060c6bc] -> nt!IofCallDriver -> \Device\00000050[0x85748af0]
11:53:53.392 AVAST engine scan C:\Windows
11:53:55.982 AVAST engine scan C:\Windows\system32
11:57:59.270 AVAST engine scan C:\Windows\system32\drivers
11:58:23.562 AVAST engine scan C:\Users\Ian
12:10:23.661 AVAST engine scan C:\ProgramData
12:14:21.913 Disk 0 statistics 2762233/0/0 @ 1.29 MB/s
12:14:21.913 Scan finished successfully
12:15:11.304 Disk 0 MBR has been saved successfully to "C:\Users\Ian\Desktop\MBR.dat"
12:15:11.304 The log file has been saved successfully to "C:\Users\Ian\Desktop\aswMBR.txt"
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06.05.2018 01
Ran by [removed] (administrator) on IAN-PC (07-05-2018 12:49:54)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Andrea Electronics Corporation) C:\Windows\System32\AERTSrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Safer Social Ltd) C:\Program Files\SaferVPN\SaferVPN.Service.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\…\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM\…\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4907008 2008-01-17] (Realtek Semiconductor)
HKLM\…\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1002984 2016-11-14] (Microsoft Corporation)
HKLM\…\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [295512 2013-10-10] (RealNetworks, Inc.)
HKLM\…\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\…\Run: [] => [X]
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157456 2015-09-12] (Apple Inc.)
HKLM\…\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2017-12-19] (Oracle Corporation)
HKU\S-1-5-21-246588887-1226629044-3392876210-1000\…\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-246588887-1226629044-3392876210-1000\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [12762872 2018-03-06] (Piriform Ltd)
HKU\S-1-5-21-246588887-1226629044-3392876210-1000\…\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [1421736 2017-03-28] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-21-246588887-1226629044-3392876210-1000\…\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-246588887-1226629044-3392876210-1000\…\MountPoints2: {68fb0051-60bd-11e6-9a5f-001aa087c37c} - K:\startme.exe
HKU\S-1-5-18\…\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [1421736 2017-03-28] (Garmin Ltd. or its subsidiaries)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2012-02-27]
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{14AF9657-7E65-4FEF-9245-ADCCAF95DB5F}: [DhcpNameServer] 192.168.0.1
Internet Explorer:
==================
HKU\S-1-5-21-246588887-1226629044-3392876210-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-gb/?ocid=iehp
SearchScopes: HKLM -> DefaultScope value is missing
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_161\bin\ssv.dll [2018-01-21] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-21] (Oracle Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File
FireFox:
========
FF HKLM\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-02-26] [Legacy] [not signed]
FF HKLM\…\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: (RealDownloader) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-10-10] [Legacy] [not signed]
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll [2013-10-09] (GARMIN Corp.)
FF Plugin: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-21] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.3.51 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll [2013-10-10] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.3.51 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll [2013-10-10] (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
Chrome:
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default [2018-05-07]
CHR Extension: (Slides) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-03-24]
CHR Extension: (Docs) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (Google Drive) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-09]
CHR Extension: (SaferVPN - FREE VPN | Privacy & Unblock Sites) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cocfojppfigjeefejbpfmedgjbpchcng [2018-04-20]
CHR Extension: (Google Search) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (Sheets) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-03-24]
CHR Extension: (Google Docs Offline) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-19]
CHR Extension: (RealDownloader) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-08-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-04]
CHR Extension: (Gmail) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR HKLM\…\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 AdobeFlashPlayerUpdateSvc; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [272384 2018-04-10] (Adobe Systems Incorporated) [File not signed]
R2 AERTFilters; C:\Windows\system32\AERTSrv.exe [77824 2007-12-05] (Andrea Electronics Corporation)
S3 Garmin Device Interaction Service; C:\Program Files\Garmin\Device Interaction Service\GarminService.exe [1099280 2017-03-28] (Garmin Ltd. or its subsidiaries)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4707104 2018-03-27] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.500\McCHSvc.exe [272136 2017-01-19] (McAfee, Inc.)
