Computer Hope
Software => Computer viruses and spyware => Virus and spyware removal => Topic started by: nightowl19632000 on January 02, 2015, 10:12:52 PM
-
I have had the blue screen of death appear several times over the last two weeks. After I restart, it seems to be slow but ok. I am afraid there is something going on that I need to correct. Also, it seems to take forever to restart my computer. Here are the logs you requested. Thanks!
# AdwCleaner v4.106 - Report created 02/01/2015 at 21:28:20
# Updated 21/12/2014 by Xplode
# Database : 2015-01-01.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Pam - PAM-HP
# Running from : C:\Users\Pam\Downloads\adwcleaner_4.106.exe
# Option : Clean
***** [ Services ] *****
- Service Deleted : BackupStack
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Free Ride Games
Folder Deleted : C:\ProgramData\ParetoLogic
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Uniblue
Folder Deleted : C:\ProgramData\Yahoo! Companion
Folder Deleted : C:\Program Files (x86)\BearShare Applications
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Free Ride Games
Folder Deleted : C:\Program Files (x86)\MyPC Backup
Folder Deleted : C:\Program Files\FreeFixer
Folder Deleted : C:\Users\Lance\AppData\Roaming\Elex-tech
Folder Deleted : C:\Users\Pam\AppData\Local\eSupport.com
Folder Deleted : C:\Users\Pam\AppData\Local\FreeFixer
Folder Deleted : C:\Users\Pam\AppData\Local\NativeMessaging
Folder Deleted : C:\Users\Pam\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Pam\AppData\Roaming\DriverCure
Folder Deleted : C:\Users\Pam\AppData\Roaming\DSite
Folder Deleted : C:\Users\Pam\AppData\Roaming\FreeFixer
Folder Deleted : C:\Users\Pam\AppData\Roaming\ParetoLogic
Folder Deleted : C:\Users\Pam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Folder Deleted : C:\Users\Lance\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
Folder Deleted : C:\Users\Pam\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
Folder Deleted : C:\Users\Lance\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce
File Deleted : C:\windows\Reimage.ini
File Deleted : C:\windows\System32\log\iSafeKrnlCall.log
File Deleted : C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\g60vnzzw.default\user.js
File Deleted : C:\Users\Pam\AppData\Roaming\Mozilla\Firefox\Profiles\5200bplx.default-1391973213089\user.js
***** [ Scheduled Tasks ] *****
Task Deleted : Driver Booster Scan
Task Deleted : Driver Booster Update
Task Deleted : DSite
Task Deleted : LaunchSignup
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
Key Deleted : HKCU\Software\Google\Chrome\Extensions\apjkpjchfbckhjhokinlgdbmibpbbjak
Key Deleted : HKCU\Software\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce
Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce
Key Deleted : HKLM\SOFTWARE\Classes\GameTreatWidget.GameTreatWidget
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Key Deleted : HKCU\Software\5e53dad9e638bf47
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{44D07CAA-4FC4-5A84-9951-A485AD808D0E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{44D07CAA-4FC4-5A84-9951-A485AD808D0E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C3B01BC-53A5-48A0-A43B-0C67731134B9}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ParetoLogic
Key Deleted : HKCU\Software\Reimage
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\SOFTWARE\ParetoLogic
Key Deleted : HKLM\SOFTWARE\Uniblue
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
Key Deleted : [x64] HKLM\SOFTWARE\Reimage
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Data Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17496
-\\ Mozilla Firefox v35.0 (x86 en-US)
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.hmpgUrl", "hxxp://Vosteran.com/?f=1&a=vst_ggbg_14_49_ff_na01&cd=2XzuyEtN2Y1L1QzuyE0CyBtB0BzyyEtD0Fzy0CyD0ByE0CyCtN0D0Tzu0StCtDyCyCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzy[...]
