Windows hangs at startup

[CheeseJam]

Hi. I recently came back to my laptop that was left on and it was shut down. When I rebooted, Windows got stuck at the startup screen. I tried the Windows startup repair tool and it did not fix my problem. I can successfully boot into safe mode and have no recovery points. How can I fix this problem? Thanks!

 

[gregrocker]

Work through these steps for Troubleshooting Windows 7 Failure to Start

 

[CheeseJam]

So I can't connect to a network in network safe mode. Additionally, all programs seem to be there except my antivirus, Microsoft Security Essentials. Thoughts? Seems like a virus to me.

 

[VistaKing]

   Warning

You will need a USB FLASH DRIVE

   Tip

Download the Tool from a non infected PC

Farbar Recovery Scan Tool

Choose one that goes with your OS bit version . Save the file to a USB Flash drive

32-bit Version OS :ar: Farbar Recovery Scan Tool <===== Download Link

64-Bit Version OS :ar: Farbar Recovery Scan Tool x64 <===== Download Link

   Note

Click the rb: button and right-click Computer .Select Properties . Look for System Type: which will say 32-bit Operating System or 64-bit Operating System

Plug the flash drive into the infected PC.

Enter System Recovery Options.

:ar: To enter System Recovery Options from the Advanced Boot Options:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select Repair Your Computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

:ar: To enter System Recovery Options by using Windows installation disc:
Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

:ar: On the System Recovery Options menu you will get the following options:

• Startup Repair

• System Restore

• Windows Complete PC Restore

• Windows Memory Diagnostic Tool

• Command Prompt

Select Command Prompt

In the command window type X:\FRST.exe (for x64 bit version type X:\FRST64.exe) and press Enter

   Note

Replace letter X with the drive letter of your flash drive.

   Tip

Type the commands below to see what your letter is for the USB drive and press ENTER after each command

Diskpart
List volume

The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file
Please copy and paste both logs in your reply.(FRST.txt and Addition.txt)

   Note

FRST.txt and Addition.txt files will be inside the root of the USB Flash Drive

 

[ThrashZone]

Microsoft Security Essentials. Thoughts? Seems like a virus to me.

Windows update released a new version of ie10, MS13-055: Cumulative Security Update for Internet Explorer: July 9, 2013
MSE was also upgraded to a new version/ requires accepting terms this update should of came in the second step or round of updates it was still a Important update but was Excluded with the ie10 round of updates.

 

[CheeseJam]

Thank you very much!

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-07-2013 01
Ran by SYSTEM on 09-07-2013 22:22:52
Running from H:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1281512 2013-01-27] (Microsoft Corporation)
HKLM\...\Winlogon: [Userinit] C:\windows\system32\userinit.exe,

==================== Services (Whitelisted) =================

S4 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2011-09-22] (Diskeeper Corporation)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
S4 CoordinatorServiceHost; D:\Programs\SolidWorks\SolidWorks\swScheduler\DTSCoordinatorService.exe [x]
S4 PDMWorks Workgroup Server; D:\Programs\SolidWorks\Vault\pdmwService.exe [x]
S4 Remote Solver for Flow Simulation 2012; D:\Programs\SolidWorks\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe [x]
S2 SplashtopRemoteService; "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" [x]
S2 SSUService; C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [x]
S4 Synergy; D:\Programs\Synergy\synergyd.exe [x]
S2 VC10SecS; C:\Program Files (x86)\Virtual CD v10\System\VC10SecS.exe [x]

