Strange behaviour started happening with my HP desktop

[MadforitSteve]

Recently when I put my pc into sleep mode a lot of the time it wont let me wake it up and i have to power down and restart and then it takes ages to set itserlf up and wont let me get any network until i restart the computer from the start menu, I have ran SUperANtiSpyware scan and it found nothing and i also ran an AVG virus scan which found nothing..And also the other day when i had to do this CHKDSK done all sorts of stuff before it would start....I would be grateful if you can help me with this problem.,

I am using a HP Pavillion a6455 with 3gb ram and large HDD and also an ATI card.

Thanks

 

[Influx]

Hello Steve (If I'm not wrong),

Please run a Full Scan with Malwarebytes

 

[MadforitSteve]

I have done a scan with MBAM,,,here is the log.
I have to restart now so will let yo unow if anything changes when i get back on.

 

[MadforitSteve]

I have done a scan with MBAM,,,here is the log.
I have to restart now so will let yo unow if anything changes when i get back on.

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2012.04.18.05

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Steve :: STEVE-PC [administrator]

Protection: Enabled

18/04/2012 12:59:13
mbam-log-2012-04-18 (12-59-13).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 443761
Time elapsed: 1 hour(s), 39 minute(s), 29 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 11
HKCR\CLSID\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKCR\TypeLib\{44444444-4444-4444-4444-440044044435} (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKCR\Interface\{55555555-5555-5555-5555-550055045535} (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.BHO.1 (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.BHO (PUP.Codec.PR) -> Quarantined and deleted successfully.
HKCU\Software\voomuusa (Adware.HotBar.VM) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\VooMuu (Adware.HotBar.VM) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 5
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Program Files (x86)\VooMuu (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\Program Files (x86)\VooMuu\bin (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\Program Files (x86)\VooMuu\bin\1.0.36.0 (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\ProgramData\VooMuuSA (Adware.HotBar.VM) -> Quarantined and deleted successfully.

Files Detected: 11
D:\Users\Steve\Downloads\Remove WAT v2.2.5.2 - Windows 7 Activation\Remove WAT v2.2.5.2 - Windows 7 Activation\RemoveWAT.exe (HackTool.Wpakill) -> No action taken.
D:\Users\Steve\Downloads\Remove WAT v2.2.5.2 - Windows 7 Activation\Remove WAT v2.2.5.2 - Windows 7 Activation\RemoveWAT_2.exe (HackTool.Wpakill) -> No action taken.
C:\Program Files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.dll (PUP.Codec.PR) -> Quarantined and deleted successfully.
C:\Program Files (x86)\VooMuu\bin\1.0.36.0\VooMuuSAHook.dll (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\Users\Steve\Downloads\32Red(1).exe (PUP.Casino.Gen) -> Quarantined and deleted successfully.
C:\Users\Steve\Downloads\32Red.exe (PUP.Casino.Gen) -> Quarantined and deleted successfully.
C:\Program Files (x86)\VooMuu\bin\1.0.36.0\copyright.txt (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\ProgramData\VooMuuSA\VooMuuSA.dat (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\ProgramData\VooMuuSA\VooMuuSAau.dat (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\ProgramData\VooMuuSA\VooMuuSA_hpk.dat (Adware.HotBar.VM) -> Quarantined and deleted successfully.
C:\ProgramData\VooMuuSA\VooMuuSA_kyf.dat (Adware.HotBar.VM) -> Quarantined and deleted successfully.

(end)

 

[writhziden]

Run another full scan with Malwarebytes to make sure all malware was removed.

 

[MadforitSteve]

Wouldnt the first one catch everything then ??
I've noticed that the behaviour is still happening.

 

[writhziden]

In a perfect world, Malwarebytes would catch the malware and remove it all in the first shot. However, antivirus software and antimalware software often needs to be run a second time to make sure everything that was caught is actually removed. Some viruses and malware are designed to be difficult to remove, so there are no guarantees the software that finds it also removes it the first time (or even on subsequent times). Occasionally, malware and viruses require an offline (outside Windows) scanner to remove them.

 

[MadforitSteve]

Ok,,,i have done another scan,,,ir returned four results of CrossRiderApp and after looking into this i realise that it isnt harmful and it is used to make chrome extension...If you think I should delete it then let me know..But if not then there is definstaely another problem somewhere else in my pc and it would be great to get it fixed...

 

[writhziden]

You will want to remove the app. It does not look like a good app to have on your system. How to Uninstall/Completely Remove Google+Facebook App From your Computer

Please provide us with your Event Viewer administrative logs by following these steps:

1. Click Start Menu
2. Type eventvwr into Search programs and files (do not hit enter)
3. Right click eventvwr.exe and click Run as administrator
4. Expand Custom Views
5. Click Administrative Events
6. Right click Administrative Events
7. Save all Events in Custom View As...
8. Save them in a folder where you will remember which folder and save as Errors.evtx
9. When asked, save the display information in English.
10. Go to where you saved Errors.evtx
11. Create a new folder by right clicking in a blank area within the folder Errors.evtx is saved in. You could also click New Folder at the top of the directory under the directory path box.
12. Name the new folder Errors.
13. Place Errors.evtx and the LocaleMetaData folder into the new Errors folder.
14. Right click the Errors folder -> send to -> compressed (zipped) folder
15. Upload the .zip file here.

 

[writhziden]

The LocalMetaData folder will be in the same place you saved the .evtx file.

 

[MadforitSteve]

Errors Folder

Here is the folder you have requested

 

[writhziden]

Do you have a Genuine version of Windows?

Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Date:          4/19/2012 1:06:49 PM
Event ID:      4103
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Steve-PC
Description:
Windows license activation failed. Error 0x80070005.

Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          4/19/2012 2:18:36 AM
Event ID:      2
Task Category: Session
Level:         Error
Keywords:      Session
User:          SYSTEM
Computer:      Steve-PC
Description:
Failed extract of third-party root list from auto update cab at: 
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> 
with error: A required certificate is not within its validity period when verifying against the current 
system clock or the timestamp in the signed file.

 

[MadforitSteve]

Old Error

I had this a long time ago but it is no longer a problem,,I know for sure that this is not causing the problem... I have got genuine windows...

 

[writhziden]

That is not an error that can be ignored. Without Windows activated, Windows will not run correctly unless changes were made to the operating system. Any changes to the operating system not only prevent us from helping you but also leave your system vulnerable, compromised, and unstable.

 

[carwiz]

 

[MadforitSteve]

It is a fully activated version of windows and has been working well for years,,,I don't understand why you cant help me.

 

[writhziden]

Please download and run http://go.microsoft.com/fwlink/?LinkID=52012, and then copy and paste the report into your next post. Edit out the Product Key info, but keep ALL other info (including Product IDs, etc).

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-*****
Windows Product Key Hash: *************************=
Windows Product ID: 00359-OEM-8992687-00016
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {3048D74C-3061-4268-B30E-D91A547626B0}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120305-1505
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

The first section of it should look as above.

 

[seavixen32]

Check this Microsoft support article: Windows 7 displays "Windows is not Genuine" with an error code of 0x80070005

 

[MadforitSteve]

What is that ms progeram,,,i dont mind doing it but i would like to know what it is ??

 

[writhziden]

Here is information about the diagnostic tool: You receive an error message when you try to activate Windows Vista or Windows 7 on a computer that was obtained from an OEM

The MGADiag tool

The MGADiag tool detects and reports BIOS information. However, the BIOS information for the ACPI_SLIC table does not appear in the graphical user interface output. To see the BIOS information, click the Windows tab, click Copy, and then paste the output into Notepad or into another text editor. The output will resemble the following example: