Solved Win7 x64 Sp1 (have sfc log) crashes and errors after updates-malware?

[circumvent]

Good day all...I was referred to this sub-forum by andrew129260.

First off, given everything I've read in the possible related threads, I am a noob. I am running a Toshiba Satellite L505, and last week I used cnet's "download app" updater and well, everything went down hill thereafter. computer freezes, manual restarting being only solution, taskmgr suddenly showed dllhost.exe guzzling memory, UAC permissions changed and well, after some guided tinkering (thanks to threads), got things running with some stability but not fixed.

So I finally managed to run sfc in elevated command prompt and got a huge lot of things that need repairing in jargon I can barely decipher. To note, I use MSessentials and malwarebytes and windows firewall and last week I had no problems. I really need a guru to guide me on fixing this because I am terrified at the thought of having to do a factory reset (didn't come with a physical disk) or a clean reinstall because, I have too much work data(law/medical) to lose and can't risk a technician tinkering around confidential info.

And as for system restore points, lost all point prior to my first crash, because system restore refused to work except in safe mode so it deleted all other earlier points. Umm, help is a bit of an understatement, at least in deciphering the sfc results and what I can do. So, umm "Help!"

 

[cottonball]

circumvent,


:info: Please download the Farbar Recovery Scan Tool:
Link: Farbar Recovery Scan Tool Download
Select the version that applies to your system.
Save it to your Desktop.

Double-click the downloaded file to run it.
When the tool opens click Yes to the disclaimer.

Press the Scan button.

The tool makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).
:ar: Please provide the FRST.txt in your reply.

The first time the tool is run, it also makes another log: Addition.txt
:ar: Also post the Addition.txt in your reply.




:info: Next, download the Farbar Service Scanner:
Link:Downloading Farbar Service Scanner
Save to the Desktop

Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center
Windows Update
Windows Defender

Press: Scan

When done, FSS creates a log, FSS.txt, on the Desktop.

:ar: Please provide the FSS.txt in your reply.

 

[circumvent]

Thanks for the advice, will do the same as soon as possible and upload results, thanks

 

[circumvent]

Ok, computer froze when I ran the first scanner, manually restarted and ran it again and then the other service scanner as advised. Glimpsed the log and well, I seriously am lost as to all of these tech issues.

Any help you can offer is greatly appreciated...thank you in advance.

 

[andrew129260]

First of all, thanks cottonball for handling the thread.

@circumvent

From your logs, and the knowledge I have, it looks like I may be wrong about you having malware. I don't see anything indicating an infection, (but I just did a quick skim of it so I might have possibly missed something.) Cottonball might find something I didn't, as I didn't look to long at it and he has more knowledge in the area.

According to some of the logs it looks like its stating you have a bad memory module. Can you also run a http://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html

The blue link has a tutorial on how to run this tool. Let us know if it finds any errors....

The main reason I went on the malware route was you stating the uac service was changed and the fact you had sluggish performance and other similar issues. Modern day malware typically runs with no performance drops noticed, but there are still some out there that will slow you down. I wanted to see if it was possible malware before heading to hardware issues.

 

[circumvent]

@Andrew129260,

Ok, I took your advice and ran the windows memory diagnostic test and here is the log derived...hope it helps you to help me.

I am holding off from trying anything further than my knee jerk initial reactions of running my malwarebytes & msessentials in safe mode with networking and other stand alone rootkit scanners and it is clean thus far.

I am hoping that the log is accurate, just copy and pasted, never used win diagnostic before, but it said no errors.

 

[circumvent]

Just a quick update...nothing has changed situation wise, but I ran the mem-test and everything appears to be normal (no errors)...hope that helps somewhat.

 

[Jacee]

You've picked up some 'bundled' adware.

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Using AdwCleaner v3: Scan & Clean:
Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

 

[circumvent]

You've picked up some 'bundled' adware.

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Using AdwCleaner v3: Scan & Clean:
Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

Wow, thanks for the advice. I just ran the scan, didn't take that long. You were not kidding about the log file being confusing. Just wanted to know if you wanted me to just upload the log.txt file or actually copy and paste it in reply...it is a lot. Thanks again

 

[Jacee]

You can attach the .txt log

 

[circumvent]

Thanks lol...and I browsed the log and saw some suspicious looking stuff in there actually...hope I can get my system up and running like it was prior, this is my main computer with all of my work stuff.

As for entries I want to keep...have not one clue, I leave that up to the learned Guru (bowing profusely)

 

[Jacee]

Using AdwCleaner v3: Scan & Clean:
Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button. All items shown above are garbage you don't want!!

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

After you've done that, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

 

[circumvent]

Using AdwCleaner v3: Scan & Clean:
Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button. All items shown above are garbage you don't want!!

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

After you've done that, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Ok, did Stage 1 with ADw...attached the log files before and after cleaning...have to admit, booted faster already...moving on to stage 2, wish me luck.