S3 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [103696 2016-11-14] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280864 2016-11-14] (Microsoft Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed]
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
R2 SaferVPN.Service; "C:\Program Files\SaferVPN\SaferVPN.Service.exe" -displayname "SaferVPN.Service" -servicename "SaferVPN.Service" -l "C:\Users\Ian\AppData\Local\SaferVPN\Log"
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amacpi; C:\Windows\System32\DRIVERS\null.sys [4608 2008-01-19] (Microsoft Corporation)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [220896 2018-05-07] (Malwarebytes)
S3 MpFilter; C:\Windows\system32\DRIVERS\MpFilter.sys [252808 2016-08-25] (Microsoft Corporation)
S3 Ph3xIB32; C:\Windows\System32\DRIVERS\Ph3xIB32.sys [1131136 2007-04-03] (Philips Semiconductors GmbH)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [124016 2010-03-15] (MCCI Corporation)
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [23040 2016-04-21] (The OpenVPN Project)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
U3 aswMBR; \??\C:\Users\Ian\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\Ian\AppData\Local\Temp\aswVmm.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-05-07 12:49 - 2018-05-07 12:50 - 000015038 _____ C:\Users\Ian\Desktop\FRST.txt
2018-05-07 12:16 - 2018-05-07 12:16 - 001767936 _____ (Farbar) C:\Users\Ian\Desktop\FRST.exe
2018-05-07 12:15 - 2018-05-07 12:15 - 000002291 _____ C:\Users\Ian\Desktop\aswMBR.txt
2018-05-07 12:15 - 2018-05-07 12:15 - 000000512 _____ C:\Users\Ian\Desktop\MBR.dat
2018-05-06 18:47 - 2018-05-06 18:47 - 000025179 _____ C:\Windows\system32\servers.def.lkg
2018-05-06 18:47 - 2018-05-06 18:47 - 000025179 _____ C:\Windows\system32\servers.def
2018-05-06 18:47 - 2018-05-06 18:47 - 000002903 _____ C:\Windows\system32\servers.def.vpx
2018-05-06 18:47 - 2018-05-06 18:47 - 000001627 _____ C:\Windows\system32\uat.vpx
2018-05-06 18:47 - 2018-05-06 18:47 - 000000446 _____ C:\Windows\system32\prod-pgm.vpx
2018-05-06 12:26 - 2018-05-07 12:49 - 000000000 ____D C:\FRST
2018-05-06 12:05 - 2018-05-06 12:05 - 005198336 _____ (AVAST Software) C:\Users\Ian\Desktop\aswMBR.exe
2018-05-06 11:51 - 2018-05-06 11:51 - 000000844 _____ C:\Users\Ian\Desktop\Your membership confirmation for Five Star Flutter.eml - Shortcut.lnk
2018-05-05 11:11 - 2018-05-05 11:20 - 000000000 ____D C:\Users\Ian\Desktop\emails
2018-05-04 13:51 - 2018-05-07 11:27 - 000220896 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-04-30 14:00 - 2018-04-30 14:00 - 000181968 _____ C:\Users\Ian\Downloads\boarding-pass.pdf
2018-04-30 14:00 - 2018-04-30 14:00 - 000181968 _____ C:\Users\Ian\Desktop\boarding-pass (1).pdf
2018-04-23 12:03 - 2018-05-07 11:27 - 000065536 _____ C:\Windows\system32\Ikeext.etl
2018-04-12 13:38 - 2018-04-12 13:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-05-07 11:28 - 2014-08-10 13:23 - 000000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2018-05-07 11:27 - 2018-01-16 14:41 - 000000000 ____D C:\ProgramData\AVAST Software
2018-05-07 11:27 - 2006-11-02 14:01 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-05-07 11:27 - 2006-11-02 13:47 - 000003664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2018-05-07 11:27 - 2006-11-02 13:47 - 000003664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2018-05-06 18:53 - 2006-11-02 14:01 - 000032644 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-05-06 18:43 - 2006-11-02 12:18 - 000000000 ____D C:\Windows\tracing
2018-05-04 15:28 - 2006-11-02 12:18 - 000000000 ____D C:\Windows\inf
2018-05-04 15:28 - 2006-11-02 11:33 - 000759398 _____ C:\Windows\system32\PerfStringBackup.INI
