Unable to install Malwarebytes, or others

jayjayuno · 22 Dec 2017

W10 Pro 64 bit on surface book
Fully updated.
I had a virus optimiser which I managed to get rid of, but still think I am infected.
When an attempt to install Malwarebytes or some other anti virus program, I get the following pop up and it wont install. see attached.

Measures attempted so far
Installed
RKill
Ccleaner
SASpyware
est online scanner Defender offline
adware cleaner
Run sfc/scannow
Allowed Bitdefender through U/C
Turned U/C to minimum.
Turned off W Defender.

What is blocking this?
Who is "an administrator"?
When I click -show information about the publishers certificate, nothing happens.

Am I infected?

[COLOR=inherit !important]

[/COLOR]

Samuria · 22 Dec 2017

Please download MINITOOLBOX and run it.
Downloading MiniToolBox

Checkmark following boxes:

Flush DNS
Reset FF proxy Settings
Reset Ie Proxy Settings
Report IE Proxy Settings
Report FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Installed Programs
List Users, Partitions and Memory size
List Devices (problems only)
Click Go and post the result.

Please download the wireless test tool from

http://www.crewetown.co.uk/wireless.exe

Very important you right click and choose run as admin post results

Please download and save FRST 64bit or FRST 32 bit to your Desktop.

http://download.bleepingcomputer.com/farbar/FRST.exe

http://download.bleepingcomputer.com/farbar/FRST64.exe

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Make sure that Addition option is checked.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back .
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe).

jayjayuno · 22 Dec 2017

MiniToolBox by Farbar Version: 17-06-2016
Ran by PC (administrator) on 22-12-2017 at 14:54:04
Running from "C:\Users\PC\Downloads"
Microsoft Windows 10 Pro (X64)
Model: Surface Book Manufacturer: Microsoft Corporation
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.
Hosts file not detected in the default directory

Hosts file not detected in the default directory
========================= IP Configuration: ================================

Marvell AVASTAR Wireless-AC Network Controller = WiFi (Connected)
Bluetooth Device (Personal Area Network) = Bluetooth Network Connection (Media disconnected)

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global taskoffload=disabled
set interface interface="WiFi" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 2" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Bluetooth Network Connection" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet 2" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet 3" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 1" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 4" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled

popd
# End of IPv4 configuration

Windows IP Configuration

Host Name . . . . . . . . . . . . : TheBook
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : BE-83-85-02-C7-70
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter WiFi:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Marvell AVASTAR Wireless-AC Network Controller
Physical Address. . . . . . . . . : BC-83-85-02-C6-71
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::e8c2:9b79:8529:4ee3%3(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.28(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 22 December 2017 14:49:56
Lease Expires . . . . . . . . . . : 23 December 2017 14:49:56
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 45908869
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-6E-A6-47-BC-83-85-02-C6-71
DNS Servers . . . . . . . . . . . : 82.163.142.8
95.211.158.136
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : BC-83-85-02-C6-72
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Server: UnKnown
Address: 82.163.142.8

Name: google.com
Addresses: 2a00:1450:4009:80f::200e
216.58.207.174

Pinging google.com [216.58.207.174] with 32 bytes of data:
Reply from 216.58.207.174: bytes=32 time=39ms TTL=48
Reply from 216.58.207.174: bytes=32 time=45ms TTL=48

Ping statistics for 216.58.207.174:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 39ms, Maximum = 45ms, Average = 42ms
Server: UnKnown
Address: 82.163.142.8

Name: yahoo.com
Addresses: 2001:4998:44:204::100d
2001:4998:c:e33::53
2001:4998:58:2201::73
98.138.252.38
206.190.39.42
98.139.180.180

Pinging yahoo.com [98.138.252.38] with 32 bytes of data:
Reply from 98.138.252.38: bytes=32 time=197ms TTL=50
Reply from 98.138.252.38: bytes=32 time=130ms TTL=50

