DRM Posted January 12, 2019 Report Share Posted January 12, 2019 My HP Pavillion dv7-7135us has been freezing up lately with no warning and no visible symptoms other than I return to it after a few hours and find it frozen. The only remedy is to power down. EEK and FRST files are attached. I tried to scrupulously follow the instructions. EEK did not display the same choices as the instructions, but I tried to get a clean scan, without changing any parameters after the sw updated itself. FRST showed no anomalies on operation. Addition.txt FRST.txt a2scan_190112-100254.txt Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted January 12, 2019 Report Share Posted January 12, 2019 DRM, Please update EEK. The scan report indicates that no update was conducted. Therefore the scan results are not reliable. Once EEK is finished updating, run a Malware Scan. Attach the new EEK scan report to your reply. Link to comment Share on other sites More sharing options...
DRM Posted January 13, 2019 Author Report Share Posted January 13, 2019 Thank you, Mr. Zoll. Ran it just now. EEK said it was updated, and I ran the Malware scan, per the instructions. It did not offer me the chance to make sure PUPs was checked. Results attached. It only found one infection, versus 4 or 5 last time. scan_190112-203042.txt Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted January 15, 2019 Report Share Posted January 15, 2019 Please run FRST again. Next, select and copy the following text, including the words Start:: and End::. Switch back to the FRST program window, and click the Fix button. It should read the fix directly from the clipboard and run the fix. When it is finished, please attach the fixlog.txt file it created in the same folder the FRST program is in. Start::HKU\S-1-5-21-1123327017-3724100226-3295280940-1000\...\Policies\Explorer: [NoInstrumentation] 1HKU\S-1-5-21-1123327017-3724100226-3295280940-1000\...\MountPoints2: I - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\Start.exeHKU\S-1-5-21-1123327017-3724100226-3295280940-1000\...\MountPoints2: {5b03cb5c-ae5c-11e4-af8e-c01885cc0f7f} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL H:\start.exeHKU\S-1-5-21-1123327017-3724100226-3295280940-1000\...\MountPoints2: {6ded3725-323e-11e6-bb75-c01885cc0f7f} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\Start.exeHKU\S-1-5-21-1123327017-3724100226-3295280940-1000\...\MountPoints2: {a519621e-3286-11e7-820a-c01885cc0f7f} - G:\VZW_Software_upgrade_assistant.exeHKU\S-1-5-21-1123327017-3724100226-3295280940-1000\...\MountPoints2: {ba1faa53-06a5-11e2-be8f-c01885cc0f7f} - G:\HPLauncher.exeHKU\S-1-5-18\...\Run: [] => [X]HKLM\Software\Microsoft\Active Setup\Installed Components: [{0CE7EBAF-157D-4111-9146-057CB2A4023E}] -> msiexec /fu {0CE7EBAF-157D-4111-9146-057CB2A4023E} /qnHKLM\Software\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCacheHKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\71.0.3578.98\Installer\chrmstp.exe [2018-12-17] (Google Inc.)HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{A6EADE66-0000-0000-484E-7E8A45000000}] -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll [2017-07-31] (Adobe Systems, Inc.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PGP Tray.lnk [2016-08-07]ShortcutTarget: PGP Tray.lnk -> C:\Windows\Installer\{84D84040-8C77-4B32-A7B6-92F1F88D3B3B}\Icon6560581611.exe ()2018-12-28 17:26 - 2018-12-28 17:26 - 000003114 _____ C:\Windows\System32\Tasks\{A30A61FF-E252-49D0-8ACA-1D8086150B9E}2018-12-28 13:45 - 2018-12-28 13:45 - 000003102 _____ C:\Windows\System32\Tasks\{00306B02-D1C4-4B16-B483-BA31EBEAF2F1}2018-12-28 13:37 - 2018-12-28 13:37 - 000003108 _____ C:\Windows\System32\Tasks\{0491D538-B6FE-4683-B048-F812CDAE3DC4}2018-09-14 12:40 - 2018-09-14 12:40 - 000000720 _____ () C:\Program Files (x86)\LMIR0B9B8001.tmp.bat2018-09-14 12:40 - 2018-09-14 12:40 - 000000526 _____ () C:\Program Files (x86)\LMIR0B9B8001.tmp_r.bat2018-11-24 06:51 - 2018-11-24 06:51 - 000000000 _____ () C:\Users\DRM\AppData\Local\{98587E56-985E-46CF-82B8-DDDF9C6B94E8}ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => -> No FileShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => -> No FileShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => -> No FileShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => -> No FileShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => -> No FileShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => -> No FileShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => -> No FileShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => -> No FileContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} => -> No FileContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No FileContextMenuHandlers6-x32: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No FileTask: {09BE4BB7-394F-479E-A3A4-902A4F44F44C} - System32\Tasks\{E9AFDA6E-B3A2-4DDF-8E56-53978467B859} => C:\Windows\system32\pcalua.exe -a "H:\Stash\FolderMatch\FM 350\fm350install.exe" -d "H:\Stash\FolderMatch\FM 350"Task: {0AEBF5A9-B82C-4374-9EDA-B4E71BF01C3B} - System32\Tasks\{95BF6270-E7DE-4EEE-A27E-31A50C4743EE} => C:\Windows\system32\pcalua.exe -a "G:\Data\Stash\World Watch\DLM.exe" -d "G:\Data\Stash\World Watch"Task: {1F6C55CC-292A-4548-9823-3B06AC9C02B5} - System32\Tasks\{22EE1DC6-9FFE-4259-9A3C-245D5FBB124B} => C:\Windows\system32\pcalua.exe -a "C:\Users\DRM\Downloads\stamps 10-51.exe" -d C:\Users\DRM\DownloadsTask: {32484615-30DC-431F-91E1-9EB7575E3C71} - System32\Tasks\{4A64DE69-1749-46B0-BD91-C217E5D23405} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\710_b042_multilanguage.exe -d C:\Users\DRM\DownloadsTask: {3A777C95-9614-4E82-9268-6B1725483665} - \MasterSeeker.UACBypass.7008f6f52001de362d701fb79e152fd8 -> No File <==== ATTENTIONTask: {6C432C4A-C706-4EB9-BD8E-27B780C4CAE4} - System32\Tasks\{FA96948C-6F72-4B82-A7E1-BDF4028F1B2C} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\ofw2016(3).exe -d C:\Users\DRM\DownloadsTask: {6F9ECA70-1EF1-45A1-8452-D5A9AC53A462} - System32\Tasks\{4C74F201-EB35-48B7-92C2-DB0BAF85AEB4} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\stamps12.exe -d C:\Users\DRM\DownloadsTask: {71175137-7BCE-4B22-ABF9-6120E20E7576} - System32\Tasks\{F85F9BE1-9785-415C-8761-B4BF5179F5AD} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\FirmwareFlashLauncher.exe -d C:\Users\DRM\DownloadsTask: {7966246B-4E1B-4625-A95C-7D07357F999F} - \UpSafe GMail Backup Task -> No File <==== ATTENTIONTask: {A25E4654-91E0-4D3B-B55D-4290E54594E4} - System32\Tasks\{0491D538-B6FE-4683-B048-F812CDAE3DC4} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\setup(5).exe -d C:\Users\DRM\DownloadsTask: {A4A25CF7-F44E-4104-9A49-0EFAAB5C1CDA} - System32\Tasks\{84209F6C-5701-404B-AC6A-9AC29266811F} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\TransActATSetup(2).exe -d C:\Users\DRM\DownloadsTask: {A9F9A083-ED4C-42DB-B678-2572DDADDEC9} - System32\Tasks\{8ACFB76E-8372-4A37-B213-25C9BCF79787} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\setup.exe -d C:\Users\DRM\DownloadsTask: {AA6F9A77-B5DD-4CF5-B4C3-44D0B7F28DF3} - System32\Tasks\{00306B02-D1C4-4B16-B483-BA31EBEAF2F1} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\setup.exe -d C:\Users\DRM\DownloadsTask: {D625B35E-6DF5-40F7-9D71-CB8455E8212C} - System32\Tasks\{765068BF-9068-4267-8F64-E31E58FAE1EA} => C:\Windows\system32\pcalua.exe -a "C:\Users\DRM\Downloads\PrintEco Setup 3-4-14.exe" -d C:\Users\DRM\DownloadsTask: {F70DED97-2305-4AD0-BCF5-81FE9D049992} - System32\Tasks\{9A95A630-5CE9-4E6D-8F2E-4941A85B0C31} => C:\Windows\system32\pcalua.exe -a C:\Users\DRM\Downloads\stamps.exe -d C:\Users\DRM\DownloadsTask: {F9E72B72-2C00-4386-B664-690AFBA1B28B} - System32\Tasks\{A30A61FF-E252-49D0-8ACA-1D8086150B9E} => C:\Windows\system32\pcalua.exe -a "C:\Users\DRM\Downloads\setup (1).exe" -d C:\Users\DRM\DownloadsAlternateDataStreams: C:\Windows:nlsPreferences [642]AlternateDataStreams: C:\ProgramData\TEMP:58A5270D [442]AlternateDataStreams: C:\ProgramData\TEMP:AEC0AC81 [248]AlternateDataStreams: C:\ProgramData\TEMP:B801D4E2 [256]AlternateDataStreams: C:\ProgramData\TEMP:FD9CE1F3 [242]End:: Link to comment Share on other sites More sharing options...
DRM Posted January 15, 2019 Author Report Share Posted January 15, 2019 Mr. Zoll, Done. File is attached. DRM Fixlog.txt Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted January 16, 2019 Report Share Posted January 16, 2019 Run a fresh scan with FRST, make sure that Addtions.txt is selected. Attach the new FRSTscan reports to your reply. Link to comment Share on other sites More sharing options...
DRM Posted January 16, 2019 Author Report Share Posted January 16, 2019 Done again. File attached. Addition.txt Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted January 16, 2019 Report Share Posted January 16, 2019 The Additons.txt looks fine. Can I get the FRST.txt report as well? Link to comment Share on other sites More sharing options...
DRM Posted January 16, 2019 Author Report Share Posted January 16, 2019 Ask, and ye shall receive . scan_190115-173642.txt Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted January 16, 2019 Report Share Posted January 16, 2019 Your logs look fine. How are things running? Link to comment Share on other sites More sharing options...
DRM Posted January 16, 2019 Author Report Share Posted January 16, 2019 It froze yesterday, and I rebooted it this morning (I left it frozen overnight), but it seems better today. Did you find anything that could be related to my freezing problem? Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted January 17, 2019 Report Share Posted January 17, 2019 As far as I can tell from looking at the Events log in the Additions.txt, it appears to be your display drivers that are at fault. Update the drivers for your graphics card. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted January 22, 2019 Report Share Posted January 22, 2019 Thread Closed Reason: Lack of Response PM either Kevin, Elise, or Arthur to have this thread reopened. The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on a system, other than the one they were written for, could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE if you don't we are just going to send you back to this thread Link to comment Share on other sites More sharing options...
Recommended Posts