2018-05-04 13:51 - 2006-11-02 12:18 - 000000000 ____D C:\Windows\system32\Msdtc
2018-05-04 13:32 - 2006-11-02 11:22 - 052953088 _____ C:\Windows\system32\config\software_previous
2018-05-04 13:32 - 2006-11-02 11:22 - 047972352 _____ C:\Windows\system32\config\components_previous
2018-05-04 13:32 - 2006-11-02 11:22 - 022806528 _____ C:\Windows\system32\config\system_previous
2018-05-04 13:32 - 2006-11-02 11:22 - 001572864 _____ C:\Windows\system32\config\default_previous
2018-05-04 13:32 - 2006-11-02 11:22 - 000262144 _____ C:\Windows\system32\config\security_previous
2018-05-04 13:32 - 2006-11-02 11:22 - 000262144 _____ C:\Windows\system32\config\sam_previous
2018-05-04 13:27 - 2012-02-26 15:28 - 000000000 ____D C:\Users\Ian
2018-05-04 13:27 - 2006-11-02 12:18 - 000000000 ____D C:\Windows\system32\spool
2018-05-04 13:27 - 2006-11-02 12:18 - 000000000 ____D C:\Windows\registration
2018-05-03 14:47 - 2017-11-03 21:30 - 000022016 _____ C:\Users\Ian\Desktop\holiday 2018.xls
2018-04-28 13:41 - 2012-02-27 18:38 - 000001542 _____ C:\Users\Ian\AppData\Roaming\wklnhst.dat
2018-04-27 18:36 - 2012-02-27 18:18 - 000167424 _____ C:\Users\Ian\Documents\Ian…..xls
2018-04-12 13:38 - 2018-03-02 20:19 - 000001857 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-04-10 18:28 - 2017-10-23 13:13 - 000804864 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2018-04-10 18:28 - 2017-10-23 13:13 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2018-04-10 18:28 - 2012-02-26 15:44 - 000000000 ____D C:\Windows\system32\Macromed
2018-04-09 17:19 - 2018-02-21 12:40 - 002421760 _____ C:\Users\Ian\Desktop\Auto risk.xls
==================== Files in the root of some directories =======
2014-06-09 16:49 - 2014-06-09 16:49 - 000453424 _____ (Microsoft Corporation) C:\Users\Ian\IE9-WindowsVista-x86-enu (1).exe
2014-06-09 16:48 - 2014-06-09 16:48 - 000453424 _____ (Microsoft Corporation) C:\Users\Ian\IE9-WindowsVista-x86-enu.exe
2012-06-10 13:34 - 2012-06-23 13:38 - 000000000 _____ () C:\Users\Ian\AppData\Roaming\Argentina Primera Division.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000011770 _____ () C:\Users\Ian\AppData\Roaming\Barclays Premiership.txt
2012-06-10 13:34 - 2012-06-23 13:38 - 000000000 _____ () C:\Users\Ian\AppData\Roaming\Brazilian Campeonato Brazileiro.txt
2012-04-10 17:57 - 2012-06-23 13:38 - 000005697 _____ () C:\Users\Ian\AppData\Roaming\Denmark - Superliga.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000019080 _____ () C:\Users\Ian\AppData\Roaming\English Championship.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000019184 _____ () C:\Users\Ian\AppData\Roaming\English Division 1.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000019052 _____ () C:\Users\Ian\AppData\Roaming\English Division 2.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000010857 _____ () C:\Users\Ian\AppData\Roaming\France Ligue 1.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000010065 _____ () C:\Users\Ian\AppData\Roaming\France Ligue 2.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000009984 _____ () C:\Users\Ian\AppData\Roaming\German Bundasliga 1.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000010112 _____ () C:\Users\Ian\AppData\Roaming\German Bundasliga 2.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000008544 _____ () C:\Users\Ian\AppData\Roaming\Greece - Superleague.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000010263 _____ () C:\Users\Ian\AppData\Roaming\Italian Seria A.txt
2012-04-10 17:57 - 2012-06-23 13:38 - 000012903 _____ () C:\Users\Ian\AppData\Roaming\Italian Seria B.txt
2012-06-10 13:34 - 2012-06-23 13:38 - 000000000 _____ () C:\Users\Ian\AppData\Roaming\Japanese J-League.txt
