# Solved: Restore is freezing up during installation



## WyteNyte (May 22, 2014)

I am working on my sisters Gateway NV53 series laptop. I have done the full restore multiple times and it always hangs up at Installing Microsoft Office 2010 (17/24 applications being loaded). I can go ahead and bring up Task Manager and stop the ALaunchx to get out of it, but the next time I reboot it goes right back to this spot. I even let it run overnight so that I could be sure it wasnt just running slow. Is there anything I can do? It is running Windows 7 Home Premium.


----------



## etaf (Oct 2, 2003)

> full restore multiple times


 and the full restore works all OK , apart from the office 2010
and when you restore , your are restoring to a point in time before office 2010 was installed on that PC

is that correct?


----------



## WyteNyte (May 22, 2014)

I am doing a full restore to factory defaults so I have had it erase all data on HDD. It is like new setup. I installed 121 windows updates and when it reboots it still comes back to this point (17/24 applications installed) and hangs up.


----------



## WyteNyte (May 22, 2014)

I am working on my sisters Gateway NV53 series laptop. I have done the full restore multiple times and it always hangs up at Installing

Microsoft Office

(17/24 applications being loaded). I can go ahead and bring up Task Manager and stop the ALaunchx to get out of it, but the next time I reboot it goes right back to this spot. I even let it run overnight so that I could be sure it wasnt just running slow. Is there anything I can do? It is running Windows 7 Home Premium.

*< Edited to remove the non-working HTML codes - ETAF>*


----------



## etaf (Oct 2, 2003)

Is that the correct message , 
as i have edited out all the HTML tag codes - as they were not working and made the post unreadable

thanks

i have also moved to windows 7 forum, but we can move to business application forum if a ms office issue


----------



## Lance1 (Aug 4, 2003)

Hit Windows key + R Type *msconfig* Go to the startup tab and uncheck *aLaunchx* Reboot the system. That will stop it from initializing on startup.


----------



## etaf (Oct 2, 2003)

does it work OK before the updates ?


----------



## WyteNyte (May 22, 2014)

No, it didnt work before the updates. The sequence was:

1) she downloaded something that caused it to stop booting up period; I presume it was a virus of somekind;
2) Rather than fighting the virus I opted to just do a Recovery / Restore;
3) Performed the restore and it runs fine up to the point where it is loading the applications, it gets to installing Microsoft Office 2010 (17/24 completed) and just sits there;
4) I tried to address the issue by downloading all the windows updates; (I had to access task manager to shutdown the ALaunchX program which was running the install, then updated windows)
5) System reboots and completes all updates then returns to "Installing Software" and goes to where it left off, Installing Office 2010 (17/24) and just sits there. Appears to be installing but never advances.

Question: Is there anyway to get around the software installation portion of the program; is there a registry location where I can tell the system this is not "first Use" so that it doesnt return to installing applications? If I do this will I be able to install the apps I dont have yet from the protected partition?

Thank you everyone, for any help you can provide.


----------



## etaf (Oct 2, 2003)

> 2) Rather than fighting the virus I opted to just do a Recovery / Restore;


 these are two different things - which did you do? 
one takes the PC back to a previous date - Restore
the other often is used to return the PC back to its factory condition - Recovery


----------



## WyteNyte (May 22, 2014)

Thanks Lance, I tried doing this and when the system reboots it just turns it back on. When I went ahead and tried disabling everything under the startup tab and rebooted, I found that everything remained unchecked HOWEVER a new instance of ALaunchX now appeared and was checked. What can I try next? Also, if I format the hard drive will I lose the protected portion which contains the Windows 7 OS??


----------



## WyteNyte (May 22, 2014)

Sorry that I confused you, when i typed in restore / recovery I only meant to indicate which program I was using, I am performing a full factory restore (back to factory default settings)

Thanks


----------



## WyteNyte (May 22, 2014)

I am doing a full recovery to factory default.


----------



## etaf (Oct 2, 2003)

i would do it again and a full format of the harddrive 
make sure you update the drivers 
chipset would be first 
Make sure it works OK
then the windows updates
make sure it works OK 
then install any additional programs ,like office


----------



## Lance1 (Aug 4, 2003)

WyteNyte said:


> Thanks Lance, I tried doing this and when the system reboots it just turns it back on. When I went ahead and tried disabling everything under the startup tab and rebooted, I found that everything remained unchecked HOWEVER a new instance of ALaunchX now appeared and was checked. What can I try next? Also, *if I format the hard drive will I lose the protected portion which contains the Windows 7 OS??*


If ALaunch.exe is initializing itself, which it should not, I suspect a possible infection. I sent a PM to one of the Malware specialists here. Please do not do anything more till he responds.