==================== Drivers (Whitelisted) ====================

S3 anvsnddrv; C:\Windows\System32\drivers\anvsnddrv.sys [33872 2011-11-28] (AnvSoft Inc.)
S1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2011-09-22] (Diskeeper Corporation)
S0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [80688 2011-09-22] (Diskeeper Corporation)
S3 FlashUSB; C:\Windows\system32\drivers\FlashUSB_x64.sys [19968 2010-12-20] (Danish Wireless Design A/S)
S3 HH10Help.sys; C:\windows\system32\drivers\HH10Help.sys [24088 2009-07-09] (H+H Software GmbH)
S3 HH10Help.sys; C:\windows\system32\drivers\HH10Help.sys [24088 2009-07-09] (H+H Software GmbH)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-19] (Siliten)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S2 SGDrv; C:\Windows\system32\drivers\SGdrv64.sys [7680 2011-04-11] (Phoenix Technologies Ltd.)
S3 shspusb; C:\Windows\system32\drivers\HSPUSB.sys [24064 2010-12-20] (MobileTop)
S3 ssaebus; C:\Windows\system32\drivers\ssaebus.sys [136264 2010-12-20] (MCCI Corporation)
S3 ssaeunic; C:\Windows\system32\drivers\ssaeunic.sys [178760 2010-12-20] (MCCI Corporation)
S3 sscdserd; C:\Windows\system32\drivers\sscdserd.sys [141384 2010-12-20] (MCCI Corporation)
S3 ssceserd; C:\Windows\system32\drivers\ssceserd.sys [129024 2010-12-20] (MCCI Corporation)
S3 ssm_bus; C:\Windows\system32\drivers\ssm_bus.sys [136192 2010-12-20] (MCCI Corporation)
S3 ssm_mdm; C:\Windows\system32\drivers\ssm_mdm.sys [172032 2010-12-20] (MCCI Corporation)
S3 ssuddmgr; C:\Windows\system32\drivers\ssuddmgr.sys [202560 2011-02-17] (DEVGURU Co., LTD.(DEVGURU :: DEVGURU))
S3 ssudobex; C:\Windows\system32\drivers\ssudobex.sys [202560 2011-02-17] (DEVGURU Co., LTD.(DEVGURU :: DEVGURU))
S3 ssudserd; C:\Windows\system32\drivers\ssudserd.sys [202560 2011-02-17] (DEVGURU Co., LTD.(DEVGURU :: DEVGURU))
S3 ss_bserd; C:\Windows\system32\drivers\ss_bserd.sys [128000 2010-12-20] (MCCI Corporation)
S1 vdrv1000; C:\Windows\System32\Drivers\VDRV1000.SYS [223256 2010-03-25] (H+H Software GmbH)
S3 ViaUsbEtsDriver; C:\Windows\System32\drivers\ViaUsbEts.sys [21760 2008-05-29] (Via Telecom, Inc.)
S3 ViaUsbModemDriver; C:\Windows\System32\drivers\ViaUsbModem.sys [28160 2008-06-15] ()
S3 cpuz135; \??\C:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x]
S3 easytether; system32\DRIVERS\easytthr.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 19:21 - 2013-07-09 19:21 - 00000742 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-07-09 19:21 - 2013-04-04 13:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-07-09 16:24 - 2013-07-09 16:24 - 00000000 ____D C:\Windows\pss
2013-07-08 19:27 - 2013-07-08 19:27 - 00262144 ____A C:\Windows\Minidump\070813-70528-01.dmp
2013-07-08 14:39 - 2013-07-08 14:39 - 00003584 ____A C:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-27 11:17 - 2013-06-27 11:18 - 00000000 ____D C:\ProgramData\Package Cache
2013-06-26 11:27 - 2007-11-15 18:21 - 00385024 ____A (SYCODE) C:\Windows\SYCLicense071115U.dll
2013-06-26 11:27 - 2007-10-21 11:18 - 01232896 ____A (SYCODE) C:\Windows\SYCIOU.dll
2013-06-26 11:27 - 2007-10-21 11:17 - 01028096 ____A (SYCODE) C:\Windows\SYCGeoU.dll
2013-06-26 11:27 - 2007-10-21 11:17 - 00233472 ____A (SYCODE) C:\Windows\SYCGUIU.dll
2013-06-20 09:07 - 2013-06-20 09:07 - 00000000 ____D C:\ProgramData\MentorGraphics
2013-06-17 20:29 - 2013-07-08 19:26 - 00006088 ____A C:\Windows\setupact.log
2013-06-17 20:29 - 2013-06-17 20:29 - 00000000 ____A C:\Windows\setuperr.log
2013-06-17 19:36 - 2011-01-11 04:15 - 00069632 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfcm80.dll
2013-06-17 19:36 - 2011-01-11 04:14 - 00057856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfcm80u.dll
2013-06-17 19:36 - 2011-01-10 21:51 - 01101824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc80.dll
2013-06-17 19:36 - 2011-01-10 21:51 - 01093120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc80u.dll
2013-06-17 19:36 - 2011-01-10 21:51 - 00002372 ____A C:\Windows\SysWOW64\Microsoft.VC80.MFC.manifest
2013-06-17 19:36 - 2003-03-18 21:20 - 01060864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MFC71.dll
2013-06-17 19:36 - 2003-03-18 21:12 - 01047552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MFC71u.dll
2013-06-17 19:36 - 2003-03-18 19:05 - 00089088 ____A (Microsoft Corporation) C:\Windows\SysWOW64\atl71.dll
2013-06-15 05:18 - 2013-06-08 06:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-15 05:18 - 2013-06-08 06:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-15 05:18 - 2013-06-08 06:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-15 05:18 - 2013-06-08 06:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-15 05:18 - 2013-06-08 06:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-15 05:18 - 2013-06-08 04:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-15 05:18 - 2013-06-08 03:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-15 05:18 - 2013-06-08 03:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-15 05:18 - 2013-06-08 03:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-15 05:18 - 2013-06-08 03:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-15 05:18 - 2013-06-08 03:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-15 05:18 - 2013-06-08 03:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-13 06:24 - 2013-05-16 17:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 06:24 - 2013-05-16 17:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 06:24 - 2013-05-16 17:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 06:24 - 2013-05-16 17:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 06:24 - 2013-05-16 17:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 06:24 - 2013-05-16 17:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 06:24 - 2013-05-16 17:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 