 

[circumvent]

Umm, Jacee...call me paranoid a bit, but just wanted to advise on what took place with stage 2 TFC...ran it, found temp files, but when it finished, it didn't prompt me to restart to clean...instead is opened my "libraries" folder...is that indicative of anything?

Well I restarted manually (shut down>restart) and when it did restart I still apparently don't have elevated admin privileges and found a bunch of hidden files on my desktop (jpg album art and desktop.ini) which was unexpected, but didn't freak me out. I just went to folder options to hide known extensions, but left option to show hidden files and folders.

Went into my main subdirectory and found a lot of log (.LOG1 and.LOG2 extension) files and;

.regtran-ms files
.TM.blf files

have no idea what those extensions are but all of them start with ntuser

e.g. ntuser.dat{54b77abd-384d-11df-9ac7-a7ce7f31c209}.TMContainer00000000000000000001.regtrans-ms

there is also an actual ntuser.dat file.

should I be concerned? I also scanned again with Adw and here's the log attached...

Not gonna do anything until I hear from my great and powerful Guru..

 

[Jacee]

Let's see what is running in security to determine your question.

Download Security Check by screen317 from here http://screen317.spywareinfoforum.org/SecurityCheck.exe or here http://screen317.spywareinfoforum.org/
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please post the contents of that document.

 

[circumvent]

Let's see what is running in security to determine your question.

Download Security Check by screen317 from here http://screen317.spywareinfoforum.org/SecurityCheck.exe or here http://screen317.spywareinfoforum.org/
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please post the contents of that document.

Ok, thank you again for so much help. One thing I noticed prior to scanning was that firefox would close with no error message, just exit and when I open it I'm offered to restore the session.

I checked the taskmanager and saw that my dllhost.exe was hogging a lot of memory (though not sure that was related to firefox closing or the system freezing.

Also, I had to disable kingsoft realtime defense because almost every application cited here to download kept getting quarantined. Thinking I may have to uninstall it.

Saved the log file from the scan as checkup.txt

 

[Jacee]

Uninstall all of these programs:

Wise Registry Cleaner 7.83
CleanMyPC - Registry Cleaner
Duplicate Cleaner Free 3.1.4
Windows7 does not need a registry cleaner. More often then not, they will affect your computer in adverse ways, instead of helping it!

kingsoft kingsoft antivirus
Trend Micro
You have three anti-virus programs running (including MSE). Anti-virus programs are resource hogs. They will fight each other for your system's resources and some fight each other's virus definitions.

Reboot after uninstalling all the above applications.

If you want to have another anti-virus to scan your system, use an "online scanner". I recommend ESET.
scan your machine with ESET OnlineScan[/b]

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

 

[circumvent]

Uninstall all of these programs:

Wise Registry Cleaner 7.83
CleanMyPC - Registry Cleaner
Duplicate Cleaner Free 3.1.4
Windows7 does not need a registry cleaner. More often then not, they will affect your computer in adverse ways, instead of helping it!

kingsoft kingsoft antivirus
Trend Micro
You have three anti-virus programs running (including MSE). Anti-virus programs are resource hogs. They will fight each other for your system's resources and some fight each other's virus definitions.

Reboot after uninstalling all the above applications.

If you want to have another anti-virus to scan your system, use an "online scanner". I recommend ESET.
scan your machine with ESET OnlineScan[/b]

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

Sorry for the in between replies...working at the same time. Ok, will uninstall those programs, but do I need to uninstall the duplicate cleaner? I actually do use that mostly with my usb flash drives because I'm constantly moving files from one computer to the other and use duplicate cleaner to just delete duplicate word files or pictures...not really on the laptop itself.

Wow, didn't know I don't need a registry cleaner...the way they are touted on legit sites.

As for online scanners, I use the trend micro housecall (aside from the extra stuff I'll delete as suggested) is that ok to keep or should I just go with eset?

 

[Jacee]

You can keep the duplicate cleaner for your flash drive. You will need TrendMicro's uninstall tool:
Uninstalling Trend Micro program using the Diagnostic Toolkit

Umm, Jacee...call me paranoid a bit, but just wanted to advise on what took place with stage 2 TFC...ran it, found temp files, but when it finished, it didn't prompt me to restart to clean...instead is opened my "libraries" folder...is that indicative of anything?

I'm wondering if SlimCleaner may have something to do with opening the Libraries folder

 

[circumvent]

You can keep the duplicate cleaner for your flash drive. You will need TrendMicro's uninstall tool:
Uninstalling Trend Micro program using the Diagnostic Toolkit

Umm, Jacee...call me paranoid a bit, but just wanted to advise on what took place with stage 2 TFC...ran it, found temp files, but when it finished, it didn't prompt me to restart to clean...instead is opened my "libraries" folder...is that indicative of anything?

I'm wondering if SlimCleaner may have something to do with opening the Libraries folder

Ok, well I'll uninstall slimcleaner as well, and will restart and do the eset scan and send log file