To respects of the format, if you load another OS outside of the recovery partition, you will lose access the recovery partition and you will not be able to bring the system back to factory default from it.


----------



## WyteNyte (May 22, 2014)

I performed a full reformat of the HDD, then installed Windows 7 from the computer's OS Partition. Unfortunately, since the Office 2010 application is part of the install it freezes still and there seems to be nothing I can do, I have tried running msconfig and turning the ALaunchX program (which is installing the software) and the OOTag program (Out of Box Experience program) off. When I reboot something in the system is turning it back on. I tried disabling everything under the startup tab in msconfig and when I rebooted they all stayed off, HOWEVER, there was a new instance of ALaunchX at the top and it was enabled. Can you think of anything else I can try.

Thanks for your assistance.


----------



## WyteNyte (May 22, 2014)

Thanks Lance, I will await your reply.


----------



## etaf (Oct 2, 2003)

Do you have a recovery DVD set ?

do you have the Key for the office 2010 applications ?

do you have a CoA label on the PC 
you could download a w7 ISO and then install that using the CoA Key 
only issue is , any issue and you will no longer have the recovery partition and so cannot go back 
also then download office 2010 ISO and install using the Key


----------



## Lance1 (Aug 4, 2003)

Be patient, Mark is one busy fellow. But he is quite good at what he does.


----------



## Mark1956 (May 7, 2011)

Hi WyteNyte, I just need you to answer a couple of things. 

Have you done a full Factory Restore wiping out all the original data on the hard drive?

What was wrong with the system that prompted you to do a Factory Restore?

This problem does appear to be fairly common on Acer PC's and if you have done a full Factory restore wiping out all the original data this won't be due to an infection.

When you cancel ALaunchx is the system fully functional and does Microsoft Office work or is it only partially installed?


----------



## WyteNyte (May 22, 2014)

Lance, I have done the full factory restore and this system locks up at installing office 2010 (just refreshing memory) Once I use task manager to shut down ALaunchX the system works fine. Office 2010 is not available due to the partial download and it not being fully installed. I have no clue as to what the remaining 7 apps are (office 2010 is 17 of 24). 

I have the CoA on the computer for the windows 7 key but no clue as to the CoA or product key for Office 2010. 

Thanks for all the help guys, I appreciate it. Let me know if I should just go with turning off ALaunchX and trying to download an ISO (would need directions how to do it) for W7.

Glenn Wagner


----------



## WyteNyte (May 22, 2014)

I am doing the recovery from the OS partition on the HDD using ALT+F10. I dont have a DVD/CD set of recovery discs. I have the CoA on the computer with the W7 product key but no key code for the Office 2010 application as it is included in the factory restore.

Thanks for the help, awaiting your instructions.

Glenn Wagner


----------



## Mark1956 (May 7, 2011)

Give this a try and see if the partial install will run to completion after you have rebooted the system.


Click on Start.
Type UAC in the search box and hit the enter key.
Click on the slider and drag it to the bottom.
Then click on OK and accept any pop ups and reboot the PC.


----------



## etaf (Oct 2, 2003)

is this a full version of office or just a trial version

did you get some sort of special deal ?

Office is often included , but its only a 30/60day trial and uses a one click setup 
very rarely is a full version of office included - and if it is , you are usually provided with a key.
some OEM supplies on w7 provided office starter with word and excel


> Microsoft Office Starter 2010 is a cut-down version of the package which displays ads, and only contains limited versions of Office and Excel. But by way of compensation you can use it free of charge and without a product key.


----------



## WyteNyte (May 22, 2014)

I have no CoA so would imagine it is the trial version, is there anyway to eliminate it from the install?


----------



## WyteNyte (May 22, 2014)

Lance, I adjusted the UAC and let it run, after work it was still at 17/24. Is there anyway to eliminate the Office 2010 from the install?


----------



## Lance1 (Aug 4, 2003)

WyteNyte said:


> Lance, I adjusted the UAC and let it run, after work it was still at 17/24. Is there anyway to eliminate the Office 2010 from the install?