2012-06-10 13:34 - 2012-06-23 13:38 - 000000000 _____ () C:\Users\Ian\AppData\Roaming\Mexican Primera Division.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000009052 _____ () C:\Users\Ian\AppData\Roaming\Netherlands - Erediesie.txt
2012-04-10 17:57 - 2012-06-23 13:38 - 000008160 _____ () C:\Users\Ian\AppData\Roaming\Norwegian Adeccoligaen.txt
2012-04-14 12:43 - 2012-06-23 13:38 - 000008370 _____ () C:\Users\Ian\AppData\Roaming\Norwegian Tippeligaen.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000007236 _____ () C:\Users\Ian\AppData\Roaming\Portugal - Primera.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000011800 _____ () C:\Users\Ian\AppData\Roaming\Russia Premier League.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000005814 _____ () C:\Users\Ian\AppData\Roaming\Scottish Division 1.txt
2012-04-14 12:43 - 2012-04-24 19:52 - 000006154 _____ () C:\Users\Ian\AppData\Roaming\Scottish Division 2.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000007446 _____ () C:\Users\Ian\AppData\Roaming\Scottish Premier League.txt
2012-04-10 17:57 - 2012-04-24 19:52 - 000011730 _____ () C:\Users\Ian\AppData\Roaming\Spanish Primera Division.txt
2012-04-10 17:57 - 2012-06-23 13:38 - 000013019 _____ () C:\Users\Ian\AppData\Roaming\Spanish Segunda Division.txt
2012-04-10 17:57 - 2012-06-23 13:38 - 000008220 _____ () C:\Users\Ian\AppData\Roaming\Sweden Allsvenska.txt
2012-06-10 13:34 - 2012-06-10 13:34 - 000000000 _____ () C:\Users\Ian\AppData\Roaming\USA MLS.txt
2012-02-27 18:38 - 2018-04-28 13:41 - 000001542 _____ () C:\Users\Ian\AppData\Roaming\wklnhst.dat
2013-08-17 15:00 - 2013-08-17 15:01 - 000000680 _____ () C:\Users\Ian\AppData\Local\d3d9caps.dat
2012-02-27 18:10 - 2015-02-12 12:51 - 000032768 _____ () C:\Users\Ian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-08-12 19:58 - 2016-08-12 19:59 - 045700992 _____ (Sony) C:\Users\Ian\AppData\Local\pcc.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-05-07 11:34
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 06.05.2018 01
Ran by [removed] (07-05-2018 12:50:38)
Running from C:\Users\[removed]\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) (2012-02-26 14:17:30)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-246588887-1226629044-3392876210-500 - Administrator - Disabled)
Guest (S-1-5-21-246588887-1226629044-3392876210-501 - Limited - Disabled)
Ian (S-1-5-21-246588887-1226629044-3392876210-1000 - Administrator - Enabled) => C:\Users\Ian
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Disabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Disabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM\…\Adobe AIR) (Version: 29.0.0.112 - Adobe Systems Incorporated)
Adobe Flash Player 29 ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 29.0.0.140 - Adobe Systems Incorporated)
Adobe Flash Player 29 PPAPI (HKLM\…\Adobe Flash Player PPAPI) (Version: 29.0.0.140 - Adobe Systems Incorporated)
Adobe Reader X (10.1.16) (HKLM\…\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.16 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-246588887-1226629044-3392876210-1000\…\Amazon Kindle) (Version: - Amazon)
ANT Drivers Installer x86 (HKLM\…\{E64F69D8-38FE-48B8-95AB-CC676FA636F1}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Apple Application Support (32-bit) (HKLM\…\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{BD40DFE8-9908-43A8-93C0-67608DD3D400}) (Version: 11.0.5.14 - Apple Inc.)
Apple Software Update (HKLM\…\{19589375-5C58-4AFA-842F-8B34744CCEAD}) (Version: 2.5.0.1 - Apple Inc.)
Bonjour (HKLM\…\{D168AAD0-6686-47C1-B599-CDD4888B9D1A}) (Version: 3.1.0.1 - Apple Inc.)
