This is my windows 10 computer Dell 7010 Optiplex.
Every thing was working ok and when I attempted to close Notepad everything appeared to freeze up. Turned the power off waited several min and turned the power back on. After power up the original round plug keyboard and mouse no longer worked.
Turned the power off again and mouse and keyboard still did not work so i had to plug in usb mouse and keyboard. Then i cleared the temp files in Edge and restarted.
OK now the round plug mouse and keyboard works so it sounds like I picked up some garbage. What should I do to give the computer a good cleaning and a backup point?
Thanks Ron
Hi, Ron.
If you would like us to make a check on your computer, you can download the tool we use and provide some logs.
Download
Farbar Recovery Scan Tool (http://'https//www.bleepingcomputer.com/download/farbar-recovery-scan-tool/') and save it to your
desktop. --> IMPORTANTNote: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
If your antivirus software detects the tool as malicious, it's safe to allow FRST to run. It is a
false-positive detection.
If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe
- Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
- Press Scan button and wait for a while.
- The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
- Please attach the content of these two logs in your next reply.
Dr M thanks for the help.
When I click on your link for Farbar Recovery Scan Tool it takes me to a page that says.
"Hmmm... cant reach this page".
OK attempted to download from bleeping computer but i cannot open it.
It is sitting in downloads i don't know how to send it to my desktop.
Do i need to turn Malwarebytes off?
Hi, Ron!
Strange the link doesn't work. I used it a couple of hours ago, while assisting another user.
No, no need to turn Malwarebytes off.
To take FRST on to the Desktop, just drag it and place it on to the Desktop. Or, copy it from your Downloads folder and paste it on to the Desktop.
Is this what you need to look at?
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-04-2017 01
Ran by Ron (20-04-2024 12:19:18)
Running from C:\Users\Ron\Downloads
Windows 10 Pro Version 2009 (X64) (2022-02-15 23:02:48)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1533190171-1017924844-2528464932-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1533190171-1017924844-2528464932-503 - Limited - Disabled)
Guest (S-1-5-21-1533190171-1017924844-2528464932-501 - Limited - Disabled)
Ron (S-1-5-21-1533190171-1017924844-2528464932-1001 - Administrator - Enabled) => C:\Users\Ron
WDAGUtilityAccount (S-1-5-21-1533190171-1017924844-2528464932-504 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Malwarebytes (Enabled - Up to date) {0D452135-A081-B000-D6B6-132E52638543}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Malwarebytes version 4.6.12.323 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.6.12.323 - Malwarebytes)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 124.0.2478.51 - Microsoft Corporation)
Microsoft Edge Update (HKLM-x32\...\Microsoft Edge Update) (Version: 1.3.185.29 - )
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 123.0.2420.97 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1533190171-1017924844-2528464932-1001\...\OneDriveSetup.exe) (Version: 24.070.0407.0003 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{1FC1A6C2-576E-489A-9B4A-92D21F542136}) (Version: 3.74.0.0 - Microsoft Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6111 - Realtek Semiconductor Corp.)
Update for Windows 10 for x64-based Systems (KB4480730) (HKLM\...\{0746492E-47B6-4251-940C-44462DFD74BB}) (Version: 2.55.0.0 - Microsoft Corporation)
Update for Windows 10 for x64-based Systems (KB5001716) (HKLM\...\{B9A7A138-BFD5-4C73-A269-F78CCA28150E}) (Version: 8.94.0.0 - Microsoft Corporation)
UpdateAssistant (Version: 1.25.0.0 - Microsoft Corporation) Hidden
Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.23214 - Microsoft Corporation)
Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1533190171-1017924844-2528464932-1001_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InprocServer32 -> C:\Users\Ron\AppData\Local\Microsoft\OneDrive\24.070.0407.0003\FileCoAuthLib64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1533190171-1017924844-2528464932-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {008539BF-83F9-4483-9E0A-EEEE6EAC0A08} - System32\Tasks\Microsoft\Windows\Shell\UpdateUserPictureTask
Task: {077333D6-06BA-4EA4-BDF4-1CD1439558F2} - System32\Tasks\Microsoft\Windows\BrokerInfrastructure\BgTaskRegistrationMaintenanceTask
Task: {0852846A-2BA6-4C61-AC18-50BD9DD651BA} - System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing
Task: {0CBABB27-6DFC-4155-BAE7-AE919B92FEF2} - System32\Tasks\Microsoft\Windows\DirectX\DXGIAdapterCache => C:\WINDOWS\system32\dxgiadaptercache.exe [2023-11-15] (Microsoft Corporation)
Task: {0CEC0B91-4AE9-4E8A-ACB2-3B4C811F442C} - System32\Tasks\Microsoft\Windows\WaaSMedic\PerformRemediation
Task: {0E2DCCB3-7B11-40CF-B973-90F22732E317} - System32\Tasks\Microsoft\Windows\EDP\EDP Inaccessible Credentials Task
Task: {12DF3F8A-9612-48CA-AE38-2818FA70CA73} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2023-11-15] ()
Task: {304D2127-E6ED-4C82-B9B3-63B3B54A4D66} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Check And Scan
Task: {34ADEFE8-89DB-43BC-8C0B-14BB34D69F6D} - System32\Tasks\Microsoft\Windows\BitLocker\BitLocker Encrypt All Drives
Task: {35525E8D-FD60-47BF-8D11-FA4F778C57C3} - System32\Tasks\Microsoft\Windows\Printing\EduPrintProv => C:\WINDOWS\system32\eduprintprov.exe [2019-12-07] (Microsoft Corporation)
Task: {3ACA5FB6-47C8-46BF-9F9D-517311D0A566} - System32\Tasks\Microsoft\Windows\AppListBackup\Backup
Task: {3B105A37-A1EC-4A6D-B252-37A7C8C91646} - System32\Tasks\Microsoft\Windows\PI\SecureBootEncodeUEFI => C:\WINDOWS\system32\SecureBootEncodeUEFI.exe [2024-04-09] (Microsoft Corporation)
Task: {3FC4BE91-4A96-48F5-8858-1628CB88EFB5} - System32\Tasks\Microsoft\Windows\Chkdsk\SyspartRepair => C:\WINDOWS\system32\bcdboot.exe [2024-04-09] (Microsoft Corporation)
Task: {429D7D8F-BE6A-4730-9045-CA42C1A0A330} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\UCPD velocity => C:\WINDOWS\system32\UCPDMgr.exe [2024-03-13] (Microsoft Corporation)
Task: {4366F565-9CCA-4095-8743-34D251EC3B39} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistantAllUsersRun => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe [2020-11-10] (Microsoft Corporation)
Task: {44AF7ADA-1C0D-43B1-A063-9E7581F7730B} - System32\Tasks\Microsoft\Windows\InstallService\SmartRetry
Task: {4A0DEFDA-A2B8-4736-88E1-A578E00D9704} - System32\Tasks\Microsoft\Windows\Input\PenSyncDataAvailable
Task: {4BCE6391-0B05-40B4-B642-910B37FB1CE6} - System32\Tasks\Microsoft\Windows\PushToInstall\Registration => Sc.exe start pushtoinstall registration
Task: {4F2030CE-BA8E-4122-B9A8-29AA5858973E} - System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache
Task: {5030B58B-D08B-4FDD-B052-2ECA1FA73A5C} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceWnsFallback
Task: {55B1C85E-5BEF-4EDB-ADD0-ECEAEF261E7C} - System32\Tasks\Microsoft\Windows\DirectX\DirectXDatabaseUpdater => C:\WINDOWS\system32\directxdatabaseupdater.exe [2023-11-15] (Microsoft Corporation)
Task: {571A0A5E-B60E-4A25-BEFB-ABB3C6BB6B78} - System32\Tasks\Microsoft\Windows\Workplace Join\Device-Sync
Task: {58CCC4DA-C86D-4E3D-8FAF-A7B24D8F3950} - System32\Tasks\Microsoft\Windows\StateRepository\MaintenanceTasks => Rundll32.exe %windir%\system32\Windows.StateRepositoryClient.dll,StateRepositoryDoMaintenanceTasks
Task: {5E351EE7-F0D4-4F41-A05C-907EB1A33CE8} - System32\Tasks\Microsoft\Windows\WlanSvc\CDSSync
Task: {5F2A2E08-82B7-42C0-80B5-C83AEEB31A33} - System32\Tasks\Microsoft\Windows\Management\Autopilot\RemediateHardwareChange
Task: {634C4147-9AE3-4EF8-B9F4-958C3F82EE19} - System32\Tasks\Microsoft\Windows\Application Experience\PcaPatchDbTask => Rundll32.exe %windir%\system32\PcaSvc.dll,PcaPatchSdbTask
Task: {66A3F618-0C70-4F70-9BBA-735CCDB43A09} - System32\Tasks\Microsoft\Windows\EDP\StorageCardEncryption Task
Task: {75FAB7DC-5F84-4E02-ABAF-E605EB56FA9D} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache
Task: {76BF0333-5722-4D65-A4B6-FBC88F8CD929} - System32\Tasks\Microsoft\Windows\Subscription\EnableLicenseAcquisition => C:\WINDOWS\system32\ClipRenew.exe [2023-11-15] (Microsoft Corporation)
Task: {7BF0B098-7560-45C2-8440-C7A5CC39D4F8} - System32\Tasks\Microsoft\Windows\Subscription\LicenseAcquisition => C:\WINDOWS\system32\ClipRenew.exe [2023-11-15] (Microsoft Corporation)
Task: {7C4733D2-81D6-4CA3-B30C-E00B496B9857} - System32\Tasks\Microsoft\Windows\Input\TouchpadSyncDataAvailable
Task: {8397BE6F-9E48-4DEB-BBEE-527DCF5ABF30} - System32\Tasks\Microsoft\Windows\Clip\LicenseImdsIntegration => C:\WINDOWS\system32\fclip.exe [2024-04-09] (Microsoft Corporation)
Task: {846047A8-A966-449C-8571-32766DE1E3C7} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe [2022-02-15] (Microsoft Corporation) <==== ATTENTION
Task: {87094343-6C1F-4855-A6B9-305BA74AB761} - System32\Tasks\Microsoft\Windows\BitLocker\BitLocker MDM policy Refresh
Task: {8788D0FE-D241-444E-9196-3C038B69FF1B} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe [2022-02-15] (Microsoft Corporation) <==== ATTENTION
Task: {9A9AA0A0-E1AB-4D6D-B31C-FC390A7564D2} - System32\Tasks\Microsoft\Windows\WwanSvc\OobeDiscovery
Task: {9B29B882-A95C-438B-BF91-E7C31B1D82D1} - System32\Tasks\Microsoft\Windows\InstallService\WakeUpAndContinueUpdates
Task: {A071B421-06E2-4F81-9C16-1617F5A0BFE4} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistant => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe [2020-11-10] (Microsoft Corporation)
Task: {A08D6A77-C926-4E78-9ED0-09836E2769AE} - System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdates
Task: {A1F360BD-19AD-41F7-BAEC-3272B71DBD7D} - System32\Tasks\Microsoft\Windows\CloudRestore\Backup
Task: {A2FADBDF-6855-42F7-BDFC-F0C510EDA9BC} - System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdatesAsUser
Task: {A3B2A4DE-C904-4CAB-9FCC-F54C0B733CDF} - System32\Tasks\Microsoft\Windows\Printing\PrinterCleanupTask
Task: {A499FA48-7057-4AC1-9702-44C6FD924058} - System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources
Task: {A60D9ECB-A6F4-4FE1-9BD7-B049487A67E7} - System32\Tasks\Microsoft\Windows\International\Synchronize Language Settings
Task: {A74EF9D1-6D6B-4566-8E25-782430F970E5} - System32\Tasks\Microsoft\Windows\PushToInstall\LoginCheck => Sc.exe start pushtoinstall login
Task: {AF73DAAA-53AE-4CC8-8671-BE29D886B057} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceProtectionStateChanged
Task: {AFC65A59-CFA7-4A23-82E6-F31C49035446} - System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting
Task: {C3DBA8E7-0546-4C5A-ABD4-1091FA2E7394} - System32\Tasks\Microsoft\Windows\WindowsUpdate\RUXIM\PLUGScheduler => C:\Program Files\RUXIM\PLUGscheduler.exe [2024-02-27] (Microsoft Corporation)