You could use the *Office 2010 Removal Tool* to completely remove Office 2010. This is a direct link to the download. After the download, boot to Safe Mode by tapping F8 on boot up and selecting Safe Mode. and run the install. You may get a security warning, click Run. Select I Agree to the MS license terms and select next. It'll run for a few seconds and say that it's ready to Uninstall MS Office 2010, select Next and let it run. After it's done boot to normal Windows. Post the results.


----------



## etaf (Oct 2, 2003)

heres a restore ISO for w7
http://ez93.com/dl/gateway-nv53-recovery.html
they are charging a minimum amount for the download of windows 7 and the drivers 
although we should be able to download all the drivers from here
http://us.gateway.com/gw/en/US/content/drivers-downloads
if you enter the serNo or SNID - see if you get to the drivers

Alternatively you could download from digital river - but you need to know the Key for that machine which for W7 is usually on the CoA - it maybe under the battery

this is what the CoA label looks like
http://www.microsoft.com/en-gb/howtotell/Hardware.aspx#PCPurchase

I dont know how to stop the Office install , seems to be part of the recovery CD process

without the Windows Key , we cannot use a W7 ISO from digital river - DO NOT post the key here if you find it 
its 5 groups of 5characters


----------



## WyteNyte (May 22, 2014)

Tried the uninstall office tool and it failed, will try to go to the site and download W7 from there, I have the SNID and product code, will let you know how it goes.

Glenn


----------



## WyteNyte (May 22, 2014)

I will try the download, have the SNID and the W7 Product Code. Will let you know how it goes.

Glenn


----------



## etaf (Oct 2, 2003)

if you have the W7 Product Code 
and also the W7 version, you should be able to download form digital river for free
http://www.w7forums.com/threads/official-windows-7-sp1-iso-image-downloads.12325/
http://techpp.com/2009/11/11/download-windows-7-iso-official-direct-download-links/

you would need to create the bootable DVD
You do *NOT* copy the ISO file onto a CD/DVD - you have to use the ISO to create a bootable CD/DVD
The CD/DVD creator software you have on the PC may have an option to create an image from an ISO 
*If not* - use this free program http://www.imgburn.com/ - Choose the option  Write image file to disc


----------



## WyteNyte (May 22, 2014)

I have the windows key but when I go to digitalriver.com I cant find where to download W7. I found that first location and could pay to download it there but it seems to be a recovery CD rather than an install. I would prefer to not pay for a recovery cd that just duplicates the errors I am getting using the ALT+F10. I downloaded the drivers from MS and it didnt make a difference. What should I try next, thank you for your patience.

Glenn


----------



## WyteNyte (May 22, 2014)

I have the windows key but when I go to digitalriver.com I cant find where to download W7. I found that first location and could pay to download it there but it seems to be a recovery CD rather than an install. I would prefer to not pay for a recovery cd that just duplicates the errors I am getting using the ALT+F10. I downloaded the drivers from MS and it didnt make a difference. What should I try next, thank you for your patience.

Glenn


----------



## WyteNyte (May 22, 2014)

I have the windows key but when I go to digitalriver.com I cant find where to download W7. I found that first location and could pay to download it there but it seems to be a recovery CD rather than an install. I would prefer to not pay for a recovery cd that just duplicates the errors I am getting using the ALT+F10. I downloaded the drivers from MS and it didnt make a difference. What should I try next, thank you for your patience.

Glenn


----------



## Mark1956 (May 7, 2011)

This is the new download site: Windows 7 ISO downloads


----------



## etaf (Oct 2, 2003)

what exact version of windows is on the CoA label 
the first link should open a page, and on that page is a list of different W7 versions 
clicking on any of those links - automatically starts the download.

Note with all these things there is a possibility that it may not install on the pc - because of a fault

you will need all the drivers for the PC

Do you have the recovery DVDS or are you doing this from the PC ?

heres another link http://www.heidoc.net/joomla/technology-science/microsoft/14-windows-7-direct-download-links#


----------



## WyteNyte (May 22, 2014)

It is Windows 7 Home Prem OA. I am restoring it from the PC.


----------



## Mark1956 (May 7, 2011)

WyteNyte, I have just noticed you have two threads on the go for the same problem, this can cause a lot of confusion.

Etaf, please merge the threads. The other one is here: http://forums.techguy.org/windows-7/1126569-windows-7-freezes-up-recovery.html


----------



## Mark1956 (May 7, 2011)

You'll see from my post in your duplicate thread that I have requested the threads are merged. You should not have more than one thread open for the same problem.

As far as I can see you only have two options with this. I can get you to run a scan which will produce a log showing the Registry key that is set to run ALaunchX and then give the instructions to remove it. This will stop the existing problem, but you won't get Office installed (I doubt there is anything we can do to fix that).

If you need Office, you will need to get a new set of Recovery discs from the manufacturer which should then allow you to complete the installation, including Office. You could also take a look at Open Office which is free: http://openoffice.apache.org/


----------



## etaf (Oct 2, 2003)

i have merged your two threads together, for the reasons outlined by Mark1956


----------



## WyteNyte (May 22, 2014)

I was really starting to get confused on which one to respond to. PLEASE send me instructions on running the scan. She doesnt really need office, (if she does I will buy it for her) so stopping the alunchx would be great. 

Thank you for all your help.

Glenn


----------



## Mark1956 (May 7, 2011)

Ok, run the scan below and post both of the logs.

Please download Farbar Recovery Scan Tool (FRST) and save it to your desktop. Do not get tempted to download Regclean Pro.

*Note:* If you get a warning that the download could harm your system, please ignore it and allow the download to go ahead. FRST is perfectly safe and we would never ask you to download anything that isn't.

*Note*: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


Double-click on FRST to run it. When the tool opens click *Yes* to the disclaimer.
Press the* Scan* button. *DO NOT* check any of the Optional Scan options unless requested.
It will make a log (*FRST.txt*) in the same directory the tool is run from. Please copy and paste it into your next reply.
The first time the tool is run, it makes another log (*Addition.txt*). Please also copy and paste that into your reply.


----------



## WyteNyte (May 22, 2014)

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-06-2014 01
Ran by Administrator (administrator) on WIN-OHQIGLIBB2A on 02-06-2014 09:16:11
Running from C:\Users\Administrator\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.0.0.128\ccSvcHst.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe
(Acer Group) C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Symantec Corporation) C:\Program Files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\18.0.0.128\InstStub.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [Trigger New Acer AlaunchX] => c:\OEM\Preload\Command\AlaunchX\AppInRun.exe [304672 2009-09-21] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [206208 2010-06-09] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe [258304 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [OOTag] => C:\Program Files (x86)\Gateway\OOBEOffer\OOTag.exe [13856 2010-02-22] (Microsoft)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [Camera Assistant Software] => C:\Program Files (x86)\Video Web Camera\traybar.exe [600688 2010-07-06] (Chicony)
HKLM\...\RunOnce: [New Acer AlaunchX] - c:\OEM\Preload\Command\AlaunchX\LaunchAlaunchX.exe [300064 2009-09-21] (Acer Inc.)
HKLM-x32\...\RunOnce: [IdentityCardFUB] - C:\Windows\oem\IdentityCard\FUB.exe [227872 2009-10-08] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6406306CE07ACF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
DPF: HKLM-x32 {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.microsoft.com/downl...584-842756A66467/MicrosoftDownloadManager.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF Plugin-x32: @Microsoft.com/DownloadManager,version=1.1 - C:\Windows\ ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
==================== Services (Whitelisted) =================
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.0.0.128\ccSvcHst.exe [126904 2010-05-22] (Symantec Corporation)
==================== Drivers (Whitelisted) ====================

