BSOD on Startup - Varying Error Messages

[derekimo]

OK, this time it's another driver,

BugCheck 1000007E, {ffffffffc0000005, fffff880075ae38a, fffff8800a193488, fffff8800a192ce0}

Probably caused by : RTKVHD64.sys ( RTKVHD64+35e38a )

Followup: MachineOwner

Driver Reference Table - RTKVHD64.sys

That driver is from Jan. 2014 though.

I think something else is going on here.

What were the results of the SFC scan?

Have you checked for malware recently?

 

[derekimo]

I think these tests will be useful too,

http://www.sevenforums.com/tutorials/313457-seatools-dos-windows-how-use.html

   Information

MemTest86+

Run a minimum of 8 passes, preferably overnight, or until errors occur using MemTest86+.

Use this tutorial to help you use MemTest86+:
RAM - Test with MemTest86+

Do you have backups and use an imaging program to keep all your data safe?

That is always a good idea anyway but even more so right now.

 

[machkr]

Results of sfc /verifyonly showed nothing - all clear. I can run sfc /scannow if need be - as I understand sfc /verifyonly analyzes and it found nothing. I'm running MSE and will run a Full Scan right now. Will also follow instructions from previous post. I do not have a backup - I will see what I can do now. Thanks in advance.

 

[derekimo]

Do you have Malwarebytes installed?

That is another excellent tool to have installed.

https://www.malwarebytes.org/

Just use the free version, uncheck the free trial,

View attachment 309841

Update the database and do a full scan.

 

[machkr]

I do not, but I do now. Thanks!

 

[derekimo]

You're welcome. We'll get this figured out.

 

[machkr]

Thanks - I know we will. 6 minutes into Malwarebytes scan and it seems we already have 3 objects detected - great idea for that. Thanks. I'll update you on the results when the scan is complete. Also loaded MemTest86+ on a thumb drive, I will try that once the scan is complete and we've sorted everything out with that. Thanks in advance.

 

[derekimo]

Good work, after the malwarebytes scan and clean, can you upload the log file.

It will be here,

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs

ProgramData is a hidden folder so you will have to unhide it.

http://www.sevenforums.com/tutorials/394-hidden-files-folders-show-hide.html

 

[machkr]

Sure thing - any idea how long a full scan takes? I'm going to leave it running overnight regardless, but I was just curious.

 

[derekimo]

It might be a few hours on your's, you have about 300+ GB to go through.

 

[machkr]

Alrighty - almost 2 hours in, we'll see Thanks.

 

[machkr]

Alright - scan finished (approx. 3 hours). Here's the log. I still have the dialog open, should I remove only the items it selected after the scan? Some of them are selected, others aren't. Thanks in advance.

 

[machkr]

Here's the log after I chose "Remove Selected". I believe it shows the actions it's taking for each instance it found. I'm restarting my computer and will check some things and then restart with MemTest86+. I'll leave it running for the night. Here goes nothing! Thanks in advance.

 

[derekimo]

Wow, you got some nasty stuff going on there. That has just become the top priority.

Who is using the guest account?

This is bad news here,

www.kevinbloggg.blogspot.com.url (Riskware.Cracks)

Select everything in the dialog and remove, it will tell you to reboot, go ahead.

You are doing stuff on your computer we do not support, stop with all the cracks and illegal stuff, or all help will end.

 

[derekimo]

Here's the log after I chose "Remove Selected". I believe it shows the actions it's taking for each instance it found. I'm restarting my computer and will check some things and then restart with MemTest86+. I'll leave it running for the night. Here goes nothing! Thanks in advance.

Looks like some of those were "No action taken", go back and remove them as well.

I've asked a security expert to help as well.

 

[machkr]

When I finished the Malwarebytes scan, I didn't select everything - I'll do that when I can. My MemTest86+ test has been running for almost 8 hours and it's only on Pass 2 with 418 errors, so that's good and bad. Should I let it run until it has completed 8 passes or should I exit or what? Those illegal programs have been deleted for quite some time, sorry for that - it wasn't one of my smartest ideas - and no one uses the guest account, but it has been turned on occasionally, I'll check it after. Again, sorry - thanks in advance.

 

[derekimo]

Since there are errors, go ahead and stop and follow step 3,

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Since this is a laptop, you can test to see if it's only one stick that is bad but you'd be better off replacing as a matched set.

Just get rid of all that nasty junk, keep running Malwarebytes till it finds nothing to delete.

You may already be familiar with this program since I saw it mentioned in one of the logs,

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

 

[Jacee]

I'm watching ... there's lots of "Adware" on that machine! Please post the fresh results of the
MBam log (after you've removed the threats), and the .txt results from AdwCleaner.

 

[machkr]

# AdwCleaner v3.021 - Report created 11/03/2014 at 17:37:05
# Updated 10/03/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Matthew - MATTHEW-PC
# Running from : C:\Users\Matthew\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Windows\System32\Tasks\LaunchApp
Folder Found : C:\Users\Matthew\AppData\Roaming\Mozilla\Firefox\Profiles\5asgzqor.default-1386527740652\Extensions\[email protected]
Folder Found C:\Program Files (x86)\driver-soft
Folder Found C:\ProgramData\boost_interprocess
Folder Found C:\Windows\SysWOW64\AI_RecycleBin

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\ScorpionSaver
Key Found : HKCU\Software\OCS
Key Found : [x64] HKCU\Software\OCS
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Key Found : HKLM\Software\Driver-Soft
Key Found : [x64] HKLM\SOFTWARE\Scorpion Saver

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16518


-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Matthew\AppData\Roaming\Mozilla\Firefox\Profiles\5asgzqor.default-1386527740652\prefs.js ]


-\\ Google Chrome v33.0.1750.146

[ File : C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4739 octets] - [08/12/2013 14:37:38]
AdwCleaner[R1].txt - [1043 octets] - [08/12/2013 14:43:39]
AdwCleaner[R2].txt - [1613 octets] - [11/03/2014 17:37:05]
AdwCleaner[S0].txt - [4461 octets] - [08/12/2013 14:38:35]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [1733 octets] ##########

 

[machkr]

Finishing up a Malwarebytes Full Scan at the moment and I've submitted an RMA for my memory, so I should hear back from that soon - any other advice for further diagnosing/troubleshooting? Any tips to avoid adware/malware in the future? Thanks in advance.