06:24 - 2013-05-16 17:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 06:24 - 2013-05-16 16:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 06:24 - 2013-05-16 16:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 06:24 - 2013-05-16 16:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 06:24 - 2013-05-16 16:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 06:24 - 2013-05-16 16:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 06:24 - 2013-05-16 16:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 06:24 - 2013-05-16 16:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 06:24 - 2013-05-16 16:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 06:24 - 2013-05-16 16:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 06:24 - 2013-05-14 04:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 06:24 - 2013-05-14 00:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 05:55 - 2013-05-12 21:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 05:55 - 2013-05-12 21:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 05:55 - 2013-05-12 21:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 05:55 - 2013-05-12 21:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 05:55 - 2013-05-12 20:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 05:55 - 2013-05-12 20:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 05:55 - 2013-05-12 20:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 05:55 - 2013-05-12 19:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 05:55 - 2013-05-12 19:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 05:55 - 2013-05-12 19:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 05:55 - 2013-05-09 21:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 05:55 - 2013-05-09 19:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 05:55 - 2013-05-07 22:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 05:55 - 2013-04-25 21:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 05:55 - 2013-04-25 20:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 05:55 - 2013-04-25 15:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 05:55 - 2013-04-16 23:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 05:55 - 2013-04-16 22:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 05:55 - 2013-03-31 14:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 04456520 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110u.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 04421192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00164424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\atl110.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00083024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110u.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00083016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00074832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110fra.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00074832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110deu.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00073808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110esn.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00072784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110ita.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00070736 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110rus.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00065104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110enu.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00053840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110jpn.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00053328 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110kor.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00046160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110cht.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00046160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110chs.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 05619784 ____A (Microsoft Corporation) C:\Windows\System32\mfc110u.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 05592648 ____A (Microsoft Corporation) C:\Windows\System32\mfc110.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00192584 ____A (Microsoft Corporation) C:\Windows\System32\atl110.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00090192 ____A (Microsoft Corporation) C:\Windows\System32\mfcm110u.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00090184 ____A (Microsoft Corporation) C:\Windows\System32\mfcm110.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00074832 ____A (Microsoft Corporation) C:\Windows\System32\mfc110fra.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00074832 ____A (Microsoft Corporation) C:\Windows\System32\mfc110deu.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00073808 ____A (Microsoft Corporation) C:\Windows\System32\mfc110esn.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00072784 ____A (Microsoft Corporation) C:\Windows\System32\mfc110ita.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00070736 ____A (Microsoft Corporation) C:\Windows\System32\mfc110rus.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00065104 ____A (Microsoft Corporation) C:\Windows\System32\mfc110enu.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00053840 ____A (Microsoft Corporation) C:\Windows\System32\mfc110jpn.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00053328 ____A (Microsoft Corporation) C:\Windows\System32\mfc110kor.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00046160 ____A (Microsoft Corporation) C:\Windows\System32\mfc110cht.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00046160 ____A (Microsoft Corporation) C:\Windows\System32\mfc110chs.dll

 

[CheeseJam]

==================== One Month Modified Files and Folders =======

2013-07-09 20:33 - 2009-07-13 20:45 - 00021200 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-09 20:33 - 2009-07-13 20:45 - 00021200 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-09 19:21 - 2013-07-09 19:21 - 00000742 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-07-09 19:15 - 2011-11-09 13:59 - 00002243 ____A C:\Windows\epplauncher.mif
2013-07-09 19:14 - 2011-12-25 15:13 - 00174558 ____A C:\Windows\PFRO.log
2013-07-09 19:11 - 2012-06-30 21:50 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-09 19:11 - 2012-06-30 21:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-09 16:24 - 2013-07-09 16:24 - 00000000 ____D C:\Windows\pss
2013-07-09 15:57 - 2009-07-13 21:13 - 00779788 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-09 14:54 - 2011-11-21 10:41 - 01704646 ____A C:\Windows\WindowsUpdate.log
2013-07-09 14:52 - 2011-12-25 14:12 - 00000000 ____D C:\Users\Robert\AppData\Roaming\uTorrent
2013-07-09 14:43 - 2012-04-25 11:39 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-09 14:31 - 2011-12-25 11:21 - 00000912 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1617886939-4081324411-3031297083-1000UA.job
2013-07-09 11:54 - 2012-04-25 11:39 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-09 11:23 - 2011-12-25 14:20 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Dropbox
2013-07-09 11:16 - 2012-11-02 17:05 - 00000000 ____D C:\Users\Robert\AppData\Local\TempSWBackupDirectory
2013-07-09 10:10 - 2011-12-29 15:48 - 00000000 ____D C:\Users\Robert\AppData\Local\SolidWorks
2013-07-09 10:10 - 2011-12-28 16:34 - 00000000 ____D C:\Users\Robert\AppData\Roaming\SolidWorks
2013-07-09 06:00 - 2011-12-25 11:21 - 00000860 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1617886939-4081324411-3031297083-1000Core.job
2013-07-08 19:27 - 2013-07-08 19:27 - 00262144 ____A C:\Windows\Minidump\070813-70528-01.dmp
2013-07-08 19:27 - 2012-01-02 12:34 - 00000000 ____D C:\Windows\Minidump
2013-07-08 19:26 - 2013-06-17 20:29 - 00006088 ____A C:\Windows\setupact.log
2013-07-08 19:26 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-08 14:39 - 2013-07-08 14:39 - 00003584 ____A C:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-07-06 07:52 - 2011-12-25 14:35 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2013-07-02 09:23 - 2009-07-13 21:08 - 00032564 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-02 09:20 - 2013-04-01 13:49 - 00000000 ____D C:\Users\Robert\Desktop\SolidWorks
2013-07-02 08:16 - 2011-12-25 11:17 - 00000000 ____D C:\users\Robert
2013-07-02 08:07 - 2013-01-02 10:38 - 00000000 ____D C:\Program Files (x86)\Unified Remote
2013-07-01 16:29 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-27 11:18 - 2013-06-27 11:17 - 00000000 ____D C:\ProgramData\Package Cache
2013-06-27 10:54 - 2011-12-25 15:01 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Apple Computer
2013-06-22 23:03 - 2012-02-22 16:27 - 00000132 ____A C:\Users\Robert\AppData\Roaming\Adobe PNG Format CS5 Prefs
2013-06-20 12:27 - 2011-12-25 11:23 - 00002377 ____A C:\Users\Robert\Desktop\Google Chrome.lnk
2013-06-20 09:07 - 2013-06-20 09:07 - 00000000 ____D C:\ProgramData\MentorGraphics
2013-06-18 06:43 - 2011-11-09 13:59 - 00774004 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-06-17 20:29 - 2013-06-17 20:29 - 00000000 ____A C:\Windows\setuperr.log
2013-06-17 19:36 - 2011-10-16 21:22 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-17 05:36 - 2011-12-29 15:47 - 00000000 ____D C:\ProgramData\FLEXnet
2013-06-13 06:25 - 2011-11-09 17:18 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 15:09 - 2011-12-28 23:38 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Spotify
2013-06-11 15:07 - 2011-12-28 23:40 - 00000000 ____D C:\Users\Robert\AppData\Local\Spotify
2013-06-09 18:53 - 2013-06-09 18:53 - 04456520 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110u.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 04421192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00164424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\atl110.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00083024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110u.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00083016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00074832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110fra.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00074832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110deu.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00073808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110esn.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00072784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110ita.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00070736 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110rus.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00065104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110enu.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00053840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110jpn.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00053328 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110kor.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00046160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110cht.dll
2013-06-09 18:53 - 2013-06-09 18:53 - 00046160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc110chs.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 05619784 ____A (Microsoft Corporation) C:\Windows\System32\mfc110u.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 05592648 ____A (Microsoft Corporation) C:\Windows\System32\mfc110.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00192584 ____A (Microsoft Corporation) C:\Windows\System32\atl110.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00090192 ____A (Microsoft Corporation) C:\Windows\System32\mfcm110u.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00090184 ____A (Microsoft Corporation) C:\Windows\System32\mfcm110.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00074832 ____A (Microsoft Corporation) C:\Windows\System32\mfc110fra.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00074832 ____A (Microsoft Corporation) C:\Windows\System32\mfc110deu.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00073808 ____A (Microsoft Corporation) C:\Windows\System32\mfc110esn.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00072784 ____A (Microsoft Corporation) C:\Windows\System32\mfc110ita.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00070736 ____A (Microsoft Corporation) C:\Windows\System32\mfc110rus.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00065104 ____A (Microsoft Corporation) C:\Windows\System32\mfc110enu.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00053840 ____A (Microsoft Corporation) C:\Windows\System32\mfc110jpn.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00053328 ____A (Microsoft Corporation) C:\Windows\System32\mfc110kor.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00046160 ____A (Microsoft Corporation) C:\Windows\System32\mfc110cht.dll
2013-06-09 14:59 - 2013-06-09 14:59 - 00046160 ____A (Microsoft Corporation) C:\Windows\System32\mfc110chs.dll

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================


==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 8105.55 MB
Available physical RAM: 7258.14 MB
Total Pagefile: 8103.75 MB
Available Pagefile: 7248.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:50 GB) (Free:0.95 GB) NTFS (Disk=1 Partition=2)
Drive e: (TEMP_PART01) (Fixed) (Total:625.94 GB) (Free:262.38 GB) NTFS (Disk=1 Partition=3)
Drive f: (SAMSUNG_REC) (Fixed) (Total:22.59 GB) (Free:2.75 GB) NTFS (Disk=1 Partition=4) ==>[System with boot components (obtained from reading drive)]
Drive h: () (Removable) (Total:0.96 GB) (Free:0.92 GB) FAT (Disk=2 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=1 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 7 GB) (Disk ID: 74F02DEA)
Partition 1: (Not Active) - (Size=7 GB) - (Type=73)

========================================================
Disk: 1 (Size: 699 GB) (Disk ID: 74D52988)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=626 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=23 GB) - (Type=27)

========================================================
Disk: 2 (Size: 981 MB) (Disk ID: 6F20736B)
Partition 1: (Not Active) - (Size=544 GB) - (Type=72)
Partition 2: (Not Active) - (Size=923 GB) - (Type=65)
Partition 3: (Not Active) - (Size=923 GB) - (Type=79)
Partition 4: (Not Active) - (Size=-336763289600) - (Type=0D)


LastRegBack: 2013-07-03 11:28

==================== End Of Log ============================

 

[CheeseJam]

I had no Addition.txt file on the flash drive after the tool.

 

[VistaKing]

I'm not seeing anything that will stop you from booting into windows .

 

[CheeseJam]

Hmm, I can boot into Safe Mode, but when I start Windows normally, it hangs at the "Starting Windows" screen. It then shuts itself down after about a minute or two.

 

[VistaKing]

Open up notepad .

Inside notepad paste the highlighted text below


start
LastRegBack: 2013-07-03 11:28
end


Inside Notepad click on File ==> choose Save As

Save as : fixlist.txt
Location: USB flash drive

Click on the Save button

Launch FRST.exe again inside System Recovery . Click on the [Fix] button once its complete it will create a new log called Fixlog.txt . Try to log into the Desktop .

 

[gregrocker]

What are the results of a full Malwarebytes scan, in Safe Mode if necessary?

Reinstall MSE and run a full scan with it as well.

Then run SFC /SCANNOW Command. If it will not run then from the booted Win7 installer System Recovery Options or System Repair Disk Command Line run SFC /SCANNOW Run in Command Prompt at Boot.

Then run repeatedly from disk Startup Repair - Run up to 3 Separate Times.

Establish a Clean Boot, check the logs for repeat errors, utilize System Resources, test your hardware from the Troubleshooting Steps for Windows 7 which I gave you earlier and remain unresponded-to.

 

[CheeseJam]

Thanks guys. Before you responded, my computer finally booted into normal mode for some reason. My background was there so it wasn't safe mode, but a lot of core functions were missing: network, sound, and some others. The appearance looked like Windows 97, like in safe mode I guess. Microsoft Security Essentials was still uninstalled, so I got it to reinstall using a flash drive and did a full scan over night. It came up with the following trojans:Trojan:Win64/Sirefef.AA, Trojan:Win32/Sirefef.AN, Trojan:Win32/Sirefef!cfg

I removed them with MSE successfully apparently, but nothing was fixed. I rebooted and it hung at start up again. So I rebooted again, and it booted into normal mode with a bunch of my core processes not working like before. So I assume the virus is still there.

I had a virus with a similar name about a year ago, with entirely different different symptoms. I posted on some forum and some guy gave me a lengthy walkthrough to fix it then, but this virus seems different. Since this is likely the cause of my problems, should I continue with your guys' previous instructions, or do something else entirely? Thanks!

Edit: The Maleware scan found no problems previously.

This is the process I went through to fix it last time: http://www.techspot.com/community/topics/win64-sirefef-virus-help.182401/?mobile=false

Should I go back to that website and try that again? Or do you guys recommend something else since that was a year ago?

 

[gregrocker]

Even if you clean it up such serious infection rarely allows perfect performance of native Win7. Plus if you're still running the factory preinstall then you have the worst possible install one can have. So you're better off backing up your files to quarantine to be scanned with Malwarebytes and your AV, then doing a Clean Reinstall - Factory OEM Windows 7.

Be sure to boot the installer and wipe the HD first using Diskpart Clean Command, then create and format your partition(s) during install. Everything else to get a perfect install is in the Reinstall tutorial, same for retail.

If you want to try to repair what you have - a crippled bloated worst-install-possible if it's factory preinstalled Win7 - then post up the infection in our Security forum for specialized help, then if it can clean up run SFC /SCANNOW Command, go over the install thoroughly with the Troubleshooting Steps for Windows 7

 

[VistaKing]

Can you Redownload a new FRST from below .

Run Farbar Recovery Scan Tool

64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[CheeseJam]

Thanks! I attached the files to this post. I still can't access any network so I am using a flash drive for this.

 

[VistaKing]

Open Notepad .

Inside Notepad paste the highlighted the text below



start
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Search
URLSearchHook: (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No File
HKLM-x32 SearchScopes: DefaultScope {6D1016E5-DEEE-44CA-9349-C54F49D2ECDB} URL =
HKCU SearchScopes: DefaultScope {6D1016E5-DEEE-44CA-9349-C54F49D2ECDB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3301943&CUI=UN18446067163070725&UM=2
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&affID=122460&babsrc=SP_ss&mntrId=A0AFE0CA9492D46B
SearchScopes: HKCU - {6D1016E5-DEEE-44CA-9349-C54F49D2ECDB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3301943&CUI=UN18446067163070725&UM=2
BHO-x32: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
FF Keyword.URL: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3301943&SearchSource=2&CUI=UN28646771472334313&UM=2&q=
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
CHR RestoreOnStartup: "hxxp://www.google.com/", "hxxp://search.conduit.com/?ctid=CT3301943&SearchSource=48&CUI=UN37182720615178260&UM=2", "hxxp://search.conduit.com/?ctid=CT3301943&SearchSource=48&CUI=UN37630268487258217&UM=2", "hxxp://www.delta-search.com/?affID=122460&babsrc=HP_ss&mntrId=A0AFE0CA9492D46B"
S4 Synergy; D:\Programs\Synergy\synergyd.exe [423424 2013-05-02] ()
S4 PDMWorks Workgroup Server; D:\Programs\SolidWorks\Vault\pdmwService.exe [x]
S2 SplashtopRemoteService; "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" [x]
S2 SSUService; C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [x]
S2 VC10SecS; C:\Program Files (x86)\Virtual CD v10\System\VC10SecS.exe [x]
S3 ViaUsbModemDriver; C:\Windows\System32\drivers\ViaUsbModem.sys [28160 2008-06-15] ()
S3 cpuz135; \??\C:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x]
S3 easytether; system32\DRIVERS\easytthr.sys [x]
C:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
C:\windows\Tasks\SA.DAT
end



After you have paste the highlighted text . Click on File choose Save As

Save file to the Desktop
File Name : fixlist.txt
Save as Type : All Files

Click on Save button

Make sure the FRST64.exe is on the Desktop and launch the program again but this time click on the [FIX] button once its done it will create a new log called Fixlog.txt upload that log in your reply.

Once you're done with that run the tool below

Farbar Service Scanner

Click here :ar: Farbar Service Scanner to DOWNLOAD

Place file into your desktop

Place a check mark next to the following options

• Internet Services
• Windows Firewall
• System Restore
• Security Center
• Windows Update
• Windows Defender

Press the Scan button

Farbar Service Scanner will create a log, called FSS.txt, on the Desktop. Upload the FSS.txt with your reply

 

[CheeseJam]

Thanks. I attached the two files.

 

[VistaKing]

Open Notepad . Inside notepad paste the highlighted text below



Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}]
"AutoStart"=""


Click on File ===> Save As

File Name : ActionCenterIcon.reg

Save as type: All Files

and save it to your Desktop .


Right click the ActionCenterIcon.reg file and Select Merge and then reboot your machine

Once you're back inside the Desktop . Do the following step

Open Notepad . Inside Notepad Paste the highlighted text below


@Echo off
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
cls
echo Script finished.
pause
del %0


In Notepad, click File and then Save As

File Name : reset.bat
Save as type : All Files
and then save the file to your desktop

Right click on reset.bat choose

Once that is done Restart the PC and rerun the FSS.exe tool . Delete the old FSS.txt before running the tool again.

 

[CheeseJam]

After this step:

"Right click the ActionCenterIcon.reg file and Select Merge and then reboot your machine"

I could not boot normally, so I continued to boot in safe mode. As I continued through the steps, I could still not boot normally and kept rebooting into safe mode. I attached the new FSS.txt file.