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.newTabUrl", "hxxp://Vosteran.com/?f=2&a=vst_ggbg_14_49_ff_na01&cd=2XzuyEtN2Y1L1QzuyE0CyBtB0BzyyEtD0Fzy0CyD0ByE0CyCtN0D0Tzu0StCtDyCyCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtB[...]
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.prtnrId", "WSE_Vosteran");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.srchPrvdr", "Vosteran");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.tlbrSrchUrl", "hxxp://Vosteran.com/?f=3&a=vst_ggbg_14_49_ff_na01&cd=2XzuyEtN2Y1L1QzuyE0CyBtB0BzyyEtD0Fzy0CyD0ByE0CyCtN0D0Tzu0StCtDyCyCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyE[...]
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.AutoSearchEventData", "auto%20search");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.ClearCacheDate", 2);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.DNSCatch", false);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.DisplayEULA", false);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.DnsCatchEventData", "dns%20catch");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.FirstLaunchShown", true);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.LoadLayoutDate.62781", 2);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.NewTabSearchEventData", "tab%20search");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.ShowRecommendedOptions", true);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.StateReportDate", "1417461015519");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.TopRightSearchEventData", "top%20right%20search");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.beforeInstallSaved", true);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.beforeinstall.homepage", "www.facebook.com");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.beforeinstall.search", "Google");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.comp.affiliate.2810218.disabled", false);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.comp.search.2808538.width", "206");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.customNewTab", true);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.helpUsImprove", true);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.hideOthers", false);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.processAddrBar", true);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.restoreSearch", false);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.searchHistory", false);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.session", "71DB7922C48D85C0C93487B8AB784E9CD97EA5E B519610AE3EE8BF9BC21E28386DDA2C45629ABF 697807A8F6D2A758BC8104320523F9EBC390AAD 06D8CE4BBDD");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.showFirstLaunchOptions", false);
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.tb_lang", "en");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.tool_id", "62781");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.user_id", "85369248");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.user_key", "2d85a16978b9bba722cec3ff38d60ee528a48f3 c");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.user_layouts", "62781");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.user_lnames", "Gamers%20Unite%21%20Snag%20Bar");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.xml_service_url", "64e3a27980eeceb34248bc3e680b4e63");
[5200bplx.default-1391973213089\prefs.js] - Line Deleted : user_pref("freecauseafe43e800abc4df281a03fe44b74ab e8.yahooSearch", true);
-\\ Google Chrome v41.0.2251.0
[C:\Users\Lance\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
[C:\Users\Lance\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Lance\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Lance\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://en.softonic.com/s/{searchTerms}
[C:\Users\Pam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggbg_14_49_ff_na01&cd=2XzuyEtN2Y1L1QzuyE0CyBtB0BzyyEtD0Fzy0CyD0ByE0CyCtN0D0Tzu0StCtDyCyCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1BtN1L1G1B1V1N2Y1L1Qzu2SyCyDyBtAzyyEyEzytGtD0CtCtDtGzzzyyDyCtG0F0AtByCtGyBzy0EtCyDyE0FyB0FtC0E0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0A0EtAzyyB0FzztG0AtDtA0BtGyE0BtByBtG0A0FtAtDtGzzzzyC0FyByByByEyBtByE0E2Q&cr=1323670975&ir=