Ping statistics for 98.138.252.38:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 130ms, Maximum = 197ms, Average = 163ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
18...be 83 85 02 c7 70 ......Microsoft Wi-Fi Direct Virtual Adapter
3...bc 83 85 02 c6 71 ......Marvell AVASTAR Wireless-AC Network Controller
6...bc 83 85 02 c6 72 ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.28 55
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
192.168.0.0 255.255.255.0 On-link 192.168.0.28 311
192.168.0.28 255.255.255.255 On-link 192.168.0.28 311
192.168.0.255 255.255.255.255 On-link 192.168.0.28 311
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.0.28 311
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.0.28 311
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
3 311 fe80::/64 On-link
3 311 fe80::e8c2:9b79:8529:4ee3/128
On-link
1 331 ff00::/8 On-link
3 311 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [54784] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [63488] (Microsoft Corporation)
Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [24064] (Microsoft Corporation)
Catalog5 07 C:\WINDOWS\SysWOW64\wshbth.dll [50688] (Microsoft Corporation)
Catalog5 08 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 12 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 13 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [67072] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [84992] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [84992] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [79872] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [31232] (Microsoft Corporation)
x64-Catalog5 07 C:\Windows\System32\wshbth.dll [63488] (Microsoft Corporation)
x64-Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 12 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 13 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (12/22/2017 02:37:53 PM) (Source: Application Error) (User: )
Description: Faulting application name: Explorer.EXE, version: 10.0.16299.125, time stamp: 0xfeba44fb
Faulting module name: combase.dll, version: 10.0.16299.15, time stamp: 0x3db461b4
Exception code: 0xc0000005
Fault offset: 0x00000000000231b6
Faulting process ID: 0x1990
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report ID: Explorer.EXE3
Faulting package full name: Explorer.EXE4
Faulting package-relative application ID: Explorer.EXE5

Error: (12/22/2017 12:21:35 PM) (Source: Windows Search Service) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/">.

Error: (12/22/2017 12:12:19 PM) (Source: Windows Search Service) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/">.

Error: (12/22/2017 12:10:53 PM) (Source: Application Error) (User: )
Description: Faulting application name: MicrosoftEdgeCP.exe, version: 11.0.16299.15, time stamp: 0x59cda7cd
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000409
Fault offset: 0x0000000000000041
Faulting process ID: 0x23a4
Faulting application start time: 0xMicrosoftEdgeCP.exe0
Faulting application path: MicrosoftEdgeCP.exe1
Faulting module path: MicrosoftEdgeCP.exe2
Report ID: MicrosoftEdgeCP.exe3
Faulting package full name: MicrosoftEdgeCP.exe4
Faulting package-relative application ID: MicrosoftEdgeCP.exe5

Error: (12/22/2017 12:10:33 PM) (Source: Windows Search Service) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/">.

Error: (12/21/2017 11:04:21 PM) (Source: Application Error) (User: )
Description: Faulting application name: SystemSettings.exe, version: 10.0.16299.15, time stamp: 0x7640753d
Faulting module name: ntdll.dll, version: 10.0.16299.64, time stamp: 0x493793ea
Exception code: 0xc0000005
Fault offset: 0x000000000002db10
Faulting process ID: 0x920
Faulting application start time: 0xSystemSettings.exe0
Faulting application path: SystemSettings.exe1
Faulting module path: SystemSettings.exe2
Report ID: SystemSettings.exe3
Faulting package full name: SystemSettings.exe4
Faulting package-relative application ID: SystemSettings.exe5

Error: (12/21/2017 10:58:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: THEBOOK)
Description: Package Microsoft.Windows.Cortana_1.9.6.16299_neutral_neutral_cw5n1h2txyewy+CortanaUI was terminated because it took too long to suspend.

Error: (12/21/2017 09:28:19 PM) (Source: Application Error) (User: )
Description: Faulting application name: MicrosoftEdgeCP.exe, version: 11.0.16299.15, time stamp: 0x59cda7cd
Faulting module name: edgehtml.dll, version: 11.0.16299.125, time stamp: 0x7718a00b
Exception code: 0xc0000602
Fault offset: 0x00000000006f356f
Faulting process ID: 0x848
Faulting application start time: 0xMicrosoftEdgeCP.exe0
Faulting application path: MicrosoftEdgeCP.exe1
Faulting module path: MicrosoftEdgeCP.exe2
Report ID: MicrosoftEdgeCP.exe3
Faulting package full name: MicrosoftEdgeCP.exe4
Faulting package-relative application ID: MicrosoftEdgeCP.exe5

Error: (12/21/2017 09:19:57 PM) (Source: Application Error) (User: )
Description: Faulting application name: MicrosoftEdgeCP.exe, version: 11.0.16299.15, time stamp: 0x59cda7cd
Faulting module name: edgehtml.dll, version: 11.0.16299.125, time stamp: 0x7718a00b
Exception code: 0xc0000602
Fault offset: 0x00000000006f356f
Faulting process ID: 0x322c
Faulting application start time: 0xMicrosoftEdgeCP.exe0
Faulting application path: MicrosoftEdgeCP.exe1
Faulting module path: MicrosoftEdgeCP.exe2
Report ID: MicrosoftEdgeCP.exe3
Faulting package full name: MicrosoftEdgeCP.exe4
Faulting package-relative application ID: MicrosoftEdgeCP.exe5

Error: (12/21/2017 08:53:35 PM) (Source: Windows Search Service) (User: )
Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/">.