Task: {C5D47392-881C-422A-9BF8-E4916B55CD22} - System32\Tasks\Microsoft\Windows\USB\Usb-Notifications
Task: {CAB76809-EDC0-40D2-A888-AD9BEDF4E88A} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => C:\WINDOWS\System32\UNP\UpdateNotificationMgr.exe [2023-11-15] (Microsoft Corporation)
Task: {CADF1293-5495-426F-8E37-A30F69274AF4} - System32\Tasks\Microsoft\Windows\Input\LocalUserSyncDataAvailable
Task: {CCF0F0B7-E1EB-480C-9AA5-5B9EE8841C9E} - System32\Tasks\Microsoft\Windows\Shell\ThemesSyncedImageDownload
Task: {CDE6FD4E-6639-46DD-BA88-8F82F69885C0} - System32\Tasks\Microsoft\Windows\Speech\HeadsetButtonPress => C:\WINDOWS\system32\speech_onecore\common\SpeechRuntime.exe [2023-11-15] (Microsoft Corporation)
Task: {D55565F0-299B-45FA-9F35-029520D3BB17} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistantWakeupRun => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe [2020-11-10] (Microsoft Corporation)
Task: {DA42085F-11E4-4EE1-A363-1898204812F5} - System32\Tasks\Microsoft\Windows\Input\MouseSyncDataAvailable
Task: {DA894A8E-3ADA-4FF0-A49C-84C21845A4C0} - System32\Tasks\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner
Task: {E61CF834-7ED9-4A64-ADDE-3BF61246ECDE} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => %ProgramFiles%\CUAssistant\culauncher.exe
Task: {E7FE19C8-6ACD-4C28-A527-4999C9E71FF6} - System32\Tasks\Microsoft\Windows\ConsentUX\UnifiedConsent\UnifiedConsentSyncTask
Task: {EB5BA36F-DD3F-409F-9960-F6AD54F76DC0} - System32\Tasks\Microsoft\Windows\Management\Autopilot\DetectHardwareChange
Task: {EC3EFE4E-A2E4-4C66-975C-CA2EFD0D42CD} - System32\Tasks\Microsoft\Windows\InstallService\WakeUpAndScanForUpdates
Task: {F097952A-6698-4975-AFDC-F5F72A1DDABB} - System32\Tasks\Microsoft\Windows\AppListBackup\BackupNonMaintenance
Task: {F4A58A9D-B435-4083-B508-7EDEC6F4C75E} - System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task: {F6C5091B-F009-44D4-B4F0-AA09924C3851} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistantCalendarRun => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe [2020-11-10] (Microsoft Corporation)
Task: {F8FEDA28-6261-4385-844A-684E6C988577} - System32\Tasks\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Well, something like that. :)
First, you ran a very old version of FRST tool: 17-04-2017 01!
Second, you posted a part of one of the 2 logs.
Let's take it from the very beginning.
This is the link from where you are going to download the latest version of FRST:
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Download it, save it on the Desktop, and then carefully follow the instructions in my previous post.
No mater what i do it goes to the Downloads list and will not open when o click on it.
Strange thing is it has the internet explorer symbal in front of it.
Thanks for trying to help me but i am to retarted to do this.
Which browser are you using?
Something I just noticed:
Windows 10 Pro Version 2009 (X64) (2022-02-15 23:02:48)
Your computer is running with an out of date operating system. I recommend you to upgrade the system and then check anything else.
I don't have the money to buy a new computer.
Thanks for the help.
All this started last week when MS updated this old win 10 computer. Everything slowed down and things started working strange.
So it looks like MS sabotaged this old computer to force me to buy a new one.
Hmmm is there a way to roll back the update and then dont re-dwwnload it??
I have read alot of people having problems after updates and then they uninstall the update or do a system restore (To before the update) and its ok again.........
Just something to think of....... I hope you can get it working good again!!
Quote from: ron350 on April 20, 2024, 09:26:14 PMAll this started last week when MS updated this old win 10 computer. Everything slowed down and things started working strange.
So it looks like MS sabotaged this old computer to force me to buy a new one.
Ron, you don't have to buy a new computer! Just upgrade this one. For some reason, the computer didn't receive the updates it should receive. Running an out of date system is a security risk, that's why it's important to upgrade now. Plus, there is a possibility the issues you experienced recently are related to this.
This is what you have to do:
- Go to this Microsoft page (https://www.microsoft.com/en-us/software-download/windows10/) and under the title Create Windows 10 installation media press on Download tool now.
- Save the tool on your Desktop and double click to run it.
- On the License terms page, if you accept the license terms, select Accept.
- On the What do you want to do page, select Create installation media (USB....) and then select Next.
- Choose the ISO file option. Once the download is complete, right click the ISO and select the option Mount.
- Open the Windows File Explorer and open mounted ISO, and run the setup.exe file.
- Follow the instructions and click on the option Change what to keep.
- Select the option Keep personal files and apps and click next.
- Windows Setup will now start the in-place upgrade installation to repair Windows.
If you need any help during the steps above, feel free to ask.
QuoteHmmm is there a way to roll back the update and then dont re-dwwnload it??
I have read alot of people having problems after updates and then they uninstall the update or do a system restore (To before the update) and its ok again.........
This is not something I recommend now.
DR M those instructions say they will update my computer to version 22H2. Is that not where I am at now?
4/21/24
Windows 10 version 22H2 (OS Build 19045,4291)
When i go into settings, update MS tells me my computer will nit update to win 11.
Ron,
This is from the part of the log you posted earlier:
Windows 10 Pro Version 2009 (X64) (2022-02-15 23:02:48)
That is why I talked about the need of upgrading to the latest Windows version.
Type winver in the Search area and press Enter. It will show you the Windows version you are using now.
winver=
Micrisoft Windows
Version 22H2 (OS Build 19045-4291)
This is good!
Strange the FRST tool showed other things. Maybe because it was itself a very old version of the tool?
Well, now you must try again to download it and run it.
Let me know at which step of the process you have difficulties, so we can overcome them.
When i try to down load this:
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
My computer shows this in a tool bar on the right side of the page.
When i double click on it it goes to Downloads.
Double click on it again and it tries to open it with Note Pad and fails?
OK.
Does the tool in Downloads has the icon of Notepad too?
I wonder if you are trying to open the log created previously, named FRST.txt. Our file's name is FRST64.exe
Yes the file has a Note Pad icon in front of it.
So my computer is trying to open it with Note Pad.
How can i fix this?
Just to ensure that you are opening the right item: what's the name of it? FRST64.exe or FRST.txt?
When i click on https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
It takes me to Fubar Recovery Scan Tool Download page.
I click on DOWNLOAD NOW (Green Bar) marked 64-Bit Version.
Under downloads before i double click it shows Notepad icon then Unconfirmed 712986.
After i double click it shws Notepad with a jumble of icons and letters.
There is one line that says "This program cannot run in DOS mode."
I have tried this many times with the same results every time.
Unconfirmed download means that the file is not completely downloaded.
Wait for the download to complete and then open it in Downloads.
Last two atempts waited 5 min after downloaded to Downloads.
Unconfirmed470855 4/21/24 2:45PM CRDOWNLOAD 2,338 KB
Unconfirmed712986 4/21/24 1:30PM CRDOWNLOAD 2,338 KB
This thing will not download to my computer.
ron350,
To repeat what DR M wrote:
QuoteJust to ensure that you are opening the right item: what's the name of it? FRST64.exe or FRST.txt?
.
What is the exact name of the file that you get in Downloads? It is important that the file have an ".exe" suffix at the end. If somehow it has an ".exc" suffix then it will get associated with Notepad. So if it somehow has an ".exc" suffix the rename it to the ".exe" suffix. (Right click on it and choose "rename".)
Okay, I just saw your last post after I typed the above. Try this alternate downloads link " https://www.majorgeeks.com/files/details/farbar_recovery_scan_tool_64_bit.html ".
v_v
When it downloads in the colum on the right side of the screen it says:
(red triangle) FRST64.exe isn't commonly downloaded. Make sure you trustFRST64.exe before you open it.
Without me clicking on this it is allready siting in Downloads with the Notepad icon in front of it.
So my computer is trying to open this using NotePad.
How can i change how my computer try's to open this?
ron350,
1. Are you getting this from both the Bleeping Computer link and the Major Geeks link?
2. What browser are you using?
3. Is that window or tool bar on the right side of the screen part of the browser or part of some other program?
4. I am not familiar will the real-time aspect of MalwareBytes but you might try disabling it JUST for this download, and then re-enabling it.
The same thing happens wherever FRST comes from.
The only program downloade before now is Malwarebytes.
My only browser is EDGE.
Does not change anything with MBAM turned off.
My computer does not know how to open FRST!!!
What program or APP opens FRST on your computer?
ron350,
Okay, mystery partially but mostly solved. I downloaded the file from the Bleeping Computer link using Edge twice and I got two files:
Unconfirmed 909274.crdownload
and
Unconfirmed 796443.crdownload.
I tried downloading the file from Major Geeks using Edge and I got the following file:
Unconfirmed 787007.crdownload.
-----
So then I tried downloading from both Bleeping Computer and Major Geeks using the SeaMonkey browser. With SeaMonkey I was able to download " FRST64.exe " from both sites successfully. So the problem appears to be with the Microsoft Edge browser.
-----
Now in addition to Edge having a problem with the file, Windows Defender automatically launched a severe threat alert, and quarantined the following: " file: C:\Users\[name]\AppData\Local\Temp\tKx2M+o+.exe.part ".
So it appears that Microsoft Edge in conjunction with Windows Defender is renaming the file and also deleting the ".exe" suffix. To verify this I took the downloaded file " Unconfirmed 909274.crdownload " (see above) and renamed it " FRST64.exe ". Then I ran this renamed file and it worked as FRST is supposed to. Perhaps it was somewhat risky to rename and execute this file but I trust the two sources of the file and my security setup.
Thus I would say that for whatever reasons Windows Defender and Microsoft Edge are delivering a false positive on the FRST64.exe file when it is download and is thereby neutralizing it by renaming it and deleting the ".exe" suffix. But the file appears to be valid from my verification process as detailed above.
Therefore go to whichever folder your downloaded file is in and right-click on it, choose "Rename", and then rename it to "FRST64.exe". Then double-click the renamed file to run it. You may get a pop-up that says "Windows protected your PC". This is Windows Defender blocking the program. In the pop-up click "More info" and then click "Run anyway" at the bottom. Then you will get another pop-up asking whether 'you wish to allow this application from an unknown publisher to make changes to your computer? Click "yes" and FRST will finally run. You may then get another pop-up---this time from FRST---saying "Failed to update" but just click "OK" to get rid of it.
At this point you should have the FRST screen up and available, so then proceed with the instructions from DR M.
[This was too much work for a Sunday afternoon! - (Smile)]
v_v
Now my computer is using IE to open the files and that does not work.
What program does your computer use to open this file?
When i hover above this file in Downloads it asks what do you want to open this with and it only list IE, Paint, Notepad. Should there not be a program to unzip this file?
This is so frustrating i could scream.
ron350,
I am not clear as to what you are saying? You do not need to "open" the file.
1. Have you renamed the downloaded file to " FRST64.exe "?
2. To rename it:
a. right-click on it;
b. choose "Rename";
c. double-click the file after renaming it to " FRST64.exe ".
3. After you rename it, then when you double-click it it will run all by itself---it does not need another program to open it.
See the other steps in the last major paragraph on my last post beginning with "Therefore. . . ."
v_v
It shows up on the DeskTop as a Internet Explorer.
When i click on it it opens a page to where i copied it from.
I can cnange it to open as Paint and it will try to be a picture or something.
There i some setting on this computer that is screwed up or missing that should open that file.
No use downloading this file again untill i can find out whtat setting is screwed up or missing.
ron350,
It occurred to me that maybe you are not get to the actual folder where the real file is located.
1. At the bottom left of your screen on your taskbar you will find the Search magnifying glass icon. Click that.
2. At the bottom of the search screen that pops up type in "File Explorer".
3. When File Explorer appears click it.
4. When the File Explorer window appears look at the left hand side. Depending on your computer set-up and customization you should see "Quick Access", "Desktop", "Downloads", "Documents", etc. Click "Downloads".
5. Now in the right hand part of the window do you see either of the files that you mentioned in your "Today at 02:59:45 PM" post, "Unconfirmed470855.CRDOWNLOAD" or "Unconfirmed712986.CRDOWNLOAD"?
6. If you do then right click on one of them and follow the renaming process. It doesn't matter which one.
v_v
Whatever happened last Tuesday changed something on this computer so it will not download anything.
ron350,
Did you follow the instructions that I gave you? If so, what was the result?
v_v
ron350,
Also using the File Explorer instructions that I listed, if you say that it is on the desktop, then in File Explorer on the left hand side instead of clicking "Downloads", click "Desktop". Then in the right hand side of the File Explorer window you should find one of those "unconfirmed. . ." files. (You might need to scroll down the right side of the window some.) Right click on it, follow the renaming process as previously described and then the other subsequent steps.
v_v
I know you don't believe me but this picture explanes the problem.
It only gives me several options how to open a file and none are unzip options.
(https://i.imgur.com/BI68GrU.jpg)
ron350,
Did you follow the "File Explorer" instructions that I posted?
If you find the files in File Explorer are you right-clicking on the file that you find using File Explorer?
With reference to the image that you posted, exactly what steps are you doing to get this "How do you want to open this file" pop-up?
To repeat this should have nothing to do with needing to "open" or "unzip" a file.
v_v
ron350,
Since you are able to post images post an image of where this file is that you are clicking on.
(https://i.imgur.com/gn83qlR.jpeg)
I can't find file explorer on this piece of crap win 10 pro only "File Explorer Options" box.
(https://i.imgur.com/U1mWlSE.jpeg)
I am ready to give up.
Im sorry things seem so hard.........
Please dont give up...... We will cointinue to try and help you...
ron350,
Okay, based on your last posted "Downloads" image you are in the "Downloads" portion of the Microsoft Edge browser, not the "Downloads" folder of your computer. (This is why you need to be exact with your details when you post.) As of this moment the file is probably in some Edge temporary cache file location on your computer.
1. You need to click "Save as" to tell Edge to save it to some permanent place on your computer.
2. When you click "Save as" a "Save As" screen will pop up.
3. At the bottom of this screen make sure the name of the file is "FRST64.exe".
4. At the top of the screen in the address box there will be a file location address that the file will be saved to; make sure that you know where this location is; write it down and post that exact location here at Landzdown.
5. After you have verified the file name and noted and recorded the file location address that it will be saved to, then click the "Save" button in the bottom right hand corner of the screen.
6. After clicking "Save" then use the File Explorer instructions as above to go to the exact location where the file was saved to.
[I just did all of this using Edge and what happened on my computer was that Edge saved the file to the location that I designated (" D:\Downloaded Documents ") BUT it changed the name to "Unconfirmed 374270.crdownload" just like I described in my earlier post at "Today at 05:54:58 PM". ----- So what I have had to do at this point is to use File Explorer, go to the exact location of the file ( " D:\Downloaded Documents "), and then rename the downloaded file from "Unconfirmed 374270.crdownload" back to " FRST64.exe ", like I have written in my previous posts. This is exactly what you would/will need to do too.]
7. Post the results of these steps here at Landzdown. Give the exact details of file names and locations on your computer.
----------
Okay, I just saw your last post. I share your frustration.
1. Do you know that at the very bottom of your screen there is a very long strip called the Task Bar? This is where you may have many icons and various windows listed or indicated.
2. At the very left hand side of the task bar there is what is called the (Windows) Start button icon. It looks like four little rectangles.
3. Right next to the Start button to the right there is a little 'magnifying glass' icon. This a Windows search icon. If you click on it a screen will pop up. At the bottom of this new screen there will be a blank area where it will say "Type here to search".
4. Type "File Explorer" in the blank area and a list will appear. On the left side of the list the first item (right under "Best Match") should say "File Explorer" and it should be highlighted; either click it or if it is highlighted just simply hit the Enter or Return key.
5. A new window should open; this new Window is File Explorer;
6. From there you should be able to follow all the previous 'renaming' instructions.
[4a. If for some reason when you type "File Explorer" and you get nothing then try this alternate step; type "run" in the blank area and a list will appear; then again on the left side there will be a list of matches and the first item will be "Run"; it should be highlighted, either click it or just simply hit the Enter or Return key. A new pop-up will appear; simply type "explorer" in this pop-up screen and hit "Enter" or "Return". Then move on to step 5 above.]
v_v
V_v, thanks for all the effort put on that! :)
I'll try to explain the procedure step by step, using images.
Ron, please follow the instructions very carefully.
1. Download FRST from the official source which is https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
2. You will be asked: What do you want to do with FRST.exe?
Select Save as.
FRST1.jpg
3. Save it on to the Desktop. Make sure to save it as an application. See the image below.
FRST2.jpg
4. When you get the yellow triangle warning, click on the 3 horizontal dots and select Keep.
FRST3.jpg
5. Click on Show more and then select Keep anyway.
FRST4.jpg
Let the program to get downloaded. It will be placed on to the Desktop as an application file.
I have printed your instructions and atempted this several times with the same results.
This computer is opening this file as Notepad. Every place i send the file it has the Notepad icon in front of it.
Theproblem is that the computer wants to know what to open this file with. I can open a full page of options to open this page with but i don't wnat to click on something that will wreck the computer.
(https://i.imgur.com/nQh7HZF.jpeg)
(https://i.imgur.com/eMtN9OY.jpeg)
(https://i.imgur.com/MkWOVmc.jpeg)
(https://i.imgur.com/DaB7c7k.jpeg)
The last picture is a page of options to open with.
QuoteTheproblem is that the computer wants to know what to open this file with.
Not agree. The problem is that the file is not completely downloaded. That's why the unconfirmed name.
Click on the Downloads icon as shown in my image below. Take a screenshot of what you see.
FRST5.jpg
this?
(https://i.imgur.com/Usz7EIp.jpeg)
DR M nothing on my computer looks like your pictures.
As you can see the FRST file has the notepad icon in front of it as soon as it loads.
This is before i click on any thing. I must have about a hundred of the notepad files on my computer by now.
(https://i.imgur.com/ZkQHQUz.jpeg)
You right clicked on it. Just left click on it.
This is not a notepad icon, Ron. All you have to do is click on the Save as button, choose Desktop, follow the steps I provided in the images above, and wait for the file to download itself. Unconfirmed download refers to a partially downloaded item.
I fallow your instructions and it still ends upin Downloads or on the desltop as a Notepad file.
Nothing i can do will keep it from showing up as a Notepad file.
Quote from: ron350 on April 22, 2024, 05:12:51 PMI fallow your instructions and it still ends upin Downloads or on the desltop as a Notepad file.
Nothing i can do will keep it from showing up as a Notepad file.
This is because in your effort to open an unconfirmed download file you chose Notepad. But this is not an issue. The issue is that the file is not downloaded in your computer yet.
Check if you can download any other file. Try this one: url=https://www.bleepingcomputer.com/download/adwcleaner/
Can you download and save it on your Desktop?
ron350 (and DR M),
Good afternoon all! What a late night!!
Ron, thank you for the images. You are almost there but you are not following my instructions exactly. I will slightly disagree with my colleague DR M here, the file is downloaded. We just have to get to it and rename it.
DR M - the browser IS saving the file but Windows Defender is renaming it and deleting the ".exe" suffix. See my lengthy post from yesterday 04-21-24 at 05:54:58 PM explaining and verifying what is happening with Microsoft Edge and Windows Defender.
So Ron the image of your desktop shows the file as "Unconfirmed 680331" with a Notepad icon. What this means is that there is a file IN YOUR DESKTOP FOLDER that has a similar name. The icon on the desktop is simply a shortcut image, it IS NOT the file itself! So we need to get to your DESKTOP FOLDER to find the file and then rename it to " FRST64.exe ".
From your images it appears that you did finally find "File Explorer". In that image you see that you have highlighted under "Recent files (20)" an entry named "Unconfirmed 680331" with a Notepad icon. This is the file that we need to look for.
Go back to that same image, to the immediate left of this highlighted file you should see a folder that says "Washing Machine". Immediately above "Washing Machine" you will see "Saved Pictures", "DG 308 Maytag Dryer", etc. Keep going up that same column and you will see "Pictures", "Documents", "Downloads", "Desktop": this last item "DESKTOP" is what we want. Click on Desktop.
Now, still in File Explorer, to the right you should see the "contents" of your DESKTOP FOLDER. This may show up as images (icons), or as a list, etc, depending on how you have set up File Explorer. For more clarity what we will need is to change the VIEW of this right side.
Go to the top of File Explorer. You should see four column listings: "File" - "Home" - "Share" - "View". Click on View.
The View banner or ribbon will now be visible. Immediately under the word "View" you should see 8 "Layout" choices starting with "Extra large icons" and ending with "Details". Click on "Details" so that it is highlighted.
Now move your cursor immediately to the right, leaving the 8 "Layout" group choices, then go past the "Current View" group choices, until you get to the "Show/Hide" group choices. This group has 3 entries beginning with "Item check boxes". Put a check in the check boxes next to "File name extensions" and "Hidden items".
By now the "contents" of your "Desktop Folder" should show a list of files with various details. You might need to post an image of what you see at this point because I do not know how you have customized what details are showing in your content view. But in your "contents" now you should be able to scan and look for a file with the name of "Unconfirmed 680331" or something very close to that. If you find it this is the file we need to rename to "FRST64.exe". So follow the previously posted renaming instructions if you find it. If you do not find it post an image as to what your File Explorer window looks like at this point.
If you are able to rename it successfully, then simply double-click on it once it is renamed and follow my previous instructions to get it to run, and once it is running follow DR M's instructions. At that point he will become your 'primary physician' and I will disappear! (Smile)
----------
Okay, now I have seen both your last post and DR M's. As I wrote above DR M is not correct about the download aspect of this matter. Windows Defender is definitely blocking and renaming the "FRST64.exe" file which is what I have verified on my own computer. So my instructions are to get around this.
v_v
OK ADWCleaner is on the desktop and working.
I turned Malwarebytes off and attempted to download FRST the same way but still have a notepad file on the desktop that does nothing.
ron350,
See my last post.
V_V your instructions worked. YEAH
Now the forum will not let me upload the FRST files.
ron350,
Good for you! I was just about to write to say that the instructions were bad and would not work, and to revise them. But if they worked then I guess that my fingers knew better than my mind did! (Smile)
(You can delete and disregard the PM that I sent to you, if you got it.)
As far as uploading the FRST files I will turn you over to DR M and/or Corrine or one of the other experts. I am sure that they know some simple solution to the uploading problem.
My job is finished and I will disappear! Good luck!!
v_v
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19.04.2024 01
Ran by Ron (22-04-2024 14:01:26)
Running from C:\Users\Ron\Desktop
Microsoft Windows 10 Pro Version 22H2 19045.4291 (X64) (2022-02-15 23:02:48)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-1533190171-1017924844-2528464932-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1533190171-1017924844-2528464932-503 - Limited - Disabled)
Guest (S-1-5-21-1533190171-1017924844-2528464932-501 - Limited - Disabled)
Ron (S-1-5-21-1533190171-1017924844-2528464932-1001 - Administrator - Enabled) => C:\Users\Ron
WDAGUtilityAccount (S-1-5-21-1533190171-1017924844-2528464932-504 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Malwarebytes (Disabled - Up to date) {0D452135-A081-B000-D6B6-132E52638543}
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Malwarebytes version 4.6.12.323 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.6.12.323 - Malwarebytes)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 124.0.2478.51 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 123.0.2420.97 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1533190171-1017924844-2528464932-1001\...\OneDriveSetup.exe) (Version: 24.070.0407.0003 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{1FC1A6C2-576E-489A-9B4A-92D21F542136}) (Version: 3.74.0.0 - Microsoft Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6111 - Realtek Semiconductor Corp.)
Update for Windows 10 for x64-based Systems (KB4480730) (HKLM\...\{0746492E-47B6-4251-940C-44462DFD74BB}) (Version: 2.55.0.0 - Microsoft Corporation)
Update for Windows 10 for x64-based Systems (KB5001716) (HKLM\...\{B9A7A138-BFD5-4C73-A269-F78CCA28150E}) (Version: 8.94.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{76A22428-2400-4521-96AF-7AC4A6174CA5}) (Version: 1.25.0.0 - Microsoft Corporation) Hidden
Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.19041.2183 - Microsoft Corporation)
Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)
Packages:
=========
Disney+ -> C:\Program Files\WindowsApps\Disney.37853FC22B2CE_2024.3.211.0_neutral__6rarf9sa4v8jt [2024-04-20] (Disney)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2024-04-20] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2024-04-20] (Microsoft Corporation) [MS Ad]
Microsoft Copilot -> C:\Program Files\WindowsApps\Microsoft.Windows.Ai.Copilot.Provider_1.0.3.0_neutral__8wekyb3d8bbwe [2024-04-20] (Microsoft Corporation)
Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2024-04-20] (Microsoft Corporation)
Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0 [2024-04-20] (Spotify AB) [Startup Task]
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1533190171-1017924844-2528464932-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel(R) pGFX -> Intel Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2023-03-03] (Malwarebytes Inc. -> Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2018-02-26] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2023-03-03] (Malwarebytes Inc. -> Malwarebytes)
==================== Codecs (Whitelisted) ====================
==================== Shortcuts & WMI ========================
==================== Loaded Modules (Whitelisted) =============
==================== Alternate Data Streams (Whitelisted) ========
==================== Safe Mode (Whitelisted) ==================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) ==========
HKU\S-1-5-21-1533190171-1017924844-2528464932-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mail.yahoo.com/b/?.src=ym&reason=myc
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2018-12-12 04:20 - 2018-12-12 04:18 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1533190171-1017924844-2528464932-1001\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img2.jpg
DNS Servers: 209.18.47.61 - 209.18.47.62
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{E78010E5-E7FD-4689-BDF3-95484FCBCC98}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{31EAABA1-6B04-43D1-AE97-CEB7F41822D0}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{FFE5B5A2-E897-4F59-8663-5F327C31AFBE}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{1C4A6B37-0012-4A9E-8D7C-2DF69FC74E8E}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{B612F704-E1E6-45F4-B96A-0838B0819B45}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{873D14E3-B240-4161-B46F-3FE1E20928FA}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{465BA9B6-3C40-4681-9516-616A941B141C}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{9205F944-6ED6-4A3D-801A-4A4D6B230B53}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{D0EB38E8-B60B-48B4-8950-15C920098125}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{F278B8A2-0E2D-4F02-89C7-AE49F905B7A2}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.235.663.0_x64__zpdnekdrzrea0\Spotify.exe (453637B3-4E12-4CDF-B0D3-2A3C863BF6EF -> Spotify Ltd)
FirewallRules: [{1C9A66AA-16C9-4239-89FD-60F8591A414C}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.97\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{F090E1E4-A1AB-4D4C-9C7B-5F302FD802A9}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.117.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{BE6498E7-0378-4565-BA83-08B60CB1597A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.117.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{9D12B745-F465-4A31-B5A2-ACC5917B0B5E}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.117.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{B79E3505-12FF-47ED-8C42-16635D4C473C}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.117.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
==================== Restore Points =========================
03-04-2024 19:12:16 Scheduled Checkpoint
09-04-2024 19:22:43 Windows Modules Installer
18-04-2024 18:31:36 Scheduled Checkpoint
19-04-2024 19:53:23 last
20-04-2024 16:38:48 Restore Operation
20-04-2024 17:40:32 4/20/24
==================== Faulty Device Manager Devices ============
Name: Unknown USB Device (Device Descriptor Request Failed)
Description: Unknown USB Device (Device Descriptor Request Failed)
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
==================== Event log errors: ========================
Application errors:
==================
Error: (04/21/2024 08:53:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: backgroundTaskHost.exe, version: 10.0.19041.3636, time stamp: 0xe9186526
Faulting module name: KERNELBASE.dll, version: 10.0.19041.4291, time stamp: 0xa956ff71
Exception code: 0xc000027b
Fault offset: 0x000000000012dca2
Faulting process id: 0x8a4
Faulting application start time: 0x01da93f334300705
Faulting application path: C:\WINDOWS\system32\backgroundTaskHost.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: c99aa2fe-6624-4410-8145-f0a84d631f75
Faulting package full name: Microsoft.YourPhone_1.24032.123.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: App
Error: (04/20/2024 05:20:28 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (2932,R,98) SRUJet: Error -1811 (0xfffff8ed) occurred while opening logfile C:\WINDOWS\system32\SRU\SRU0D39B.log.
Error: (04/20/2024 04:55:29 PM) (Source: System Restore) (EventID: 8210) (User: )
Description: An unspecified error occurred during System Restore: (Scheduled Checkpoint). Additional information: 0x80070005.
Error: (04/19/2024 07:09:15 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x8007045b, A system shutdown is in progress..
Error: (04/19/2024 07:09:15 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress.]
Error: (04/19/2024 07:09:14 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x8007045b, A system shutdown is in progress..
Error: (04/19/2024 07:09:14 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress.]
Error: (04/18/2024 08:52:14 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete retrim on Windows (C:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)
System errors:
=============
Error: (04/22/2024 01:04:47 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Security Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (04/22/2024 01:04:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) HD Graphics Control Panel Service service terminated unexpectedly. It has done this 1 time(s).
Error: (04/21/2024 10:51:40 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x8024200b: 2024-01 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5034441).
Error: (04/21/2024 10:31:03 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x8024200b: 2024-01 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5034441).
Error: (04/21/2024 10:21:40 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x8024200b: 2024-01 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5034441).
Error: (04/20/2024 04:57:55 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Delivery Optimization service hung on starting.
Error: (04/20/2024 09:59:28 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-J4MTF94)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.
Error: (04/20/2024 09:59:28 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-J4MTF94)
Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.
Windows Defender:
================
Date: 2024-04-21 10:46:51
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2024-04-21 10:35:51
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2024-04-20 17:39:13
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2023-03-07 17:05:54
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2023-03-06 16:11:37
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan
�Event[0]:
Date: 2024-04-20 17:09:02
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.389.793.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.20300.3
Error code: 0x80240022
Error description: The program can't check for definition updates.
Date: 2024-04-20 17:09:02
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.389.793.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.20300.3
Error code: 0x80240022
Error description: The program can't check for definition updates.
Date: 2024-04-20 16:40:32
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence and will attempt to revert to a previous version.
Security intelligence Attempted: Current
Error Code: 0x80501102
Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support.
Security intelligence Version: 1.389.793.0;1.389.793.0
Engine Version: 1.1.20300.3
Date: 2024-04-20 11:37:57
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.389.793.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.20300.3
Error code: 0x80240017
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
Date: 2024-04-20 11:34:32
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence and will attempt to revert to a previous version.
Security intelligence Attempted: Current
Error Code: 0x80501102
Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support.
Security intelligence Version: 1.389.793.0;1.389.793.0
Engine Version: 1.1.20300.3
CodeIntegrity:
===============
Date: 2024-04-20 17:11:54
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\aepic.dll because the set of per-page image hashes could not be found on the system.
Date: 2024-03-12 08:32:51
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
BIOS: Dell Inc. A28 02/22/2018
Motherboard: Dell Inc. 0GY6Y8
Processor: Intel(R) Core(TM) i5-3570 CPU @ 3.40GHz
Percentage of memory in use: 30%
Total physical RAM: 16270.45 MB
Available physical RAM: 11361.8 MB
Total Virtual: 18702.45 MB
Available Virtual: 14224.39 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:1862.17 GB) (Free:1768.15 GB) (Model: Hitachi HUA722020ALA331) NTFS
\\?\Volume{219776b6-0000-0000-0000-100000000000}\ (System) (Fixed) (Total:0.34 GB) (Free:0.31 GB) NTFS
\\?\Volume{219776b6-0000-0000-0000-a0a0d1010000}\ () (Fixed) (Total:0.5 GB) (Free:0.08 GB) NTFS
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 1863 GB) (Disk ID: 219776B6)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1862.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=517 MB) - (Type=27)
==================== End of Addition.txt =======================
I'm glad that finally worked and you were able to run FRST. DR M is also going to need to see FRST.txt which will be located in the same place as Addition.txt. Follow the same steps you used to copy/paste Addition.txt and post FRST.txt as a reply.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 19.04.2024 01
Ran by Ron (administrator) on DESKTOP-J4MTF94 (Dell Inc. OptiPlex 7010) (22-04-2024 14:00:24)
Running from C:\Users\Ron\Desktop\FRST64.exe
Loaded Profiles: Ron
Platform: Microsoft Windows 10 Pro Version 22H2 19045.4291 (X64) Language: English (United States)
Default browser: Edge
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\cmd.exe
(cmd.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <12>
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\NisSrv.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.14326.21854.0_x64__8wekyb3d8bbwe\HxAccounts.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.14326.21854.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.14326.21854.0_x64__8wekyb3d8bbwe\HxTsr.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtDCpl64.exe [2917632 2016-08-18] (Realtek Semiconductor Corp -> Realtek Semiconductor Corp.)
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-21-1533190171-1017924844-2528464932-1001\...\Run: [MicrosoftEdgeAutoLaunch_9D847451E3A3A387AE6EDE98F9EC1B0B] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4082112 2024-04-18] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-1533190171-1017924844-2528464932-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Bubbles.scr [809472 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Windows x64\Print Processors\HP2030PrintProc: C:\Windows\System32\spool\prtprocs\x64\HP2030PP.DLL [65024 2012-12-04] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\...\Print\Monitors\HP2030LM: C:\WINDOWS\system32\HP2030LM.DLL [246784 2012-12-04] (Microsoft Windows Hardware Compatibility Publisher -> Marvell Semiconductor India Private Limited.)
==================== Scheduled Tasks (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {E61CF834-7ED9-4A64-ADDE-3BF61246ECDE} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => %ProgramFiles%\CUAssistant\culauncher.exe (No File)
Task: {ABC7C92E-59A2-45BE-98D5-54DE6A06685F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\MpCmdRun.exe [1654168 2024-04-21] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {66515A92-1FDD-4A0C-88E9-7C2B3F94BC28} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\MpCmdRun.exe [1654168 2024-04-21] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {0325FFC0-A947-4EFD-B43A-C2BA11098B55} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\MpCmdRun.exe [1654168 2024-04-21] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {13DF739B-89CB-45CF-9126-A3414219ACC4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\MpCmdRun.exe [1654168 2024-04-21] (Microsoft Windows Publisher -> Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62
Tcpip\..\Interfaces\{31e5774b-c91d-46c0-ab78-1b1e41b86a8a}: [DhcpNameServer] 209.18.47.61 209.18.47.62
Tcpip\..\Interfaces\{31e5774b-c91d-46c0-ab78-1b1e41b86a8a}: [DhcpDomain] bham.rr.com
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Ron\AppData\Local\Microsoft\Edge\User Data\Default [2024-04-22]
Edge HomePage: Default -> hxxps://mail.yahoo.com/b/?.src=ym&reason=myc
Edge StartupUrls: Default -> "hxxps://mail.yahoo.com/b/?.src=ym&reason=myc"
Edge Extension: (Malwarebytes Browser Guard) - C:\Users\Ron\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn [2024-04-10]
Edge Extension: (Google Docs Offline) - C:\Users\Ron\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-04-05]
Edge Extension: (Edge relevant text changes) - C:\Users\Ron\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-01-27]
Edge HKLM\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
Edge HKLM-x32\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8884840 2024-04-18] (Malwarebytes Inc. -> Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [522184 2024-04-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\NisSrv.exe [3199648 2024-04-21] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24030.9-0\MsMpEng.exe [133576 2024-04-21] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [File not signed]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [144896 2019-12-07] (Microsoft Corporation) [File not signed]
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2022-06-20] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
S3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239576 2024-02-11] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [20936 2024-04-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [601376 2024-04-21] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [105760 2024-04-21] (Microsoft Windows -> Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2024-04-22 13:54 - 2024-04-22 13:56 - 000020776 _____ C:\Users\Ron\Desktop\Addition.txt
2024-04-22 13:52 - 2024-04-22 14:01 - 000008600 _____ C:\Users\Ron\Desktop\FRST.txt
2024-04-22 13:31 - 2024-04-22 13:32 - 002394112 _____ (Farbar) C:\Users\Ron\Desktop\FRST64.exe
2024-04-22 13:10 - 2024-04-22 13:10 - 008790880 _____ (Malwarebytes) C:\Users\Ron\Desktop\adwcleaner(1).exe
2024-04-22 13:02 - 2024-04-22 13:04 - 000000000 ____D C:\AdwCleaner
2024-04-22 12:03 - 2024-04-22 12:03 - 002394112 _____ (Farbar) C:\Users\Ron\Downloads\Unconfirmed 186212.crdownload.crdownload.crdownload.crdownload
2024-04-22 12:00 - 2024-04-22 12:00 - 002394112 _____ (Farbar) C:\Users\Ron\Downloads\Unconfirmed 186212.crdownload.crdownload.crdownload
2024-04-22 11:23 - 2024-04-22 11:23 - 000000000 ____D C:\Users\Ron\AppData\Local\D3DSCache
2024-04-22 11:05 - 2024-04-22 11:05 - 002394112 _____ (Farbar) C:\Users\Ron\Downloads\FRST.exe.crdownload
2024-04-21 11:58 - 2024-04-21 11:58 - 000000000 ____D C:\Program Files (x86)\WindowsInstallationAssistant
2024-04-21 10:48 - 2024-04-21 10:51 - 000000000 ___HD C:\$WinREAgent
2024-04-20 12:17 - 2024-04-22 14:00 - 000000000 ____D C:\FRST
2024-04-09 20:16 - 2024-04-09 20:16 - 000020861 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2024-04-09 20:15 - 2024-04-09 20:15 - 000020861 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2024-04-22 13:11 - 2023-05-09 18:29 - 000000000 ____D C:\Users\Ron\AppData\Local\Malwarebytes
2024-04-22 12:48 - 2022-02-15 17:47 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2024-04-22 12:06 - 2019-12-07 04:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2024-04-22 08:33 - 2018-04-10 22:14 - 000000000 __SHD C:\Users\Ron\IntelGraphicsProfiles
2024-04-21 21:37 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2024-04-21 11:17 - 2022-10-02 20:05 - 000000000 ____D C:\Users\Ron\AppData\LocalLow\IGDump
2024-04-21 10:35 - 2018-04-10 22:06 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2024-04-21 08:53 - 2022-02-05 17:01 - 000000000 ____D C:\Users\Ron\AppData\Local\CrashDumps
2024-04-20 17:27 - 2022-02-15 18:01 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2024-04-20 17:27 - 2022-02-15 17:47 - 000008192 ___SH C:\DumpStack.log.tmp
2024-04-20 17:27 - 2019-12-07 04:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2024-04-20 17:20 - 2022-02-15 16:10 - 000000000 ____D C:\Users\Ron
2024-04-20 17:19 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2024-04-20 17:17 - 2019-12-07 04:14 - 000000000 ___HD C:\Program Files\WindowsApps
2024-04-20 17:13 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\ServiceState
2024-04-20 17:13 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\registration
2024-04-20 17:13 - 2019-12-07 04:13 - 000000000 ____D C:\WINDOWS\INF
2024-04-20 11:38 - 2022-02-15 18:01 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-1533190171-1017924844-2528464932-1001
2024-04-20 11:38 - 2022-02-15 18:01 - 000003376 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1533190171-1017924844-2528464932-1001
2024-04-20 11:38 - 2022-02-15 16:10 - 000002384 _____ C:\Users\Ron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2024-04-20 11:12 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\NDF
2024-04-19 18:06 - 2022-02-15 17:59 - 000795738 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2024-04-19 07:19 - 2022-02-15 12:23 - 000002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2024-04-19 07:19 - 2022-02-15 12:23 - 000002283 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2024-04-18 18:35 - 2022-02-15 18:05 - 000000000 ____D C:\ProgramData\Packages
2024-04-11 05:08 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\appcompat
2024-04-10 12:34 - 2019-12-07 04:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2024-04-10 12:30 - 2022-02-15 17:47 - 000259496 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2024-04-10 12:28 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SystemResources
2024-04-10 12:28 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2024-04-10 12:28 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2024-04-10 12:27 - 2023-12-13 12:30 - 000000000 ____D C:\WINDOWS\InboxApps
2024-04-10 12:27 - 2019-12-07 04:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2024-04-10 12:27 - 2019-12-07 04:14 - 000000000 ___RD C:\WINDOWS\PrintDialog
2024-04-10 12:27 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\DDFs
2024-04-10 12:27 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\appraiser
2024-04-10 12:27 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\Provisioning
2024-04-10 12:27 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2024-04-09 20:21 - 2019-12-07 04:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2024-04-09 20:15 - 2022-02-15 17:51 - 003017216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2024-04-09 19:22 - 2022-01-31 23:17 - 000000000 ____D C:\WINDOWS\system32\MRT
2024-04-09 19:21 - 2022-01-31 23:16 - 192651728 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2024-04-04 18:55 - 2023-08-20 21:56 - 000000427 _____ C:\Users\Ron\Documents\Hairpin Puller.txt
2024-04-04 08:45 - 2022-02-15 18:01 - 000003536 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2024-04-04 08:45 - 2022-02-15 18:01 - 000003412 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2024-03-28 08:27 - 2018-04-10 22:15 - 000000000 ____D C:\Users\Ron\AppData\Local\Packages
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
Hi, Ron.
You fought to download FRST tool and post the logs, but it worth it, because now you know that your system is clean.
There is some maintenance we can do, though. Also, we need to remove the restriction you have on Windows updates.
1. Question about MalwarebytesDo you have the Premium version or the free one?
2. FRST fix
Please do the following to run a FRST fix.
NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system- Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.
Start::
CreateRestorePoint:
CloseProcesses:
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
Task: {E61CF834-7ED9-4A64-ADDE-3BF61246ECDE} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => %ProgramFiles%\CUAssistant\culauncher.exe (No File)
CMD: DISM /Online /Cleanup-Image /RestoreHealth
CMD: SFC /scannow
EmptyTemp:
End::
- Right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt on your Desktop.
- Post the log in your next reply.
In your next reply please post:1. Your reply about Malwarebytes
2. The fixlog.txt
I am sorry about all the trouble.
Corrine helped me acquire a lifetime version of Malwarebytes.
Fix result of Farbar Recovery Scan Tool (x64) Version: 19.04.2024 01
Ran by Ron (24-04-2024 10:48:48) Run:1
Running from C:\Users\Ron\Desktop
Loaded Profiles: Ron
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start::
CreateRestorePoint:
CloseProcesses:
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
Task: {E61CF834-7ED9-4A64-ADDE-3BF61246ECDE} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => %ProgramFiles%\CUAssistant\culauncher.exe (No File)
CMD: DISM /Online /Cleanup-Image /RestoreHealth
CMD: SFC /scannow
EmptyTemp:
End::
*****************
Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E61CF834-7ED9-4A64-ADDE-3BF61246ECDE}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E61CF834-7ED9-4A64-ADDE-3BF61246ECDE}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\CUAssistant\CULauncher" => removed successfully
========= DISM /Online /Cleanup-Image /RestoreHealth =========
Deployment Image Servicing and Management tool
Version: 10.0.19041.3636
Image Version: 10.0.19045.4291
[== 3.8% ]
[== 3.8% ]
[== 4.0% ]
[== 4.4% ]
[== 4.5% ]
[== 4.7% ]
[== 4.8% ]
[== 4.9% ]
[== 5.1% ]
[=== 5.3% ]
[=== 5.4% ]
[=== 5.6% ]
[=== 5.8% ]
[=== 5.9% ]
[=== 6.0% ]
[=== 6.3% ]
[=== 6.6% ]
[=== 6.8% ]
[==== 7.0% ]
[==== 7.2% ]
[==== 7.4% ]
[==== 7.5% ]
[==== 7.8% ]
[==== 7.9% ]
[==== 8.2% ]
[==== 8.5% ]
[===== 8.8% ]
[===== 9.1% ]
[===== 9.2% ]
[===== 9.4% ]
[===== 9.7% ]
[===== 9.8% ]
[===== 9.8% ]
[===== 10.0% ]
[===== 10.1% ]
[===== 10.2% ]
[===== 10.3% ]
[====== 10.5% ]
[====== 10.6% ]
[====== 10.9% ]
[====== 11.2% ]
[====== 11.4% ]
[====== 11.6% ]
[====== 11.8% ]
[====== 11.9% ]
[======= 12.2% ]
[======= 12.5% ]
[======= 12.8% ]
[======= 13.0% ]
[======= 13.2% ]
[======= 13.3% ]
[======= 13.5% ]
[======= 13.7% ]
[======== 14.0% ]
[======== 14.0% ]
[======== 14.3% ]
[======== 14.6% ]
[======== 14.9% ]
[======== 15.2% ]
[======== 15.4% ]
[========= 15.7% ]
[========= 15.9% ]
[========= 16.0% ]
[========= 16.2% ]
[========= 16.4% ]
[========= 16.6% ]
[========= 16.8% ]
[========= 17.1% ]
[========== 17.4% ]
[========== 17.7% ]
[========== 17.9% ]
[========== 18.2% ]
[========== 18.3% ]
[========== 18.6% ]
[========== 18.8% ]
[=========== 19.0% ]
[=========== 19.1% ]
[=========== 19.2% ]
[=========== 19.4% ]
[=========== 19.5% ]
[=========== 19.8% ]
[=========== 19.9% ]
[=========== 20.1% ]
[=========== 20.3% ]
[=========== 20.5% ]
[============ 20.8% ]
[============ 20.9% ]
[============ 20.9% ]
[============ 20.9% ]
[============ 21.0% ]
[============ 21.0% ]
[============ 21.0% ]
[============ 21.0% ]
[============ 21.0% ]
[============ 21.1% ]
[============ 21.1% ]
[============ 21.1% ]
[============ 21.1% ]
[============ 21.1% ]
[============ 21.6% ]
[============ 21.9% ]
[============= 22.4% ]
[============= 23.2% ]
[============= 23.9% ]
[============== 24.7% ]
[============== 25.1% ]
[============== 25.5% ]
[=============== 26.0% ]
[=============== 26.6% ]
[=============== 27.3% ]
[================ 28.0% ]
[================ 28.4% ]
[================ 28.6% ]
[================ 28.8% ]
[================ 29.1% ]
[================= 29.4% ]
[================= 29.4% ]
[================= 29.7% ]
[================= 29.7% ]
[================= 29.8% ]
[================= 29.8% ]
[================= 29.9% ]
[================= 30.0% ]
[================= 30.3% ]
[================= 30.5% ]
[================= 30.8% ]
[================== 31.2% ]
[================== 31.4% ]
[================== 31.8% ]
[================== 32.2% ]
[================== 32.4% ]
[================== 32.6% ]
[=================== 33.0% ]
[=================== 33.3% ]
[=================== 33.7% ]
[=================== 33.8% ]
[=================== 34.0% ]
[=================== 34.0% ]
[=================== 34.1% ]
[=================== 34.2% ]
[==================== 34.5% ]
[==================== 34.8% ]
[==================== 35.2% ]
[==================== 35.5% ]
[==================== 35.8% ]
[==================== 36.1% ]
[===================== 36.2% ]
[===================== 36.4% ]
[===================== 36.4% ]
[===================== 36.5% ]
[===================== 36.9% ]
[===================== 37.1% ]
[===================== 37.4% ]
[===================== 37.4% ]
[===================== 37.7% ]
[===================== 37.9% ]
[====================== 38.0% ]
[====================== 38.0% ]
[====================== 38.1% ]
[====================== 38.1% ]
[====================== 38.5% ]
[====================== 38.6% ]
[====================== 38.9% ]
[====================== 39.2% ]
[====================== 39.4% ]
[======================= 39.8% ]
[======================= 39.8% ]
[======================= 39.9% ]
[======================= 40.0% ]
[======================= 40.1% ]
[======================= 40.2% ]
[======================= 40.4% ]
[======================= 40.5% ]
[======================= 40.8% ]
[======================= 41.2% ]
[======================== 41.4% ]
[======================== 41.6% ]
[======================== 41.7% ]
[======================== 41.9% ]
[======================== 42.0% ]
[======================== 42.3% ]
[======================== 42.3% ]
[======================== 42.6% ]
[======================== 42.6% ]
[======================== 42.8% ]
[======================== 42.8% ]
[======================== 42.9% ]
[======================== 42.9% ]
[======================== 42.9% ]
[======================== 43.0% ]
[======================== 43.1% ]
[======================== 43.1% ]
[========================= 43.2% ]
[========================= 43.3% ]
[========================= 43.4% ]
[========================= 43.5% ]
[========================= 43.6% ]
[========================= 43.7% ]
[========================= 43.8% ]
[========================= 43.8% ]
[========================= 43.9% ]
[========================= 44.0% ]
[========================= 44.0% ]
[========================= 44.1% ]
[========================= 44.2% ]
[========================= 44.4% ]
[========================= 44.5% ]
[========================= 44.6% ]
[========================= 44.6% ]
[========================== 44.8% ]
[========================== 44.8% ]
[========================== 44.9% ]
[========================== 45.0% ]
[========================== 45.0% ]
[========================== 45.1% ]
[========================== 45.1% ]
[========================== 45.2% ]
[========================== 45.2% ]
[========================== 45.3% ]
[========================== 45.4% ]
[========================== 45.4% ]
[========================== 45.5% ]
[========================== 45.6% ]
[========================== 45.7% ]
[========================== 45.8% ]
[========================== 45.8% ]
[========================== 45.9% ]
[========================== 46.0% ]
[========================== 46.2% ]
[========================== 46.2% ]
[========================== 46.3% ]
[========================== 46.3% ]
[========================== 46.5% ]
[========================== 46.5% ]
[===========================46.6% ]
[===========================46.6% ]
[===========================46.6% ]
[===========================46.6% ]
[===========================46.7% ]
[===========================46.7% ]
[===========================46.9% ]
[===========================47.0% ]
[===========================47.2% ]
[===========================47.4% ]
[===========================47.5% ]
[===========================47.6% ]
[===========================47.8% ]
[===========================47.9% ]
[===========================48.1% ]
[===========================48.2% ]
[===========================48.2% ]
[===========================48.2% ]
[===========================48.4% ]
[===========================48.5% ]
[===========================48.8% ]
[===========================49.0% ]
[===========================49.1% ]
[===========================49.1% ]
[===========================49.3% ]
[===========================49.5% ]
[===========================49.7% ]
[===========================49.7% ]
[===========================50.0% ]
[===========================50.2% ]
[===========================50.6% ]
[===========================50.6% ]
[===========================50.7% ]
[===========================50.9% ]
[===========================51.0% ]
[===========================51.5% ]
[===========================52.0% ]
[===========================52.4% ]
[===========================52.9% ]
[===========================53.3% ]
[===========================53.6% ]
[===========================53.9% ]
[===========================54.1% ]
[===========================54.4% ]
[===========================54.4% ]
[===========================54.6% ]
[===========================54.6% ]
[===========================54.6% ]
[===========================54.6% ]
[===========================54.7% ]
[===========================54.7% ]
[===========================54.7% ]
[===========================54.8% ]
[===========================54.9% ]
[===========================54.9% ]
[===========================54.9% ]
[===========================54.9% ]
[===========================55.0% ]
[===========================55.0% ]
[===========================55.0% ]
[===========================55.0% ]
[===========================55.0% ]
[===========================55.1% ]
[===========================55.1% ]
[===========================55.1% ]
[===========================55.1% ]
[===========================55.2% ]
[===========================55.2% ]
[===========================55.2% ]
[===========================55.2% ]
[===========================55.2% ]
[===========================55.2% ]
[===========================55.2% ]
[===========================55.2% ]
[===========================55.3% ]
[===========================55.3% ]
[===========================55.4% ]
[===========================55.4% ]
[===========================55.4% ]
[===========================55.5% ]
[===========================55.5% ]
[===========================55.5% ]
[===========================55.5% ]
[===========================55.5% ]
[===========================55.5% ]
[===========================55.5% ]
[===========================55.6% ]
[===========================55.6% ]
[===========================55.6% ]
[===========================55.7% ]
[===========================55.7% ]
[===========================55.8% ]
[===========================55.8% ]
[===========================55.8% ]
[===========================55.8% ]
[===========================55.8% ]
[===========================55.8% ]
[===========================55.9% ]
[===========================55.9% ]
[===========================55.9% ]
[===========================56.0% ]
[===========================56.0% ]
[===========================56.0% ]
[===========================56.1% ]
[===========================56.1% ]
[===========================56.1% ]
[===========================56.2% ]
[===========================56.2% ]
[===========================56.2% ]
[===========================56.2% ]
[===========================56.3% ]
[===========================56.3% ]
[===========================56.3% ]
[===========================56.4% ]
[===========================56.4% ]
[===========================56.4% ]
[===========================56.4% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.5% ]
[===========================56.6% ]
[===========================56.6% ]
[===========================56.6% ]
[===========================56.6% ]
[===========================56.7% ]
[===========================56.7% ]
[===========================56.7% ]
[===========================56.7% ]
[===========================56.8% ]
[===========================56.8% ]
[===========================56.8% ]
[===========================56.8% ]
[===========================56.8% ]
[===========================56.8% ]
[===========================56.8% ]
[===========================56.9%= ]
[===========================56.9%= ]
[===========================57.0%= ]
[===========================57.0%= ]
[===========================57.0%= ]
[===========================57.1%= ]
[===========================57.1%= ]
[===========================57.1%= ]
[===========================57.1%= ]
[===========================57.2%= ]
[===========================57.3%= ]
[===========================57.3%= ]
[===========================57.3%= ]
[===========================57.4%= ]
[===========================57.4%= ]
[===========================57.4%= ]
[===========================57.4%= ]
[===========================57.5%= ]
[===========================57.5%= ]
[===========================57.5%= ]
[===========================57.5%= ]
[===========================57.6%= ]
[===========================57.6%= ]
[===========================57.6%= ]
[===========================57.7%= ]
[===========================57.7%= ]
[===========================57.7%= ]
[===========================57.8%= ]
[===========================57.8%= ]
[===========================57.8%= ]
[===========================57.8%= ]
[===========================57.9%= ]
[===========================57.9%= ]
[===========================57.9%= ]
[===========================57.9%= ]
[===========================58.0%= ]
[===========================58.0%= ]
[===========================58.1%= ]
[===========================58.2%= ]
[===========================58.3%= ]
[===========================58.3%= ]
[===========================58.3%= ]
[===========================58.4%= ]
[===========================58.6%= ]
[===========================58.6%== ]
[===========================58.9%== ]
[===========================59.2%== ]
[===========================59.7%== ]
[===========================59.8%== ]
[===========================59.8%== ]
[===========================62.3%==== ]
[===========================77.4%============ ]
[===========================84.9%================= ]
[==========================100.0%==========================]
Error: 0x800f081f
The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see https://go.microsoft.com/fwlink/?LinkId=243077.
The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log
========= End of CMD: =========
========= SFC /scannow =========
Beginning system scan. This process will take some time.
There is a system repair pending which requires reboot to complete. Restart
Windows and run sfc again.
========= End of CMD: =========
=========== EmptyTemp: ==========
FlushDNS => completed
BITS transfer queue => 1310720 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 45265715 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
Windows/system/drivers => 438824369 B
Edge => 0 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 1254960 B
NetworkService => 1568114 B
Ron => 1420834539 B
RecycleBin => 80135028 B
EmptyTemp: => 1.9 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 11:26:58 ====
This my version of Malwarebytes
(https://i.imgur.com/kpJVZU0.jpeg)
No trouble at all, and you are very welcome.
SFC didn't run via FRST. Let's do it using another way.
- Click on the Start button and in the search box, type Command Prompt
- When you see Command Prompt on the list, right-click on it and select Run as administrator
- Enter the command below and press on Enter
sfc /scannow- Let the scan finish.
- You will normally get one of the following results:
Windows Resource Protection did not find any integrity violations
Windows Resource Protection found corrupt files and successfully repaired them
Windows Resource Protection found corrupt files but was unable to fix some of them
Windows Resource Protection could not perform the requested operation
- Please post the result you got (a screenshot).
Well that was worth a shot but it says i am not the Administrator.
I don't have to log in when i turn this computer on.
Hi, Ron.
There are two ways to enable the Administrator account in Windows 10. Fortunately, I can point you to illustrated instructions by someone I've known online and as a fellow former MVP. See the two methods at Enable or Disable the Built-in Administrator Account in Windows 10 (https://www.groovypost.com/howto/enable-disable-built-in-administrator-account-windows-10/) by Andre Da Costa.
This is what i end up with.
Why does it say system 32 i thought this was a 64 computer?
Microsoft Windows [Version 10.0.19045.4355]
(c) Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>sfc/scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.
C:\WINDOWS\system32>
Ron,
System32 is a system's folder. It contains important operating system files that Windows needs in order to function properly. Nothing to do with 32 or 64 bit. When you run something as administrator, it runs via system32.
The result is good.
Let's now change a Malwarebytes setting, so Windows Defender will take action as the primary antivirus, with Malwarebytes as the antimalware.
- Open Malwarebytes.
- Click the little gear on the top right (Settings) and when it opens, click the Security tab and make sure about the following:
Under the title Scan Options, all the options are checked.
Under the title Windows Security Center (Premium only) the option is unchecked.
Under the title Potentially unwanted items all options are set to Always.
- Click on the little gear to return to the main menu and close the program.
How is the computer running now? Any remaining issue/question/concern?
So far there have not been any problems.
Just to make sure i followed directions all i changes was one togle.
WINDOWS SECURITY CENTER
Always register Malwarebytes in the Windows Security Center. From ON to OFF
Quote from: ron350 on April 25, 2024, 04:58:02 PMSo far there have not been any problems.
Just to make sure i followed directions all i changes was one togle.
WINDOWS SECURITY CENTER
Always register Malwarebytes in the Windows Security Center. From ON to OFF
Yes! That's it.
Since you have no issues, and everything is checked, rename FRST64.exe to uninstall.exe. Double click on the renamed file, so the tool and its logs delete themselves.
Thanks for all the great help.
Does this forum accept donations?
You are very welcome, Ron!
I'm glad we could help.
As to donations, maybe Corrine can give more information.
I'll check with the forum owner regarding donations.
well it has done the same thing again.
After searching for automotive hook & pick sets on ebay and duckduckgo the PS/2 mouse and keyboard stoped working.
When i unpluged the computer and pluged it back in the hard light stayed on for 30 min like it was down loadinig something.
Something has changed the way this dell optiplex works after power is lost. Before when power was restored, there would be a screen that said to press F1 to continue but now windows 10 just starts and the hard drive stays on for 15 min. The PS/2 keyboard lights will flicker, and it will not work.
Hi, Ron.
Sorry to hear that the computer freezes again.
The only thing we didn't check is the disk. Let's check it.
1. Check disk 1- Click on the Start button and in the search box, type Command Prompt.
- When you see Command Prompt on the list, right-click on it and select Run as administrator.
- Enter the command below and press on Enter and wait for it to finish (~15 minutes).
chkdsk C: /r
- You will receive a message that the operation cannot be performed while the system is in use and ask if you want to check when you restart your computer. Choose Yes, and then restart the computer, allowing disk check to run at startup.
- The process will take some time, depending on the disk condition.
- Download ListChkdskResult (https://www.dropbox.com/s/xfsr4yyg5yun3k1/ListChkdskResult.exe?dl=1) by SleepyDude and save it on your Desktop.
- Double click on the created icon.
- A notepad file will open. Copy its content and paste it in your next reply.
2. Check disk 2- Download CrystalDiskInfo from here (https://crystalmark.info/redirect.php?product=CrystalDiskInfoInstaller) and save it to your Desktop.
- Run the installer to install the program.
- When finished, open the installed program by double clicking on it.
- If everything is working properly, you should see the status "Good" displayed. Other statuses you might see include "Bad" (which usually indicates a drive that's dead or near death), "Caution" (which indicates a drive that you should most likely be thinking about backing up and replacing), and "Unknown" (which just means that information could not be obtained).
- Take a screenshot and attach it for me to check.
In your next reply please post:- The chkdsk result
- The screenshot after running DiskCrystalInfo
DR M thanks again for the help.
It says Chkdsk canot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N).
Yes, choose Y.
I hope this is correct it said Fixing (C:)
ListChkdskResult by SleepyDude v0.1.7 Beta | 21-09-2013
------< Log generate on 4/29/2024 9:07:22 PM >------
Category: 0
Computer Name: DESKTOP-J4MTF94
Event Code: 1001
Record Number: 42523
Source Name: Microsoft-Windows-Wininit
Time Written: 04-30-2024 @ 01:50:30
Event Type: Information
User:
Message:
Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.
A disk check has been scheduled.
Windows will now check the disk.
Stage 1: Examining basic file system structure ...
786432 file records processed.
File verification completed.
Phase duration (File record verification): 19.03 seconds.
26203 large file records processed.
Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 0.69 milliseconds.
Stage 2: Examining file name linkage ...
86030 reparse records processed.
1254176 index entries processed.
Index verification completed.
Phase duration (Index verification): 7.31 minutes.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 6.36 seconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 3.14 minutes.
86030 reparse records processed.
Phase duration (Reparse point and Object ID verification): 172.75 milliseconds.
Stage 3: Examining security descriptors ...
Cleaning up 2134 unused index entries from index $SII of file 0x9.
Cleaning up 2134 unused index entries from index $SDH of file 0x9.
Cleaning up 2134 unused security descriptors.
CHKDSK is compacting the security descriptor stream
Security descriptor verification completed.
Phase duration (Security descriptor verification): 1.72 seconds.
233873 data files processed.
Phase duration (Data attribute verification): 0.81 milliseconds.
CHKDSK is verifying Usn Journal...
38304144 USN bytes processed.
Usn Journal verification completed.
Phase duration (USN journal verification): 699.74 milliseconds.
Stage 4: Looking for bad clusters in user file data ...
786416 files processed.
File data verification completed.
Phase duration (User file recovery): 35.92 minutes.
Stage 5: Looking for bad, free clusters ...
460662008 free clusters processed.
Free space verification is complete.
Phase duration (Free space recovery): 0.00 milliseconds.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
No further action is required.
1952622860 KB total disk space.
108637036 KB in 450869 files.
379832 KB in 233876 indexes.
8 KB in bad sectors.
957952 KB in use by the system.
65536 KB occupied by the log file.
1842648032 KB available on disk.
4096 bytes in each allocation unit.
488155715 total allocation units on disk.
460662008 allocation units available on disk.
Total duration: 46.85 minutes (2811531 ms).
Internal Info:
00 00 0c 00 d2 72 0a 00 54 38 12 00 00 00 00 00 .....r..T8......
35 01 00 00 d9 4e 01 00 00 00 00 00 00 00 00 00 5....N..........
-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-J4MTF94
Event Code: 1001
Record Number: 16427
Source Name: Microsoft-Windows-Wininit
Time Written: 04-20-2023 @ 15:34:35
Event Type: Information
User:
Message:
Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.
One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
Stage 1: Examining basic file system structure ...
Read failure with status 0xc000009c at offset 0xe9856e3800 for 0x400 bytes.
File record segment 79812 is unreadable.
609536 file records processed.
File verification completed.
Phase duration (File record verification): 6.14 minutes.
15669 large file records processed.
Phase duration (Orphan file record recovery): 0.00 milliseconds.
1 bad file records processed.
Read failure with status 0xc000009c at offset 0xe9856e3800 for 0x400 bytes.
Phase duration (Bad file record checking): 0.00 milliseconds.
Stage 2: Examining file name linkage ...
58980 reparse records processed.
Index entry tokenProviderManager.js of index $I30 in file 0x9259d points to unused file 0x79812.
Deleting index entry tokenProviderManager.js in index $I30 of file 9259D.
Index entry tokenProviderManager.js of index $I30 in file 0x930a0 points to unused file 0x79812.
Deleting index entry tokenProviderManager.js in index $I30 of file 930A0.
879908 index entries processed.
Index verification completed.
Phase duration (Index verification): 13.80 minutes.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 2.24 seconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 44.04 seconds.
58980 reparse records processed.
Phase duration (Reparse point and Object ID verification): 2.93 minutes.
Stage 3: Examining security descriptors ...
Cleaning up 5629 unused index entries from index $SII of file 0x9.
Cleaning up 5629 unused index entries from index $SDH of file 0x9.
Cleaning up 5629 unused security descriptors.
Security descriptor verification completed.
Phase duration (Security descriptor verification): 91.12 milliseconds.
135187 data files processed.
Phase duration (Data attribute verification): 0.82 milliseconds.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the master file table's (MFT) DATA attribute.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
No further action is required.
1952622860 KB total disk space.
62883620 KB in 314740 files.
229064 KB in 135188 indexes.
4 KB in bad sectors.
743320 KB in use by the system.
65536 KB occupied by the log file.
1888766852 KB available on disk.
4096 bytes in each allocation unit.
488155715 total allocation units on disk.
472191713 allocation units available on disk.
Total duration: 23.93 minutes (1435859 ms).
Internal Info:
00 4d 09 00 93 dd 06 00 84 1c 0c 00 00 00 00 00 .M..............
a5 00 00 00 bf e5 00 00 00 00 00 00 00 00 00 00 ................
-----------------------------------------------------------------------
Well this looks bad.
(https://i.imgur.com/kkS1qS0.png)
I can't make the screenshot larger.
(https://i.imgur.com/Ikk5coS.png)
Hi, Ron.
It seems that your hard drive started failing.
You have two options:
1. Make a backup of all of your personal files and data, order a new disk and go for a replacement.
2. Make a backup of all of your personal files and data, and keep using the old disk, until things become worse. Unfortunately, we can't say when this will happen. In a week, a month or a year.