[C:\Users\Pam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggbg_14_49_ff_na01&cd=2XzuyEtN2Y1L1QzuyE0CyBtB0BzyyEtD0Fzy0CyD0ByE0CyCtN0D0Tzu0StCtDyCyCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1BtN1L1G1B1V1N2Y1L1Qzu2SyCyDyBtAzyyEyEzytGtD0CtCtDtGzzzyyDyCtG0F0AtByCtGyBzy0EtCyDyE0FyB0FtC0E0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0A0EtAzyyB0FzztG0AtDtA0BtGyE0BtByBtG0A0FtAtDtGzzzzyC0FyByByByEyBtByE0E2Q&cr=1323670975&ir=
[C:\Users\Pam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Pam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
*************************
AdwCleaner[R0].txt - [15376 octets] - [02/01/2015 21:20:54]
AdwCleaner[S0].txt - [15274 octets] - [02/01/2015 21:28:20]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15335 octets] ##########
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 1/2/2015
Scan Time: 9:56:58 PM
Logfile: Malwarebytes scanning history log.txt
Administrator: Yes
Version: 2.00.4.1028
Malware Database: v2015.01.03.01
Rootkit Database: v2014.12.30.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Pam
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 381463
Time Elapsed: 31 min, 37 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 1
PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Vosteran\\, Quarantined, [6c918270b3d621153f9d51959d67669a]
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 2
PUP.Optional.MyPCBackup.A, C:\Users\Pam\Downloads\JustCloud_Setup.exe, Quarantined, [e31a92601673f83e4f0025c0ae53758b],
PUP.Optional.Spigot.A, C:\Users\Pam\AppData\Roaming\Mozilla\Firefox\Profiles\5200bplx.default-1391973213089\searchplugins\yahoo_ff.xml, Quarantined, [40bd5d95484120163cab2f3253b0e31d],
Physical Sectors: 0
(No malicious items detected)
(end)
Results of screen317's Security Check version 0.99.93
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````[/u]
MVPS Hosts File
Java 7 Update 51
Java 8 Update 25
Java version 32-bit out of Date!
Adobe Flash Player 16.0.0.240
Mozilla Firefox (35.0)
Google Chrome (41.0.2243.0)
Google Chrome (41.0.2251.0)
Google Chrome (Plugins...)
````````Process Check: objlist.exe by Laurent````````[/u]
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
IObit IObit Malware Fighter IMFsrv.exe
Malwarebytes Anti-Malware mbamscheduler.exe
IObit IObit Malware Fighter IMF.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````[/u]
Thank you for your help! Pam
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please download Junkware Removal Tool (http://thisisudax.org/downloads/JRT.exe) to your desktop.
•Warning! Once the scan is complete JRT will shut down your browser with NO warning.
•Shut down your protection software now to avoid potential conflicts.
•Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this (http://www.bleepingcomputer.com/forums/topic114351.html) link to see a list of security programs that should be disabled and how to disable them.
•Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator
•The tool will open and start scanning your system.
•Please be patient as this can take a while to complete depending on your system's specifications.
•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
•Copy and Paste the JRT.txt log into your next message.
********************************************
We Need to Diagnose Your BlueScreen
1.When you boot your machine, press F8 to list the startup options, exactly as you would if you were trying to enter Safe Mode (http://www.bleepingcomputer.com/tutorials/tutorial61.html)
2.Select "Disable Automatic Restart on System Failure", as shown here:
(http://i424.photobucket.com/albums/pp322/digistar/disableautomaticrestart.png)
3.When your system BSODs, write down the STOP error code, as well as any written out error message back here. The STOP error will always appear, but the message may not. You are looking for this:
(http://i424.photobucket.com/albums/pp322/digistar/bluescreen.png)
*****************************************
Update Your Java (JRE)
Old versions of Java have vulnerabilities that malware can use to infect your system.
First Verify your Java Version (http://www.java.com/en/download/installed.jsp)
If there are any other version(s) installed then update now.
Get the new version (if needed)
If your version is out of date install the newest version of the Sun Java Runtime Environment (http://www.majorgeeks.com/Sun_Java_Runtime_Environment_d4648.html).
Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
Be sure to close ALL open web browsers before starting the installation.
Remove any old versions
1. Download JavaRa (http://raproducts.org/click/click.php?id=1) and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.
Additional Note: The Java Quick Starter (JQS.exe) (http://java.sun.com/javase/6/docs/technotes/guides/jweb/otherFeatures/jqs.html) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
-
This is my JRT.txt log.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by Pam on Sat 01/03/2015 at 14:44:45.26
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211181110}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F}
~~~ Files
Successfully deleted: [File] "C:\windows\wininit.ini"
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\strongvault online backup"
Successfully deleted: [Folder] "C:\ai_recyclebin"
Successfully deleted: [Folder] "C:\windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\Pam\appdata\local\{4E5E9C7C-BEDE-41EB-9CD9-49DB71A16214}
Successfully deleted: [Empty Folder] C:\Users\Pam\appdata\local\{90A4BB67-FA9D-4589-9147-8919511B9351}
Successfully deleted: [Empty Folder] C:\Users\Pam\appdata\local\{95BBC452-A77B-448A-9840-BF481A73CFBB}
~~~ FireFox
Successfully deleted: [Folder] C:\Users\Pam\AppData\Roaming\mozilla\firefox\profiles\5200bplx.default-1391973213089\fctb
Successfully deleted the following from C:\Users\Pam\AppData\Roaming\mozilla\firefox\profiles\5200bplx.default-1391973213089\prefs.js
user_pref("[email protected]", true);
user_pref("extensions.iobitascsurfingprotection@iobit.com.install-event-fired", true);
user_pref("extensions.xpiState", "{\"app-profile\":{\"[email protected]\":{\"d\":\"C:\\\\Users\\\\Pam\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles
Emptied folder: C:\Users\Pam\AppData\Roaming\mozilla\firefox\profiles\5200bplx.default-1391973213089\minidumps [205 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 01/03/2015 at 15:31:09.95
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
Also I forgot to ask, do I wait until I get the blue screen again to write down the error code and other info if it is available? I don't know how long it will be before it comes back up.
Thanks!
-
No, run the BSOD test that I've provided and paste the log.
-
I am not sure what else I need to do? I ran the Junk Removal Tool and posted the log and I have updated my Java. I restarted my computer and hit F8 and the options came up and I chose the one that you instructed me to do. Should the BSOD screen pop up after I did that? If so, nothing happened. I guess I don't understand the instructions. Sorry, I am kind of a newbie. Thank you for your patience!
-
Sorry, I gave you the incorrect program.
Download BlueScreenView to your desktop.
BlueScreenView (http://www.nirsoft.net/utils/blue_screen_view.html)
unzip downloaded file and double click on BlueScreenView.exe to run the program.
when scanning is done, go to EDIT - Select All
Go to FILE - SAVE Selected Items, and save the report as BSOD.txt
Open BSOD.txt in Notepad, copy all of the content, and paste it into your next reply.
-
I have downloaded the BSOD. There is nothing to save. Unless I am suppose to make it scan, it showes 0 crashes. Do I just wait until I get another blue screen before anything will show up in this program?
-
If you've been experiencing BSOD's there should be a log of them. If there are none, we'll have to wait for the next one.
-
I know it has been more than 30 days, but I have just had 2 Blue Screen of Death in the last two days. I will post what I have found here and then I will start all over and make a new topic since it has been more than 30 days. Thanks! Pam
==================================================
Dump File : 053015-43805-01.dmp
Crash Time : 5/30/2015 1:10:52 PM
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x000000d1
Parameter 1 : 00000000`0000000a
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000000
Parameter 4 : fffff880`016456f0
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+748c0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18839 (win7sp1_gdr.150427-0707)
Processor : x64
Crash Address : ntoskrnl.exe+748c0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\windows\Minidump\053015-43805-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7601
Dump File Size : 286,200
Dump File Time : 5/30/2015 1:13:17 PM
==================================================
==================================================
Dump File : 052915-39639-01.dmp
Crash Time : 5/29/2015 1:40:22 PM
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x000000d1
Parameter 1 : 00000000`0000000a
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000000
Parameter 4 : fffff880`016456f0
Caused By Driver : tcpip.sys
Caused By Address : tcpip.sys+446f0
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+748c0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\windows\Minidump\052915-39639-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7601
Dump File Size : 287,288
Dump File Time : 5/29/2015 1:43:17 PM
==================================================
-
Ok. I will lock this thread.