CCleaner (HKLM\…\CCleaner) (Version: 5.41 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (HKLM\…\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Elevated Installer (HKLM\…\{1052502B-4C91-43F9-B160-AE39ED57C9F0}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Communicator Plugin (HKLM\…\{032A13FF-D26D-4844-9597-7EF698627985}) (Version: 4.1.0 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM\…\{BCC7CA85-E57F-452D-BB44-15A1CE018BD0}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express (HKLM\…\{bd8bd200-9a60-4969-b267-6b565f36e3da}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin Express Tray (HKLM\…\{DA9C865D-6762-4931-8588-0B13B7A0796B}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin USB Drivers (HKLM\…\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM\…\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM\…\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
Google Update Helper (HKLM\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Google Update Helper (HKLM\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
HP Deskjet 1050 J410 series Basic Device Software (HKLM\…\{226837D8-0BF8-4CBE-BAB2-8F07E2C2B4DD}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Deskjet 1050 J410 series Help (HKLM\…\{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}) (Version: 140.0.66.66 - Hewlett Packard)
HP Deskjet 1050 J410 series Product Improvement Study (HKLM\…\{7414C891-720D-4E86-85E5-C3AA898DA9EC}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Photo Creations (HKLM\…\HP Photo Creations) (Version: 1.0.0.3781 - HP Photo Creations Powered by RocketLife)
HP Update (HKLM\…\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
iCloud (HKLM\…\{79BD66B2-4DAE-4C3B-B08E-DC72E507C163}) (Version: 2.1.3.25 - Apple Inc.)
iTunes (HKLM\…\{868B9974-4F23-494D-B6BC-4FAB92B2755D}) (Version: 12.1.3.6 - Apple Inc.)
Java 8 Update 161 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F32180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
Java 8 Update 31 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (HKLM\…\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes version 3.4.5.2467 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.4.5.2467 - Malwarebytes)
McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.11.500.3 - McAfee, Inc.)
Microsoft .NET Framework 3.5 SP1 (HKLM\…\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2000 Disc 2 (HKLM\…\{00040409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Office 2000 Premium (HKLM\…\{00000409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft PhotoDraw 2000 (HKLM\…\Microsoft PhotoDraw 2000) (Version: - )
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50906.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM\…\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
QuickTime 7 (HKLM\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
RealDownloader (HKLM\…\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}) (Version: 1.3.3 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (HKLM\…\{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}) (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (HKLM\…\{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}) (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\…\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - )
RealUpgrade 1.1 (HKLM\…\{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}) (Version: 1.1.0 - RealNetworks, Inc.) Hidden
SaferVPN 4.2.1 (HKLM\…\SaferVPN) (Version: 4.2.1 - )
Segoe UI (HKLM\…\{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}) (Version: 15.4.2271.0615 - Microsoft Corp) Hidden
Sony PC Companion 2.10.065 (HKLM\…\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.065 - Sony)
Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\…\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\…\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\…\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
Windows Live Essentials (HKLM\…\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Upload Tool (HKLM\…\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams.dll [2013-10-31] (Apple Inc.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {07154A62-9851-44A9-8F85-78E11F255647} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {189AF94A-631A-4163-90E1-4A10A3DFB53F} - System32\Tasks\GoogleUpdateTaskMachineCore1d0e8f93c2703fb => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {250FDCDD-16C4-4913-84E6-A6CA386B899D} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_29_0_0_140_pepper.exe [2018-04-10] (Adobe Systems Incorporated)
Task: {2A6609EA-AB08-4BB0-A48E-381D1EF4223C} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => Command(1): C:\Windows\servicing\vsp1ceip.exe [2008-01-19] (Microsoft Corporation)
Task: {3E0332FC-B783-4E0B-A255-DE16746AB2D0} - System32\Tasks\GarminUpdaterTask => C:\Program Files\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [2017-03-28] ()
Task: {484E4A53-6443-4C50-81F3-35D1729897EA} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-03-06] (Piriform Ltd)
Task: {525C3C29-4071-476A-BE7B-7866D847FCD9} - System32\Tasks\HPCustParticipation HP Deskjet 1050 J410 series => C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {620DB084-8DCF-4614-94D3-74C681754883} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2018-04-10] (Adobe Systems Incorporated)
Task: {6A6AF43F-CFC3-4E89-B720-816AC866F698} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2017-10-12] (Apple Inc.)