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========
2014-06-02 09:16 - 2014-06-02 09:16 - 00005827 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-06-02 09:15 - 2014-06-02 09:16 - 00000000 ____D () C:\FRST
2014-06-02 09:15 - 2014-06-02 09:15 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-05-30 19:05 - 2012-06-02 15:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-05-30 19:05 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-05-30 19:05 - 2012-06-02 15:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-05-30 19:05 - 2012-06-02 15:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-05-30 19:05 - 2012-06-02 15:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-05-30 19:05 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-05-30 19:04 - 2014-05-30 19:04 - 00000000 ____D () C:\Users\Administrator\AppData\Local\WindowsUpdate
2014-05-30 18:07 - 2014-05-30 18:08 - 00000000 ____D () C:\Symbols
2014-05-30 17:19 - 2014-05-30 17:19 - 00002525 _____ () C:\Users\Public\Desktop\Microsoft Download Manager.lnk
2014-05-30 17:19 - 2014-05-30 17:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Download Manager
2014-05-30 17:19 - 2014-05-30 17:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Download Manager
2014-05-28 19:30 - 2014-03-31 09:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-05-28 18:58 - 2014-05-28 18:58 - 00000010 _____ () C:\ScrubRetValFile.txt
2014-05-28 18:12 - 2014-05-28 18:12 - 00000000 ____D () C:\Windows\NAPP_Dism_Log
2014-05-28 17:56 - 2014-05-28 17:59 - 00000000 ___RD () C:\Backup
2014-05-28 17:32 - 2014-05-28 17:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 9
2014-05-28 17:32 - 2014-05-28 17:32 - 00000000 ____D () C:\ProgramData\OEM
2014-05-28 17:31 - 2014-05-28 17:31 - 00002194 _____ () C:\Users\Public\Desktop\CyberLink PowerDVD 9.lnk
2014-05-28 17:30 - 2014-05-28 17:30 - 00505128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2014-05-28 17:30 - 2014-05-28 17:30 - 00353576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2014-05-28 17:30 - 2014-05-28 17:30 - 00029480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2014-05-28 17:27 - 2014-05-28 17:27 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2014-05-28 17:24 - 2014-05-28 17:24 - 00057560 _____ () C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-28 17:24 - 2014-05-28 17:24 - 00000184 _____ () C:\Windows\LMv4.UNI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\ATI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Users\Administrator\AppData\Local\ATI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Web Camera
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\ProgramData\ATI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Program Files\Synaptics
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Program Files (x86)\Video Web Camera
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 _____ () C:\Windows\Setup.INI
2014-05-28 17:24 - 2010-06-09 03:54 - 00206208 _____ () C:\Windows\PLFSetI.exe
2014-05-28 17:24 - 2010-06-01 01:39 - 00214400 _____ (Sonix) C:\Windows\SysWOW64\Snpropwp.dll
2014-05-28 17:24 - 2009-12-27 19:56 - 00000302 _____ () C:\Windows\PidList_C.ini
2014-05-28 17:23 - 2014-05-28 17:24 - 00000000 ____D () C:\Program Files (x86)\Launch Manager
2014-05-28 17:23 - 2014-05-28 17:23 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Packard Bell
2014-05-28 17:21 - 2014-05-28 17:21 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-28 17:20 - 2014-05-28 17:20 - 00000003 _____ () C:\Windows\system32\PLD_Framework.cmd
2014-05-28 17:19 - 2014-06-02 09:16 - 01045003 _____ () C:\Windows\WindowsUpdate.log
2014-05-28 17:19 - 2014-05-28 17:24 - 00010866 _____ () C:\Windows\DPINST.LOG
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Program Files\Realtek
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Program Files\DIFX
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Program Files (x86)\AMD
2014-05-28 17:19 - 2010-06-22 03:03 - 02622056 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2014-05-28 17:19 - 2010-06-22 03:03 - 02399848 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-05-28 17:19 - 2010-06-22 03:03 - 02004072 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-05-28 17:19 - 2010-06-22 03:03 - 01146984 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-05-28 17:19 - 2010-06-22 03:03 - 00476264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-05-28 17:19 - 2010-06-22 03:03 - 00332392 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-05-28 17:19 - 2010-06-22 03:03 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-05-28 17:19 - 2010-06-22 03:02 - 01216104 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-05-28 17:19 - 2010-06-22 03:02 - 00155752 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2014-05-28 17:19 - 2010-06-22 03:02 - 00073832 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInst64.dll
2014-05-28 17:19 - 2010-06-13 23:19 - 00220496 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFNHK64.dll
2014-05-28 17:19 - 2010-06-13 23:19 - 00078672 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFAPO64.dll
2014-05-28 17:19 - 2010-06-13 23:18 - 00078672 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\system32\SFCOM64.dll
2014-05-28 17:19 - 2010-06-13 23:18 - 00071504 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2014-05-28 17:19 - 2010-06-09 22:44 - 00037468 _____ () C:\Windows\system32\Drivers\RtPCEE3.DAT
2014-05-28 17:19 - 2010-06-07 00:27 - 01251944 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2014-05-28 17:19 - 2010-05-14 00:21 - 00123152 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2014-05-28 17:19 - 2010-05-13 19:04 - 00124176 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2014-05-28 17:19 - 2010-05-13 07:28 - 00123664 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2014-05-28 17:19 - 2010-05-06 02:34 - 00335192 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2014-05-28 17:19 - 2010-05-06 02:34 - 00334680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2014-05-28 17:19 - 2010-05-06 01:43 - 02601816 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
2014-05-28 17:19 - 2010-05-06 01:43 - 01736536 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2014-05-28 17:19 - 2010-04-26 22:50 - 00330656 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-05-28 17:19 - 2010-04-14 02:56 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2014-05-28 17:19 - 2010-03-21 22:21 - 00247560 _____ () C:\Windows\system32\Drivers\RTConvEQ.dat
2014-05-28 17:19 - 2010-03-21 22:21 - 00001448 _____ () C:\Windows\system32\Drivers\RtHdatEx.dat
2014-05-28 17:19 - 2010-03-15 01:59 - 00000024 _____ () C:\Windows\system32\Drivers\rtkhdaud.dat
2014-05-28 17:19 - 2010-02-11 00:45 - 00000176 _____ () C:\Windows\system32\Drivers\RTHDAEQ1.dat
2014-05-28 17:19 - 2010-01-26 20:12 - 01814048 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RHDMEx64.dll
2014-05-28 17:19 - 2010-01-26 20:12 - 01631264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkHDM64.dll
2014-05-28 17:19 - 2010-01-26 20:12 - 00068640 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RHCoInst64.dll
2014-05-28 17:19 - 2010-01-26 20:05 - 00231328 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtHDMIVX.sys
2014-05-28 17:19 - 2010-01-26 06:52 - 00000520 _____ () C:\Windows\system32\Drivers\RTEQEX3.dat
2014-05-28 17:19 - 2010-01-25 20:38 - 00168288 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-05-28 17:19 - 2010-01-10 17:41 - 00307936 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RH3DHT64.dll
2014-05-28 17:19 - 2010-01-10 17:41 - 00307936 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RH3DAA64.dll
2014-05-28 17:19 - 2010-01-04 22:41 - 01325328 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:41 - 00489744 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:41 - 00474896 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:40 - 01178384 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:40 - 01110800 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:40 - 00504592 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:40 - 00315152 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:40 - 00268560 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2014-05-28 17:19 - 2010-01-04 22:40 - 00265488 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2014-05-28 17:19 - 2009-12-23 08:26 - 00000520 _____ () C:\Windows\system32\Drivers\RTEQEX0.dat
2014-05-28 17:19 - 2009-12-22 02:26 - 00038456 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2014-05-28 17:19 - 2009-12-15 03:26 - 00372936 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-05-28 17:19 - 2009-12-15 03:26 - 00369864 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64H.dll
2014-05-28 17:19 - 2009-12-15 03:26 - 00201928 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64H.dll
2014-05-28 17:19 - 2009-12-15 03:26 - 00201928 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-05-28 17:19 - 2009-12-15 03:26 - 00099016 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-05-28 17:19 - 2009-12-15 03:26 - 00095432 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64H.dll
2014-05-28 17:19 - 2009-12-15 03:26 - 00076488 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64H.dll
2014-05-28 17:19 - 2009-12-15 03:26 - 00076488 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-05-28 17:19 - 2009-12-10 18:55 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-05-28 17:19 - 2009-12-10 18:55 - 00307920 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-05-28 17:19 - 2009-11-23 18:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2014-05-28 17:19 - 2009-11-23 18:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2014-05-28 17:19 - 2009-11-23 18:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2014-05-28 17:19 - 2009-11-23 18:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2014-05-28 17:19 - 2009-11-18 03:42 - 02197264 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2014-05-28 17:19 - 2009-11-17 03:12 - 00108960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-05-28 17:19 - 2008-08-20 22:43 - 00000520 _____ () C:\Windows\system32\Drivers\RTEQEX2.dat
2014-05-28 17:19 - 2005-06-26 14:29 - 00000520 _____ () C:\Windows\system32\Drivers\RTEQEX1.dat
2014-05-28 17:18 - 2014-05-28 17:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
2014-05-28 17:17 - 2014-05-28 17:18 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-05-28 17:17 - 2014-05-28 17:17 - 00000000 ____D () C:\Program Files\ATI
2014-05-25 04:44 - 2014-05-28 17:19 - 00003352 _____ () C:\RHDSetup.log
==================== One Month Modified Files and Folders =======
2014-06-02 09:16 - 2014-06-02 09:16 - 00005827 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-06-02 09:16 - 2014-06-02 09:15 - 00000000 ____D () C:\FRST
2014-06-02 09:16 - 2014-05-28 17:19 - 01045003 _____ () C:\Windows\WindowsUpdate.log
2014-06-02 09:16 - 2009-07-13 22:08 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp
2014-06-02 09:15 - 2014-06-02 09:15 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-06-02 09:10 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-02 09:10 - 2009-07-13 21:51 - 00028767 _____ () C:\Windows\setupact.log
2014-05-30 19:12 - 2009-07-13 21:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-30 19:12 - 2009-07-13 21:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-30 19:04 - 2014-05-30 19:04 - 00000000 ____D () C:\Users\Administrator\AppData\Local\WindowsUpdate
2014-05-30 19:03 - 2009-07-13 22:13 - 00713888 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-30 18:08 - 2014-05-30 18:07 - 00000000 ____D () C:\Symbols
2014-05-30 17:19 - 2014-05-30 17:19 - 00002525 _____ () C:\Users\Public\Desktop\Microsoft Download Manager.lnk
2014-05-30 17:19 - 2014-05-30 17:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Download Manager
2014-05-30 17:19 - 2014-05-30 17:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Download Manager
2014-05-28 18:58 - 2014-05-28 18:58 - 00000010 _____ () C:\ScrubRetValFile.txt
2014-05-28 18:54 - 2009-07-13 20:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-05-28 18:14 - 2009-03-12 02:30 - 00000000 ____D () C:\Windows\LP
2014-05-28 18:12 - 2014-05-28 18:12 - 00000000 ____D () C:\Windows\NAPP_Dism_Log
2014-05-28 18:10 - 2009-07-13 22:38 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2014-05-28 18:10 - 2009-07-13 22:32 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2014-05-28 17:59 - 2014-05-28 17:56 - 00000000 ___RD () C:\Backup
2014-05-28 17:33 - 2010-09-23 00:09 - 00012383 _____ () C:\Windows\patch.log
2014-05-28 17:32 - 2014-05-28 17:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 9
2014-05-28 17:32 - 2014-05-28 17:32 - 00000000 ____D () C:\ProgramData\OEM
2014-05-28 17:32 - 2010-09-23 00:03 - 00000000 ____D () C:\Program Files\Gateway
2014-05-28 17:32 - 2010-09-22 23:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-28 17:31 - 2014-05-28 17:31 - 00002194 _____ () C:\Users\Public\Desktop\CyberLink PowerDVD 9.lnk
2014-05-28 17:30 - 2014-05-28 17:30 - 00505128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2014-05-28 17:30 - 2014-05-28 17:30 - 00353576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2014-05-28 17:30 - 2014-05-28 17:30 - 00029480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2014-05-28 17:30 - 2010-09-23 00:30 - 00000000 ___HD () C:\OEM
2014-05-28 17:30 - 2010-09-22 23:58 - 00000000 ____D () C:\Program Files (x86)\Cyberlink
2014-05-28 17:30 - 2010-09-22 23:57 - 00000000 ____D () C:\ProgramData\Temp
2014-05-28 17:27 - 2014-05-28 17:27 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2014-05-28 17:24 - 2014-05-28 17:24 - 00057560 _____ () C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-28 17:24 - 2014-05-28 17:24 - 00000184 _____ () C:\Windows\LMv4.UNI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\ATI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Users\Administrator\AppData\Local\ATI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Web Camera
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\ProgramData\ATI
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Program Files\Synaptics
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 ____D () C:\Program Files (x86)\Video Web Camera
2014-05-28 17:24 - 2014-05-28 17:24 - 00000000 _____ () C:\Windows\Setup.INI
2014-05-28 17:24 - 2014-05-28 17:23 - 00000000 ____D () C:\Program Files (x86)\Launch Manager
2014-05-28 17:24 - 2014-05-28 17:19 - 00010866 _____ () C:\Windows\DPINST.LOG
2014-05-28 17:23 - 2014-05-28 17:23 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Packard Bell
2014-05-28 17:23 - 2009-10-05 13:30 - 00000000 ____D () C:\Windows\DeployWinRE2
2014-05-28 17:23 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\Recovery
2014-05-28 17:22 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\sysprep
2014-05-28 17:22 - 2007-07-11 18:49 - 00000000 ____D () C:\Windows\Panther
2014-05-28 17:21 - 2014-05-28 17:21 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-28 17:20 - 2014-05-28 17:20 - 00000003 _____ () C:\Windows\system32\PLD_Framework.cmd
2014-05-28 17:20 - 2010-09-22 23:57 - 00000000 ____D () C:\Program Files (x86)\Gateway
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Program Files\Realtek
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Program Files\DIFX
2014-05-28 17:19 - 2014-05-28 17:19 - 00000000 ____D () C:\Program Files (x86)\AMD
2014-05-28 17:19 - 2014-05-25 04:44 - 00003352 _____ () C:\RHDSetup.log
2014-05-28 17:19 - 2010-09-22 23:54 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-28 17:18 - 2014-05-28 17:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
2014-05-28 17:18 - 2014-05-28 17:17 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-05-28 17:17 - 2014-05-28 17:17 - 00000000 ____D () C:\Program Files\ATI
2014-05-28 17:17 - 2010-09-22 23:36 - 00003540 _____ () C:\Windows\TSSysprep.log
2014-05-28 17:17 - 2009-07-13 21:46 - 00002790 _____ () C:\Windows\DtcInstall.log
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\MSNF920.exe
C:\Users\Administrator\AppData\Local\Temp\{7014E919-2EAA-4158-AB8A-7483300316F4}.dll

