Sfc /scannow failed at 99%. Log details included. Kindly help. Thanks!

[ICIT2LOL]

Good point on the slots as my Ivy is 2&4 as primary slots where one usually thinks 1&3.
Personally I do this when tracking stuff down

SLOTCLEANING

Now as for the slots to clean them usea strip of old credit card about 1/2 inch wide nip the corners off one end - preferably round them off hold apiece of thin lint free cloth over the end dab on some form of alcohol - isopropyl alcohol (what we swab the skin with before an injection) is good and GENTLY swipe along the slots.

This can also be done for the GPUslot/s and do not forget to clean the contacts on the cards / sticks either.
It is an idea toclean the contacts on the sticks / cards while you are at it but be VERY gentlewhen doing this

 

[NoelDP]

Your graphics are interesting - but mostly normal.
The Windows Explorer window is normal
It shows a rundll32.exe (Application, rather than Application Extension - i.e. an exe file rather than a dll file)
The Taskmgr window is also fine - mine shows no rundll32 entry either


Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[Leftie]

Farbar Service Scanner Version: 21-07-2014
Ran by Nicholas (administrator) on 12-09-2014 at 02:42:10
Running from "C:\Users\Nicholas\Downloads"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

Hey NoelDP
Here's the log from FARBAR.

Its a relief to know that the rundll32 stuff is normal.

Not sure if this helps, but sometimes when im using my com, the ELCB trips due to lightning storms and the whole com just shuts down

About 2+ years back, i had to RMA 1 of the 2gb ram as it was faulty(memtest instantly detected) and was causing intermitten BSoD while i running the com.
After the RMA and new ram slotted in, everything was back to normal.

Wonder if it might cause the registry to be corrupted

 

[NoelDP]

FarBar looks normal to me.
Certainly, it's a possibility that a RAM problem would lead to strange results later in the life of the OS - but I would have hoped that SFC and/or CheckSUR could have isolated them.
Neither tool is infallible, though - and there's a good chance that your problem is a result of corruption from a long time ago.

I'm thinking in terms of a repair install here, given that history. It would certainly be quicker than attempting to chase down specific errors.

 

[Leftie]

Hi Noel
I guess you are right on the repair install.

Before i take the plunge on the repair install, im hoping to have 1 last shot

Right now im just hoping its not a deep-rootkit infection and the corruption is caused by "improper" shutdown of the computer due to lightning storms and BSoD from a few yrs back

1)Anyway i did some trawling through the processes. - I found out i ran SURT(KB947821) from my download folder(C:-->Users-->Downloads) instead of the desktop.
(wondering if this will affect the outcome, so will dl and save on desktop and re-run SURT again.
Should i run it in Safe or Normal mode? )

2)Found some weird naming folders and will be submitting them to virustotal/jotti for verification.
Eurekalog - (AppData-->Roaming)

Would it be of any help to dl and run hijackthis from trendmicro?

Thanks for sticking by.:grouphug:
Cheers!

 

[NoelDP]

HJT doesn't really work any more - and is extremely misleading in a x64 installation as it doesn't understand the 64-bit file structure.
You could try running TDSSKiller instead, which is far simpler.
SURT doesn't care where it runs from - it creates folders for itself in the partition with the largest available space when running, then (hopefully) deletes them when complete.
I've never seen any difference between running in Normal and Safe modes.

 

[ICIT2LOL]

Well I reckon a quick run of these would do no harm and even if only to eliminate stuff these might pick up



http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

download from bleeping computer – delete any rubbishthese find.

One other you can try is this one (I only ever use the Emergency and Command line scans)
Emsisoft Free Emergency Kit: Portable malware scanner | Free removal of Viruses, Bots, Spyware, Keyloggers and Trojans

 

[Leftie]

@NoelDP & ICit2lol,

Thanks for the heads up on HJT on the 64x installation!! (1 less pgm to install in com)

Will give TDSS, adwcleaner a run, thereafter followed by SURT again.
I'll update and see how it goes from there.

Once again, Thanks!

 

[Leftie]

ADWCleaner

Have found some stuffs but i didnt clean/quarantine them as i didnt want to mess about with the registry

Seems like false positives? but not too sure about those with "search hook".
Anyway, from the looks of it, im guessing nothing too serious right?
My com/pgms is still working good, net surfing is fast; without any re-directs/popups.

Im leaning to the side the corruption is not caused by malware but by "not shutting down properly"
Have ran both TDSS and AdwCleaner in safe mode followed by SURT in (normal mode).
Attached are the logs.
Is the CBS readings any better than before?

 

[NoelDP]

I need to have a look at your COMPONENTS registry hive

Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.

 

[Leftie]

I hope i got this right.

Its from onedrive, 11.8mb in size.

http://1drv.ms/1AKOfx3

Thanks loads

 

[NoelDP]

Got it - I'll have a look through it tomorrow and see if I can fix the corruptions present

 

[NoelDP]

Couldn't wait...

I've uploaded a file - lefaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.
Right-click on the file and select Extract All, and save to the default destination (which should be a folder on the desktop)

Create a new System Restore point

Open an Elevated Command Prompt, and run the following commands.

REN C:\Windows\System32\config\COMPONENTS COMPONENTS.OLD1
COPY %userprofile%\desktop\lefaa\COMPONENTS C:\Windows\System32\config

If you get an error with either command, STOP THERE - do not reboot! - post for instructions.

Assuming both commands go OK, reboot, and run another CheckSUR scan - post the new CheckSUR.log file.

 

[ICIT2LOL]

ADWCleaner

Have found some stuffs but i didnt clean/quarantine them as i didnt want to mess about with the registry

Seems like false positives? but not too sure about those with "search hook".
Anyway, from the looks of it, im guessing nothing too serious right?
My com/pgms is still working good, net surfing is fast; without any re-directs/popups.

Im leaning to the side the corruption is not caused by malware but by "not shutting down properly"
Have ran both TDSS and AdwCleaner in safe mode followed by SURT in (normal mode).
Attached are the logs.
Is the CBS readings any better than before?

Mate best thing to do is to back up the registry before going in there.
http://www.sevenforums.com/tutorials/4230-registry-backup-restore.html then you can always get it back I do it as a matter of course on new installs an before I go I there unless I am positive I know what I am doing or have specific directions from one of the senior members.

 

[Leftie]

@NoelDP
Appreciate it for fixing up the corruptions in such a short time.
As this sounds rather serious, i had better double check with you - should i run those 2 commands in Safe or Normal mode?

@ICit2lol
Will do so on the registry backing up.
Wont try to remove those stuffs found by Adwcleaner right now.
Will try to fix this current problem before filtering out those stuffs from false positives.

Cheers!

 

[NoelDP]

Either way - if the first runs in Normal Mode then fine, otherwise try it in Safe Mode.

 

[Leftie]

Apologies Noel,

I left out 1 question
For the command prompt, should i open it in Adminstrator mode or "Ordinary" mode?
(for running those 2 commands)

 

[NoelDP]

Good question - I've never actually tried it in standard mode, as I have a permanent Elevated mode window open on most machines
Safest is to do it in an Elevated Command Prompt window.

 

[Leftie]

Im sorry, please bear with me.
Im not getting what you mean due to my limited knowledge.

Would it be the command prompt in 1(right click, run as admin) or 2(just click)?

 

[NoelDP]

Number on is the Elevated Command Prompt
#2 is the standard mode.