Windows has encountered a critical error will restart in one minute

Inactive
By againstheman
Aug 17, 2012
  1. againstheman

    againstheman Newcomer, in training Topic Starter

    Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 15-08-2012
    Ran by SYSTEM at 29-08-2012 18:55:52
    Running from F:\
    Windows 7 Starter (X86) OS Language: English(US)
    The current controlset is ControlSet001

    ========================== Registry (Whitelisted) =============

    HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-11-05] (Synaptics Incorporated)
    HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [7866912 2009-11-17] (Realtek Semiconductor)
    HKLM\...\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4562944 2009-07-16] (Dell Inc.)
    HKLM\...\Run: [BTMeter] C:\Program Files\Battery Meter\BTMeter.exe [632176 2009-09-16] (Dell)
    HKLM\...\Run: [WSED] C:\Program Files\WSED\WSED.exe [247080 2009-05-27] (Dell)
    HKLM\...\Run: [CapsLKNotify] C:\Program Files\CapsLKNotify\CapsLKNotify.exe [320880 2009-06-09] (Compal Electronics, Inc)
    HKLM\...\Run: [Dell DataSafe Online] "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m [1779952 2009-09-11] ()
    HKLM\...\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter [206064 2009-06-03] (SupportSoft, Inc.)
    HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [31016 2006-10-26] (Microsoft Corporation)
    HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [141608 2010-07-21] (Apple Inc.)
    HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2010-08-10] (Apple Inc.)
    HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [141848 2010-10-25] (Intel Corporation)
    HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [173592 2010-10-25] (Intel Corporation)
    HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [150552 2010-10-25] (Intel Corporation)
    HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
    HKU\Aileen\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
    HKU\Aileen\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [15141768 2011-06-15] (Skype Technologies S.A.)
    HKU\Default\...\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe [1173504 2009-07-13] (Microsoft Corporation)
    HKU\Default User\...\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe [1173504 2009-07-13] (Microsoft Corporation)
    HKU\Guest\...\Run: [Diagnostics] rundll32.exe "C:\Users\Guest\AppData\Local\Google\Diagnostics\golrjkntt.dll",CreateInstance [x]
    HKU\Guest\...\Run: [Facebook Update] "C:\Users\Guest\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-08-05] (Facebook Inc.)
    Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
    Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
    Startup: C:\Users\Aileen\Start Menu\Programs\Startup\Dell Dock.lnk
    ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Aileen\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
    ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
    Startup: C:\Users\Default\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Guest\Start Menu\Programs\Startup\Dell Dock.lnk
    ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Guest\Start Menu\Programs\Startup\Facebook Messenger.lnk
    ShortcutTarget: Facebook Messenger.lnk -> (No File)

    ================================ Services (Whitelisted) ==================

    2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation)
    2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)
    2 sprtsvc_DellSupportCenter; "C:\Program Files\Dell Support Center\bin\sprtsvc.exe" /service /P DellSupportCenter [201968 2009-06-03] (SupportSoft, Inc.)
    2 wltrysvc; "C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE" "C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe" [3086848 2009-07-16] (Dell Inc.)

    ========================== Drivers (Whitelisted) =============

    3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2009-07-16] (Broadcom Corporation)
    0 EMSC; C:\Windows\System32\DRIVERS\EMSC.SYS [13680 2009-06-26] (Windows (R) Win 7 DDK provider)
    3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-08] (Microsoft Corporation)
    0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-06-17] (Duplex Secure Ltd.)
    3 catchme; \??\C:\Users\Aileen\AppData\Local\Temp\catchme.sys [x]
    3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]