System errors:
=============
Error: (12/22/2017 02:52:38 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)
Description: There was an error while attempting to read the local hosts file.

Error: (12/22/2017 02:52:29 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/22/2017 02:47:29 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/22/2017 02:43:57 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)
Description: There was an error while attempting to read the local hosts file.

Error: (12/22/2017 02:37:28 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)
Description: There was an error while attempting to read the local hosts file.

Error: (12/22/2017 02:36:47 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/22/2017 01:57:39 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/22/2017 01:30:05 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/22/2017 01:04:23 PM) (Source: DCOM) (User: THEBOOK)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}THEBOOKPCS-1-5-21-2133594979-3002416721-123404935-1001LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/22/2017 12:44:17 PM) (Source: Microsoft-Windows-TPM-WMI) (User: NT AUTHORITY)
Description: The Trusted Platform Module (TPM) firmware on this PC has a known security problem. Please contact your PC manufacturer to find out if an update is available. For more information please go to https://go.microsoft.com/fwlink/?linkid=852572

Microsoft Office Sessions:
=========================
Error: (12/22/2017 02:37:53 PM) (Source: Application Error)(User: )
Description: Explorer.EXE10.0.16299.125feba44fbcombase.dll10.0.16299.153db461b4c000000500000000000231b6199001d37b 228fee32a3C:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\combase.dll6fb10d40-4016-477e-b768-023179b8e605

Error: (12/22/2017 12:21:35 PM) (Source: Windows Search Service)(User: )
Description: 300x80040d07iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/

Error: (12/22/2017 12:12:19 PM) (Source: Windows Search Service)(User: )
Description: 300x80040d07iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/

Error: (12/22/2017 12:10:53 PM) (Source: Application Error)(User: )
Description: MicrosoftEdgeCP.exe11.0.16299.1559cda7cdunknown0.0.0.000000000c0000409000000000000004123a401d37b1de2 b25589C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exeunknown00bc7a4a-8775-4728-8672-c67f684eac4dMicrosoft.MicrosoftEdge_41.16299.15.0_neutral__8wekyb3d8bbweContentProcess

Error: (12/22/2017 12:10:33 PM) (Source: Windows Search Service)(User: )
Description: 300x80040d07iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/

Error: (12/21/2017 11:04:21 PM) (Source: Application Error)(User: )
Description: SystemSettings.exe10.0.16299.157640753dntdll.dll10.0.16299.64493793eac0000005000000000002db1092001d3 7aafd16eaf9eC:\Windows\ImmersiveControlPanel\SystemSettings.exeC:\WINDOWS\SYSTEM32\ntdll.dll96cccc77-59e3-4191-87fc-f4bc39b4c10dwindows.immersivecontrolpanel_10.0.1.1000_neutral_neutral_cw5n1h2txyewymicrosoft.windows .immersivecontrolpanel

Error: (12/21/2017 10:58:13 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: THEBOOK)
Description: Microsoft.Windows.Cortana_1.9.6.16299_neutral_neutral_cw5n1h2txyewy+CortanaUI

Error: (12/21/2017 09:28:19 PM) (Source: Application Error)(User: )
Description: MicrosoftEdgeCP.exe11.0.16299.1559cda7cdedgehtml.dll11.0.16299.1257718a00bc000060200000000006f356f84 801d37aa0c234211fC:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exeC:\W INDOWS\SYSTEM32\edgehtml.dll730a6ae2-bc32-40c0-bbe8-77c13eec6c7cMicrosoft.MicrosoftEdge_41.16299.15.0_neutral__8wekyb3d8bbweContentProcess

Error: (12/21/2017 09:19:57 PM) (Source: Application Error)(User: )
Description: MicrosoftEdgeCP.exe11.0.16299.1559cda7cdedgehtml.dll11.0.16299.1257718a00bc000060200000000006f356f32 2c01d37aa0e083aeeeC:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exeC:\ WINDOWS\SYSTEM32\edgehtml.dll9192183d-a775-405a-9f75-8b8dae5da655Microsoft.MicrosoftEdge_41.16299.15.0_neutral__8wekyb3d8bbweContentProcess

Error: (12/21/2017 08:53:35 PM) (Source: Windows Search Service)(User: )
Description: 300x80040d07iehistory://{S-1-5-21-2133594979-3002416721-123404935-1001}/

CodeIntegrity Errors:
===================================
Date: 2017-12-22 14:38:30.457
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:38:30.455
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:38:08.071
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:38:08.068
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:38:06.340
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:38:06.338
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:37:49.109
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:37:49.105
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:37:46.465
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2017-12-22 14:37:46.459
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

=========================== Installed Programs ============================

Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.0 - Adobe Systems Incorporated)
Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 388.08 - NVIDIA Corporation) Hidden
ANT Drivers Installer x64 (HKLM\...\{B9218A36-7AD3-4046-8D77-31F51DC0D795}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Apple Application Support (32-bit) (HKLM-x32\...\{BC7C46A4-D7A7-48EC-A98C-32A7762B5EFA}) (Version: 6.2.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{F0C4B709-8BF4-4A72-B527-12E7BF5482F8}) (Version: 6.2.1 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{19589375-5C58-4AFA-842F-8B34744CCEAD}) (Version: 2.5.0.1 - Apple Inc.)
Blender (HKLM\...\{B1DF3793-1651-4AE5-9CA0-E845DD8B526B}) (Version: 2.79.0 - Blender Foundation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
btda (HKLM\...\Bitdefender Agent) (Version: 21.0.25.59 - Bitdefender)
CCleaner (HKLM\...\CCleaner) (Version: 5.38 - Piriform)
Digital Video Repair 3.4.1.0 (HKLM-x32\...\Digital VideoRepair_is1) (Version: 3.4.1.0 - Rising Research)
Elevated Installer (HKLM-x32\...\{B85F70BE-A5A3-48A2-A790-AF6001F026E0}) (Version: 5.7.1.0 - Garmin Ltd or its subsidiaries) Hidden
FormatFactory 4.2.0.0 (HKLM-x32\...\FormatFactory) (Version: 4.2.0.0 - Free Time)
Garmin Express (HKLM-x32\...\{5b328687-2baf-4fb6-b6c7-c49fb4840cba}) (Version: 5.7.1.0 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM-x32\...\{5F4164CE-621E-4AFD-BBFE-1BBE2299710E}) (Version: 5.7.1.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (HKLM-x32\...\{4E9533AB-7743-4B73-A5D2-42207E159E11}) (Version: 5.7.1.0 - Garmin Ltd or its subsidiaries) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 63.0.3239.84 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
HomeplugAV (HKLM-x32\...\{2DFC446B-8A6E-4EF3-99DF-C89E37DB156D}) (Version: - )
iCloud (HKLM\...\{99868C9C-C141-4DDE-A2C7-9DDF00F68F17}) (Version: 7.2.0.67 - Apple Inc.)
KB4023057 (HKLM\...\{264FDD69-C4DF-476F-B1B8-7DCEE4AF839B}) (Version: 2.4.0.0 - Microsoft Corporation)
M.O.U.S.9 (HKLM\...\{AD988B6E-AD75-4F6A-8ECB-5AA60265F6D7}) (Version: 7.0.55.13 - Mad Catz Inc)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.8730.2127 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.7131.1115 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
NVIDIA Graphics Driver 388.08 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 388.08 - NVIDIA Corporation)
NVIDIA Update 29.1.0.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 29.1.0.0 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8730.2127 - Microsoft Corporation) Hidden
Quicken 2002 Deluxe & Business (HKLM-x32\...\Quicken 2002 Deluxe & Business) (Version: - )
QuickTime (HKLM-x32\...\{C78EAC6F-7A73-452E-8134-DBB2165C5A68}) (Version: 7.62.14.0 - Apple Inc.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1250 - SUPERAntiSpyware.com)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden
Windows Driver Package - Apple Inc. Apple ODD (05/17/2010 3.1.0.0) (HKLM\...\D6B4CB6AD2F81752C2EF8DCF6AD5EBC567ADD45C) (Version: 05/17/2010 3.1.0.0 - Apple Inc.)
Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

========================= Devices: ================================

Name: SASKUTIL
Description: SASKUTIL
Class Guid: {8ecc055d-047f-11d1-a537-0000f8753ed1}
Manufacturer:
Service: SASKUTIL
Device ID: ROOT\LEGACY_SASKUTIL\0000
Problem: : Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)
Resolution: Reasons for this error include a driver that is not present; a binary file that is corrupt; a file I/O problem, or a driver that references an entry point in another binary file that could not be loaded.
Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.

Name: SASDIFSV
Description: SASDIFSV
Class Guid: {8ecc055d-047f-11d1-a537-0000f8753ed1}
Manufacturer:
Service: SASDIFSV
Device ID: ROOT\LEGACY_SASDIFSV\0000
Problem: : Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)
Resolution: Reasons for this error include a driver that is not present; a binary file that is corrupt; a file I/O problem, or a driver that references an entry point in another binary file that could not be loaded.
Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.