Personally, I would go for the first option immediately.
What would i need to replace this hard drive?
So far i have a new WD 2TB hard drive the same size as the bad drive.
I have 2 CD's i made marked:
#1 Dell 7010 Backup DESKTOP-J4MTP94-1/2/2019
#2 Dell 7010 Backup DESKTOP-J4MTF94-1/2/2019
I started to purchase one of those toaster transfer things but was told it would not work if both hard drives were the same size.
Hi, Ron.
Your bad disk is this one:
Drive c: (Windows) (Fixed) (Total:1862.17 GB) (Free:1768.15 GB) (Model: Hitachi HUA722020ALA331) NTFS
Seeing that you have used around 100GB only, I can say that you don't need a 2T disk.
When you say you have a new WD hard drive, you refer to an internal disk or an external to use to save your files?
P.S. You sent me a PM but I couldn't reply because your inbox is full. You must delete some of the messages in your Inbox so you can receive PMs from others.
I purchased a 2TB WD internal HD because it was the closest drive to the one in the computer.
The Western Digital HD is # WD2003FZEX SATA 6Gb/s PC HA710 still sealed in its plastic pouch.
Ron, a disk of 1T would be more than enough for you.
Plus, you could get an SSD instead of a hard disk.
Just to get an idea about replacing the disk:
https://www.youtube.com/watch?v=yTl1-4wZxoE
He replaces it with an SSD, but you get the idea.
I would not recommend you to clone the old disk and go for a fresh install, using a Windows Installation Media. Here you can read how to create it: https://www.microsoft.com/el-gr/software-download/windows10
You must be sure that you have the activation key, just in case you need it.
Let me know when you are ready, so I can give you more complete instructions.
Forgive the interruption ... if you don't know the Windows key, Belarc Advisor will display it for you: https://www.landzdown.com/index.php?topic=56410.0
Quote from: winchester73 on April 30, 2024, 07:15:23 PMForgive the interruption ... if you don't know the Windows key, Belarc Advisor will display it for you: https://www.landzdown.com/index.php?topic=56410.0
No interruption at all, and I'm glad you are here with us.
Please feel free to "interrupt" at any step of the procedure. :)
If Macrium Reflect Disk Imaging and Backup works with a SSD why can't i do the same thing with this new WD HD i already have?
This is a rebuilt computer so i don't have any key sticker on the computer.
Windows system didn't find corruptions earlier, and this is the most important thing. However, my personal opinion when we have to do with a disk like yours, is to create a fresh start. If you would like to make an image using Macrium, is fine.
As Winchester73 pointed out above, you can retrieve the activation code using Belarc Advisor.
Ok how do i use Belarc Advisor to get a key?
Quote from: ron350 on April 30, 2024, 07:53:43 PMOk how do i use Belarc Advisor to get a key?
https://www.landzdown.com/index.php?topic=56410.msg207558#msg207558
Click on the link in this post, it takes you to the direct download. Save/install to your desktop. Run Belarc, the keys for software are displayed towards the bottom of page 1.
Why does Belarc Advisor want my name, email, and company name?
Merely because it gives you the option to use it for free. The Company name blank doesn't have an asterisk so isn't required. As explained in one (https://windowsreport.com/software/download-belarc-advisor-windows-10/) of the many articles about the program:
QuoteIs Belarc Advisor safe?
Yes, Belarc Advisor is safe to download and install. Your PC privacy is protected because the tool doesn't upload any information about your computer to its or anyone else's servers when performing the PC audit. Instead, it creates a local web page that's only available to you.
Did you click on that link in the Belarc post I last referenced?
I just did, and it didn't ask for anything ... it is a direct link to the installer.
I suspect you clicked on the link in the first post in the thread.
Yes, Ron. What you posted is the key. I've deleted your post though so that a bot won't pick up the key and use it before you've finished the process.
Thank you Corrine.
Thank for the help Winchester73 everything worked with no problems.
Yeah i have the magic key.
DR M i read one of your posts wrong, my vision is like my memory bad.
I think this link you posted came out scrambled?
I would not recommend you to clone the old disk and go for a fresh install, using a Windows Installation Media. Here you can read how to create it: https://www.microsoft.com/el-gr/software-download/windows10
DR M i was reading about installing a new version of Win 10 in your link https://www.microsoft.com/el-gr/software-download/windows10
It would be nice to start over with a fresh version of Win 10 but this old computer came with Win 10 Pro.
Would this newly found key only work with Win 10 Pro?
Hi, Ron.
I sent you the link in Greek. This is the link in English: https://www.microsoft.com/en-us/software-download/windows10
When you create the tool, you will select the option which takes in consideration the current computer. So, if the computer is running Windows 10 Pro, the tool will be for the specific computer and install Windows 10 Pro.
Let's now see the instructions step by step. Make sure you saved all your personal files and data in an external disk.
1. Prepare a bootable USB drive with Windows 10
Use the link above to do this.
2. Make your computer boot from USB drive
You have to change boot order, so when the time comes, the computer will boot from the USB drive, installing Windows from scratch.
This link maybe helpful: https://www.wikihow.com/Change-Computer-BIOS-Settings
3. Replace the disk
The video here, although is about replacing the HDD with an SSD, is helpful: https://www.youtube.com/watch?v=yTl1-4wZxoE
4. Reinstall Windows 10
Insert the USB drive to the computer and restart.
Follow the instructions here: https://answers.microsoft.com/en-us/insider/forum/all/how-to-perform-a-clean-install-or-reinstall-of/aef0ae63-2117-41ee-a8ea-4a3181625b08
Let us know if you have any question about the procedure.
Thanks DR M
I have printed the instructions in those links and will study them.
My pictures are backed up on a Lexar 16GB jumpdrive and have another for the Win 10 download.
Ron, feel free to ask any question during the procedure.
Have in mind, however, that my time zone is CEST +1. 🙂
Hi, Ron.
Any news? Have you installed Windows in your new disk?
DR M thanks for asking.
I might have to have surgery soon and don't want to risk killing my only computer faster than my old XP.
PS: Last week i did atempt to change the boot sequence.
I moved USB to the top of the list and DVD second then Hard drive.
Wish there was a way to test to see if I actually changed anything.
I wish you a fast recovery, Ron.
At least, make sure that you have your backup ready. You never know when a disk will completely fail.
Thank you.
Every thing was going fine till i got to a page titled: Let's add your account.
it wanted my email and my email password and when i entered them it said my password was wrong.
I then backed up and entered my phone number and it said that was not a good phone number.
I am stuck.
Are you sure you used your Microsoft account and password?
I don't have a Microsoft account that i know of.
You will need one now. There is an option on the screen where you were asked for your account, to create a Microsoft account if you don't have one.
Somehow it bypassed that page and i am now using the new hard drive.
I hope this is good and i did not mess up.
Now i need to find out how to open EDGE with my yahoo.email page like i have it set on the old HD.
ron350,
You got past that page before I could post my possible solutions. So I will not post them! But the basic gist of the solutions was to simply "disconnect from the internet while you are going through the setup process."
Some of us prefer not to establish a Microsoft Account for whatever our various reasons (probably mostly privacy-based reasons). My understanding is that one can always establish a Microsoft Account later if one wishes to, but that it is not absolutely necessary for Windows 10 setup. (But Microsoft does not make it easy to figure this out!)
If you should need to explore the issue further you can do what I did and do a search for "reinstall windows 10 without microsoft account".
Since you have gotten to where you are talking about Edge and yahoo email chances are that you have not messed anything up. I suspect that you will find out when you have to re-boot at some point.
As for your question,
QuoteNow i need to find out how to open EDGE with my yahoo.email page like i have it set on the old HD.
I am going to interpret that as saying that what you want is that whenever you open Microsoft Edge you want the first or opening tab to show your Yahoo email page. If my interpretation is correct then try the following steps:
1. Open Edge;
2. Go to the Yahoo email page that you wish to be your start page and copy the page's url address from the address bar at the top of the browser;
2. At the top right hand corner of the browser you should see three dots " ... ". These are for "Settings and more". Click them -- (or you can also just type the "alt and f" keys) -- and then scroll down to and click Settings;
3. Once the Settings screen pops up, on the left side scroll down to and click "Start, home, and new tabs";
4. On the next screen the first option in the middle of the screen will say "When Edge Starts". Choose the "Open these pages" option;
5. Underneath this last option you will see "Pages" on the left and on the right there will be a rectangle with "Add a new page". Click the rectangle;
6. A pop-up will appear; paste in the Yahoo email page url address that you copied in # 2 above and click "Add"; (you may add additional pages if you wish).
That should do it. From that point onward whenever you start Edge the first tab should always be the Yahoo email page that you set. If you set up more pages then they will be in additional tabs.
v_v
V_V thank you so much for those instructions.
I spent the last 2 hours attempting to find those instructions. Every thing i found was wrong instructions.
Already have a glitch. Instead of going to screen saver it sometimes just goes to black screen.
Hi, Ron!
So now you have a new disk, with a fresh Windows system! Congratulations!
v_v and Ron:
Why I wanted Ron to sign in with a Microsoft account when he was about to install Windows:
The disk was new and he was installing the OS from scratch. A Microsoft account would connect the activation number with the account digitally. Let's say that for any reason the new disk failed suddenly. This connection would allow him to install Windows in a new disk without having the activation number. He had it of course, but in case he didn't, that could be a blessing. Otherwise, he would have to buy Windows.
In case he didn't want to continue with the Microsoft account later, he could change it, by creating a local account. Simple.
Thanks DR M
Wow another 2 hours wasted atempting to install the HP printer drivers from factory CD.
Every time i try i allways end up with this.
"HP Lase Jet P2030 series setup interrupted"
"Setup was interrupted before HP Laser printer was completely installed."
Never mind the date on the HP CD is 2008.
Please delete post above.
Looking at the security section to see if every thing was turned on. Found Core Isolation turned off because of Incompatible Drivers.
There are 3 seperat drivers listed under "Memory Integrity- Incompatible drivers" and i don't know what to do?
igdkmd64.sys
Intel corp
Import Date: 3/9/2024
Driver date: 7/9/2015
Driver version: 10.28.10.4252
Published name: oem2.inf
igdkmd64.sys
Intel corp
Device: Intel(R) HD Graphics
Import Date: 5/10/2024
Driver date:4/3/2016
driver version: 10.18.10.4425
published name: oem6.inf
igdkm64.sys
Intel orp
Driver version:10.18.10.4425
Product name: Intel HD Graphics for Windows 8(R)
I don't know how important this is but i dont want to mess it up.
Hi, Ron.
I have exactly the same thing in my Windows 10 computer, so the Core Isolation feature is disabled.
Even when I went to the Intel's site to download the most recent compatible drivers for my system, the result was that there is no supported driver available for my system.
Also, Windows determined that the best drivers for this device are already installed.
So, I left it as is, and I have no problem at all. I would recommend you to do the same.
If someone else from the Forum has a different suggestion, I'm sure they will tell us.
This is something relevant:
https://community.intel.com/t5/Graphics/Windows-10-Pro-21H1-Core-Isolation-issues-with-latest-Intel-HD/td-p/1320322
It seems that the solution is to just leave the Core Isolation feature disabled.
Thanks DR M i will leave that alone.
You are very welcome, Ron.