    ========================== NetSvcs (Whitelisted) ===========


    ============ One Month Created Files and Folders ==============

    2012-08-26 01:12 - 2012-08-26 01:13 - 00145608 ____A C:\Windows\Minidump\082612-68266-01.dmp
    2012-08-26 01:10 - 2012-08-26 01:10 - 00000000 ____D C:\Program Files\ESET
    2012-08-25 00:25 - 2012-08-25 00:25 - 00145608 ____A C:\Windows\Minidump\082512-33321-01.dmp
    2012-08-24 14:08 - 2012-08-26 10:45 - 00000000 ____D C:\Users\Aileen\Desktop\fix
    2012-08-23 23:39 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe
    2012-08-23 23:39 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe
    2012-08-23 23:39 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
    2012-08-23 23:39 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
    2012-08-23 23:39 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
    2012-08-23 23:39 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe
    2012-08-23 23:39 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe
    2012-08-23 23:39 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe
    2012-08-23 23:38 - 2012-08-24 03:45 - 00000000 ____D C:\Windows\erdnt
    2012-08-23 19:19 - 2012-08-23 19:19 - 00000000 ____D C:\Users\Guest\Documents\Dell WebCam Central
    2012-08-23 19:19 - 2012-08-23 19:19 - 00000000 ____D C:\Users\Guest\AppData\Roaming\Creative
    2012-08-22 14:47 - 2009-04-02 17:18 - 735784960 ____A C:\Users\Guest\Desktop\I Am Legend.avi
    2012-08-20 18:49 - 2012-08-24 15:02 - 00000000 ____D C:\Qoobox
    2012-08-20 15:28 - 2012-08-20 15:28 - 00000000 ____D C:\Users\Guest\AppData\Local\Apple
    2012-08-17 05:16 - 2012-08-17 05:17 - 00000000 ____D C:\FRST
    2012-08-17 02:35 - 2012-08-21 13:50 - 00000000 ____D C:\Program Files\Microsoft Security Client
    2012-08-17 01:33 - 2012-08-17 01:33 - 00000020 ____A C:\Windows\$ö
    2012-08-16 16:22 - 2012-06-18 05:10 - 62269166 ____A C:\Users\Guest\Desktop\102_1525.MOV
    2012-08-13 15:56 - 2012-08-13 15:56 - 00000000 ____D C:\Windows\Sun
    2012-08-12 11:43 - 2011-11-17 20:51 - 00239877 ____A C:\Users\Aileen\Desktop\spanish guy project.pptx
    2012-08-12 11:43 - 2011-11-16 08:45 - 07642112 ____A C:\Users\Aileen\Desktop\Presentation2.ppt
    2012-08-11 16:49 - 2012-08-11 16:49 - 00145608 ____A C:\Windows\Minidump\081112-30466-01.dmp
    2012-08-11 14:41 - 2012-08-11 14:41 - 00145608 ____A C:\Windows\Minidump\081112-28282-01.dmp
    2012-08-06 17:25 - 2012-08-06 17:25 - 00145608 ____A C:\Windows\Minidump\080612-34788-01.dmp
    2012-08-05 22:29 - 2012-08-05 22:29 - 00501248 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookVideoCallSetup_v1.2.205.0 (2).exe
    2012-08-05 22:25 - 2012-08-05 22:26 - 00501248 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookVideoCallSetup_v1.2.205.0 (1).exe
    2012-08-05 22:16 - 2012-08-05 22:17 - 00501248 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
    2012-08-05 18:03 - 2012-08-26 01:12 - 251092590 ____A C:\Windows\MEMORY.DMP
    2012-08-05 18:03 - 2012-08-26 01:12 - 00000000 ____D C:\Windows\Minidump
    2012-08-05 18:03 - 2012-08-05 18:03 - 00145616 ____A C:\Windows\Minidump\080512-30888-01.dmp
    2012-08-01 10:22 - 2012-08-05 22:32 - 00000000 ____D C:\Users\Guest\AppData\Local\Facebook
    2012-08-01 10:22 - 2012-08-01 10:22 - 00501240 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookMessengerSetup_v1.2.205.0.exe