========================= Memory info: ===================================

Percentage of memory in use: 27%
Total physical RAM: 16310.11 MB
Available physical RAM: 11778.35 MB
Total Virtual: 18742.11 MB
Available Virtual: 13737.24 MB

========================= Partitions: =====================================

1 Drive c: (Local Disk) (Fixed) (Total:475.56 GB) (Free:344.55 GB) NTFS

========================= Users: ========================================

User accounts for \\THEBOOK

Administrator DefaultAccount defaultuser0
Guest PC WDAGUtilityAccount

========================= Minidump Files ==================================

No minidump file found

**** End of log ****

jayjayuno · 22 Dec 2017

Windows IP Configuration

Host Name . . . . . . . . . . . . : TheBook
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : BE-83-85-02-C7-70
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter WiFi:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Marvell AVASTAR Wireless-AC Network Controller
Physical Address. . . . . . . . . : BC-83-85-02-C6-71
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::e8c2:9b79:8529:4ee3%3(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.28(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 22 December 2017 14:49:56
Lease Expires . . . . . . . . . . : 23 December 2017 14:49:55
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 45908869
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-6E-A6-47-BC-83-85-02-C6-71
DNS Servers . . . . . . . . . . . : 82.163.142.8
95.211.158.136
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : BC-83-85-02-C6-72
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Interface name : WiFi
There are 1 networks currently visible.

SSID 1 : VM7268067
Network type : Infrastructure
Authentication : WPA2-Personal
Encryption : CCMP
BSSID 1 : c0:05:c2:37:16:e1
Signal : 70%
Radio type : 802.11n
Channel : 13
Basic rates (Mbps) : 1 2 5.5 11
Other rates (Mbps) : 6 9 12 18 24 36 48 54

Profiles on interface WiFi:

Group policy profiles (read only)
---------------------------------
<None>

User profiles
-------------
All User Profile : Peyrot
All User Profile : VM7268067
All User Profile : Solwise_57A5
All User Profile : AztechHL117_8EB1
All User Profile : Solwise_newish
All User Profile : Solwise_new
All User Profile : BTWifi-with-FON
All User Profile : BTHub4-8Z97
All User Profile : Solwise_5156
All User Profile : TP-LINK_CCD8A4
All User Profile : Arcadia2
Current User Profile : Chandos Free Wifi

Pinging 194.119.131.66 with 32 bytes of data:
Reply from 194.119.131.66: bytes=32 time=41ms TTL=55
Reply from 194.119.131.66: bytes=32 time=119ms TTL=55
Reply from 194.119.131.66: bytes=32 time=35ms TTL=55
Reply from 194.119.131.66: bytes=32 time=157ms TTL=55

Ping statistics for 194.119.131.66:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 35ms, Maximum = 157ms, Average = 88ms

Pinging plus.net [212.159.8.2] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 212.159.8.2:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Tracing route to cns1.uk.vianw.net [194.119.131.66]
over a maximum of 30 hops:

1 4 ms 6 ms 4 ms 192.168.0.1
2 54 ms 15 ms 19 ms 10.160.148.1
3 22 ms 16 ms 14 ms 129.228-252-62.static.virginmediabusiness.co.uk [62.252.228.129]
4 * * * Request timed out.
5 * *

jayjayuno · 22 Dec 2017

Downloaded and ran the program but the creation and saving of the text file is blocked although I have allowed notepad.exe and FRST64.exe through Defender

jayjayuno · 22 Dec 2017

By turning off Defender I got it to work

jayjayuno · 24 Dec 2017

Any ideas. I’m reluctant to use this computer online in case it’s infected?

TairikuOkami · 24 Dec 2017

Run this as admin, if you can not, run it in safe mode, then restart. Windows will download new certificates.

Code:

takeown /f "%WINDIR%\System32\catroot2" /a
icacls "%WINDIR%\System32\catroot2" /grant:r Administrators:F /c
ren "%WINDIR%\System32\catroot2" "catroot2.bak"

Samuria · 24 Dec 2017

You have a lot of Windows errors and scans show a tpm error advises contacting OEM. You have every av software certificate disallowed which is blocking your installs. Due to Windows errors I would do a refresh install with no data loss and remove all disallowed from the registry all document in frst.txt I am mobile and on phone

jayjayuno · 24 Dec 2017

Thank you both for your help.
I am in the wilds of the N Cornish coast with a weak intermittent internet service so I think I’ll wait till I’m somewhere with better access.
Wishing you happy days over the holidays

Unable to install Malwarebytes, or others

Unable to install Malwarebytes, or others

MTB results

reg txt

FRST64 fails

FRST64 results