Task: {6D7A5890-6218-45A2-B742-BE1C30B37A02} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)
Task: {6DF96862-B9FE-41EC-8313-2F0AE977032A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-246588887-1226629044-3392876210-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {98EA7818-B079-4E99-98E5-42F763625FAE} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {AA04F34C-339D-4A44-BE6E-EFC47A97F5FA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {AB55747F-B955-4DD7-8BFF-6AD57ABF9A94} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-246588887-1226629044-3392876210-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {CCEE7253-1930-4E06-B8F9-E445D7B9EC61} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-03-06] (Piriform Ltd)
Task: {E687AB6E-2AAB-4B2B-88DB-19A5EF594D8E} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-246588887-1226629044-3392876210-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {E91D7ED8-CE32-4A8F-AD15-CD623FB01E00} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-246588887-1226629044-3392876210-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-01-20 23:35 - 2015-01-20 23:35 - 001044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 000073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2013-08-14 15:19 - 2013-08-14 15:19 - 000039056 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2018-03-02 20:19 - 2018-03-12 15:09 - 001936672 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2016-10-09 04:28 - 2016-09-06 12:00 - 005197312 _____ () C:\Users\Ian\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libglesv2.dll
2016-10-09 04:28 - 2016-09-06 12:00 - 000147456 _____ () C:\Users\Ian\AppData\Local\Google\Chrome\User Data\SwiftShader\3.3.0.1\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2006-09-18 22:41 - 000000761 _____ C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-246588887-1226629044-3392876210-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\Wallpaper\img23.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [{89E6BC28-E016-43C3-9430-DFA039042D1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FA0EDCD7-5188-4F48-839F-1B2F783D788A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A180C235-4141-4D15-81D6-A10D7963A33C}] => (Allow) LPort=445
FirewallRules: [{810B0828-5206-4EC7-B2B0-BFB941B93619}] => (Allow) LPort=80
FirewallRules: [{DB1E7D00-34F1-42C7-B5A7-EB366F87741F}] => (Allow) LPort=80
FirewallRules: [{DC747F54-B810-4848-B118-CBE70EAE29B7}] => (Allow) LPort=80
FirewallRules: [{DF1CDA34-F318-4AFE-BD52-A018CE234414}] => (Allow) svchost.exe
FirewallRules: [{F79C673C-7A3C-49D9-92D2-BDD92D89247E}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{677382F5-E25B-42B3-B7EF-2C5A16265257}] => (Allow) LPort=2869
FirewallRules: [{10EFF04D-4EC0-4307-81FC-16CAA858AD6F}] => (Allow) LPort=1900
FirewallRules: [{40B8311B-5065-49F2-8533-2DBE673F49BC}] => (Allow) C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe
FirewallRules: [{8A99F608-D6F3-4AEA-A675-29266DA0C0EF}] => (Allow) C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe
FirewallRules: [{04072ABF-A58A-4B8A-ACA7-475791347C0A}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{52E64A54-60A6-44D7-84E0-538C21EBE01C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{6624007F-2C27-430F-8436-3071C3E27832}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{3990CF3A-142A-43D2-A2EB-43EC50839195}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4E22AA75-E111-4F7C-8F0D-9B806FCC1EC0}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
==================== Restore Points =========================
25-04-2018 00:00:04 Scheduled Checkpoint
26-04-2018 00:00:04 Scheduled Checkpoint
27-04-2018 00:00:03 Scheduled Checkpoint
28-04-2018 14:27:42 Scheduled Checkpoint
02-05-2018 04:43:28 Scheduled Checkpoint
03-05-2018 00:10:54 Scheduled Checkpoint
04-05-2018 00:00:03 Scheduled Checkpoint
04-05-2018 13:23:39 Restore Operation
05-05-2018 12:06:13 Scheduled Checkpoint
==================== Faulty Device Manager Devices =============
Name: ADS Instant HDTV PCI
Description: ADS Instant HDTV PCI
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: ADS Technologies
Service: Ph3xIB32
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Communications Port (COM7)
Description: Communications Port
Class Guid: {4d36e978-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard port types)
Service: Serial
Problem: : Windows cannot determine the settings for this device. Consult the documentation that came with this device and use the Resource tab to set the configuration. (Code 34)
Resolution: The device requires manual configuration. See the hardware documentation or contact the hardware vendor for instructions on manually configuring the device. After you configure the device itself, you can use the "Resources" tab in Device Manager to configure the resource settings in Windows.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/07/2018 12:47:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iTunes.exe, version 12.1.3.6, time stamp 0x55f3f4a9, faulting module ole32.dll, version 6.0.6002.19755, time stamp 0x58c96479, exception code 0xc0000005, fault offset 0x00047396,
process id 0x1110, application start time 0x01d3e5f691ff273a.