    ============ 3 Months Modified Files ========================

    2012-08-29 15:21 - 2011-06-30 16:19 - 00000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2012-08-29 13:24 - 2011-06-30 16:19 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2012-08-29 13:24 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
    2012-08-29 13:22 - 2009-07-13 20:53 - 00032642 ____A C:\Windows\Tasks\SCHEDLGU.TXT
    2012-08-29 13:05 - 2009-07-13 20:34 - 00010272 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2012-08-29 13:05 - 2009-07-13 20:34 - 00010272 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2012-08-29 13:01 - 2009-07-13 20:55 - 01349702 ____A C:\Windows\WindowsUpdate.log
    2012-08-29 12:57 - 2010-12-25 14:30 - 00016384 _____ C:\Windows\System32\Ikeext.etl
    2012-08-29 12:57 - 2009-07-13 20:39 - 00133543 ____A C:\Windows\setupact.log
    2012-08-26 19:53 - 2010-01-20 19:12 - 00726142 ____A C:\Windows\System32\PerfStringBackup.INI
    2012-08-26 01:13 - 2012-08-26 01:12 - 00145608 ____A C:\Windows\Minidump\082612-68266-01.dmp
    2012-08-26 01:12 - 2012-08-05 18:03 - 251092590 ____A C:\Windows\MEMORY.DMP
    2012-08-25 00:25 - 2012-08-25 00:25 - 00145608 ____A C:\Windows\Minidump\082512-33321-01.dmp
    2012-08-24 19:58 - 2010-01-20 20:54 - 00498102 ____A C:\Windows\PFRO.log
    2012-08-24 14:43 - 2009-07-13 18:04 - 00000215 ____A C:\Windows\system.ini
    2012-08-17 01:33 - 2012-08-17 01:33 - 00000020 ____A C:\Windows\$ö
    2012-08-11 16:49 - 2012-08-11 16:49 - 00145608 ____A C:\Windows\Minidump\081112-30466-01.dmp
    2012-08-11 14:41 - 2012-08-11 14:41 - 00145608 ____A C:\Windows\Minidump\081112-28282-01.dmp
    2012-08-06 17:25 - 2012-08-06 17:25 - 00145608 ____A C:\Windows\Minidump\080612-34788-01.dmp
    2012-08-05 22:29 - 2012-08-05 22:29 - 00501248 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookVideoCallSetup_v1.2.205.0 (2).exe
    2012-08-05 22:26 - 2012-08-05 22:25 - 00501248 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookVideoCallSetup_v1.2.205.0 (1).exe
    2012-08-05 22:17 - 2012-08-05 22:16 - 00501248 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
    2012-08-05 18:03 - 2012-08-05 18:03 - 00145616 ____A C:\Windows\Minidump\080512-30888-01.dmp
    2012-08-01 10:22 - 2012-08-01 10:22 - 00501240 ____A (Facebook Inc.) C:\Users\Guest\Downloads\FacebookMessengerSetup_v1.2.205.0.exe
    2012-07-12 15:47 - 2009-07-13 20:33 - 00413832 ____A C:\Windows\System32\FNTCACHE.DAT
    2012-06-29 19:05 - 2012-06-29 19:05 - 00097194 ____A C:\Users\Guest\Downloads\Unconfirmed 49300.crdownload
    2012-06-26 21:20 - 2012-06-26 21:20 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
    2012-06-26 21:20 - 2012-06-26 21:20 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
    2012-06-18 05:10 - 2012-08-16 16:22 - 62269166 ____A C:\Users\Guest\Desktop\102_1525.MOV
    2012-06-11 18:44 - 2012-07-12 10:46 - 02344448 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
    2012-06-08 20:46 - 2012-07-11 12:14 - 12868608 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
    2012-06-05 21:09 - 2012-07-11 12:15 - 01389568 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
    2012-06-05 21:09 - 2012-07-11 12:15 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
    2012-06-02 14:19 - 2012-06-08 15:10 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
    2012-06-02 14:19 - 2012-06-08 15:10 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
    2012-06-02 14:19 - 2012-06-08 15:10 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
    2012-06-02 14:19 - 2012-06-08 15:09 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
    2012-06-02 14:19 - 2012-06-08 15:09 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
    2012-06-02 14:19 - 2012-06-08 15:09 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
    2012-06-02 14:12 - 2012-06-08 15:10 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
    2012-06-02 14:12 - 2012-06-08 15:09 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
    2012-06-02 14:12 - 2012-06-08 15:09 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
    2012-06-01 20:51 - 2012-07-11 12:15 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
    2012-06-01 20:51 - 2012-07-11 12:15 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
    2012-06-01 20:50 - 2012-07-11 12:15 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
    2012-06-01 20:48 - 2012-07-11 12:15 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
    2012-06-01 20:47 - 2012-07-11 12:15 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll


    ========================= Known DLLs (Whitelisted) ============


    ========================= Bamital & volsnap Check ============

    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    ==================== EXE ASSOCIATION =====================

    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK

    ========================= Memory info ======================

    Percentage of memory in use: 39%
    Total physical RAM: 1013.34 MB
    Available physical RAM: 613.38 MB
    Total Pagefile: 1013.34 MB
    Available Pagefile: 612.2 MB
    Total Virtual: 2047.88 MB
    Available Virtual: 1977.62 MB

    ======================= Partitions =========================

    1 Drive c: (OS) (Fixed) (Total:134.36 GB) (Free:68.05 GB) NTFS
    3 Drive f: (DRIVER) (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32
    4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
    5 Drive y: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:10.98 GB) NTFS ==>[System with boot components (obtained from reading drive)]

    Disk ### Status Size Free Dyn Gpt
    -------- ------------- ------- ------- --- ---
    Disk 0 Online 149 GB 0 B
    Disk 1 No Media 0 B 0 B
    Disk 2 Online 7648 MB 0 B

    Partitions of Disk 0:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 OEM 39 MB 31 KB
    Partition 2 Primary 14 GB 40 MB
    Partition 3 Primary 134 GB 14 GB

    ==================================================================================

    Disk: 0
    Partition 1
    Type : DE
    Hidden: Yes
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 4 FAT Partition 39 MB Healthy Hidden

    ==================================================================================

    Disk: 0
    Partition 2
    Type : 07
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 0 Y RECOVERY NTFS Partition 14 GB Healthy

    ==================================================================================

    Disk: 0
    Partition 3
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 C OS NTFS Partition 134 GB Healthy

    ==================================================================================

    Partitions of Disk 2:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 7646 MB 1096 KB

    ==================================================================================

    Disk: 2
    Partition 1
    Type : 0B
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 3 F DRIVER FAT32 Removable 7646 MB Healthy

    ==================================================================================

    Last Boot: 2012-08-19 20:04

    ======================= End Of Log ==========================
  2. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    FRST Fixlist

    Please run the following:

    Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt

    NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

    Now, please enter System Recovery Options then select Command Prompt.

    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

    Now restart, let it boot normally and tell me how it went.
  3. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello. Are you still with us?

    Your thread has been marked as "Inactive" because of your lack of reply. Please let us know how your computer is running, or if you want to continue in this topic.

    Thanks.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.