Error: (05/06/2018 03:47:53 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: esu.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.TypeInitializationException
Stack:
at Garmin.Omt.Service.Shared.Overrides.get_OmtBaseUrl()
at Garmin.Omt.Express.SelfUpdater.Program.RealMain()
at Garmin.Omt.Express.SelfUpdater.Program.Main(System.String[])
Error: (05/05/2018 12:08:22 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: esu.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.TypeInitializationException
Stack:
at Garmin.Omt.Service.Shared.Overrides.get_OmtBaseUrl()
at Garmin.Omt.Express.SelfUpdater.Program.RealMain()
at Garmin.Omt.Express.SelfUpdater.Program.Main(System.String[])
Error: (05/04/2018 03:32:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iTunes.exe, version 12.1.3.6, time stamp 0x55f3f4a9, faulting module ole32.dll, version 6.0.6002.19755, time stamp 0x58c96479, exception code 0xc0000005, fault offset 0x00046e89,
process id 0x5a4, application start time 0x01d3e3aecc0d1f38.
Error: (05/04/2018 02:49:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iTunes.exe, version 12.1.3.6, time stamp 0x55f3f4a9, faulting module ole32.dll, version 6.0.6002.19755, time stamp 0x58c96479, exception code 0xc0000005, fault offset 0x00047396,
process id 0xc78, application start time 0x01d3e3adf4df759c.
Error: (05/04/2018 02:19:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iTunes.exe, version 12.1.3.6, time stamp 0x55f3f4a9, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0xd6801131,
process id 0xd20, application start time 0x01d3e3aa558a1249.
Error: (05/04/2018 02:14:52 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: esu.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.TypeInitializationException
Stack:
at Garmin.Omt.Service.Shared.Overrides.get_OmtBaseUrl()
at Garmin.Omt.Express.SelfUpdater.Program.RealMain()
at Garmin.Omt.Express.SelfUpdater.Program.Main(System.String[])
Error: (05/04/2018 01:04:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application mbamservice.exe, version 3.1.0.643, time stamp 0x5ab290dc, faulting module ScanControllerImpl.dll, version 3.0.0.818, time stamp 0x5aac0db1, exception code 0xc0000005, fault offset 0x001939e4,
process id 0x6c8, application start time 0x01d3e39f1b7d88e7.
System errors:
=============
Error: (05/07/2018 11:28:44 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
Null
Error: (05/07/2018 11:28:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
Error: (05/07/2018 11:27:15 AM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 412) (User: NT AUTHORITY)
Description: Event-ID 412
Error: (05/06/2018 06:53:21 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the gpsvc service.
Error: (05/06/2018 06:52:51 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wuauserv service.
Error: (05/06/2018 06:52:21 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSearch service.
Error: (05/06/2018 06:51:51 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Apple Mobile Device service.
Error: (05/06/2018 06:47:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Defender service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
CodeIntegrity:
===================================
Date: 2017-08-28 11:38:50.934
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2017-08-28 11:38:49.795
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2017-08-28 11:38:48.672
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2017-08-28 11:38:47.533
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2017-08-28 11:38:46.410
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2017-08-28 11:38:45.287
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2017-08-28 11:38:44.148
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2017-08-28 11:38:43.025
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: AMD Athlon™ 64 X2 Dual Core Processor 4400+
Percentage of memory in use: 49%
Total physical RAM: 3005.76 MB
Available physical RAM: 1517.69 MB
Total Virtual: 6242.08 MB
Available Virtual: 4801.47 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:138.96 GB) (Free:20.1 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:149.01 GB) (Free:104.05 GB) NTFS
Drive e: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 48000000)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=139 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 162EE8E1)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