==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-05-30 17:52
==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-06-2014 01
Ran by Administrator at 2014-06-02 09:17:26
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================
AV: Norton Internet Security (Disabled - Up to date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Disabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Norton Internet Security (Disabled) {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
==================== Installed Programs ======================
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.1.82.76 - Adobe Systems Incorporated)
Adobe Reader 9.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
AMD USB Filter Driver (x32 Version: 1.0.15.94 - Advanced Micro Devices, Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{3B20226B-63ED-B863-B224-FE40401B21CA}) (Version: 3.0.765.0 - ATI Technologies, Inc.)
Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden
Broadcom Gigabit NetLink Controller (HKLM\...\{A84DB02B-9C2B-4272-9D2D-A80E00A56513}) (Version: 14.0.2.3 - Broadcom Corporation)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2010.0329.836.13543 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0329.836.13543 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2010.0329.836.13543 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2010.0329.836.13543 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0329.836.13543 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0329.836.13543 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0329.836.13543 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help English (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help French (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help German (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0329.0835.13543 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0329.836.13543 - ATI) Hidden
ccc-utility64 (Version: 2010.0329.836.13543 - ATI) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.3216.50 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.3216.50 - CyberLink Corp.) Hidden
Gateway InfoCentre (HKLM-x32\...\Gateway InfoCentre) (Version: 3.02.3000 - Gateway Incorporated)
Gateway MyBackup (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.68 - NewTech Infosystems)
Gateway Power Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Gateway Incorporated)
Gateway Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Gateway Incorporated)
Gateway Registration (HKLM-x32\...\Gateway Registration) (Version: 1.03.3003 - Gateway Incorporated)
Gateway Social Networks (HKLM-x32\...\InstallShield_{64EF903E-D00A-414C-94A4-FBA368FFCDC9}) (Version: 1.0.1901 - CyberLink Corp.)
Gateway Social Networks (x32 Version: 1.0.1901 - CyberLink Corp.) Hidden
Gateway Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Gateway Incorporated)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Gateway Incorporated)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 4.0.14 - Gateway)
Microsoft Download Manager (HKLM-x32\...\{654977DB-0001-0002-0001-EABD228DDE8B}) (Version: 1.2.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Windows Debugging Symbols (HKLM-x32\...\{8DD62FB6-083D-40B9-9D7D-48449FDDDED5}) (Version: 7601 - Microsoft)
Nero 9 Essentials (HKLM-x32\...\{b2701285-afdf-4e55-93ab-7cf2f815f5d4}) (Version: - Nero AG)
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.13.100 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.12.100 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero Express Help (x32 Version: 9.4.37.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.12.100 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden
Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.37.100 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.27.100 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden
NeroExpress (x32 Version: 9.4.37.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Norton Internet Security (HKLM-x32\...\NIS) (Version: 18.0.0.128 - Symantec Corporation)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6034 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6141 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30122 - Realtek Semiconductor Corp.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.19.0 - Synaptics Incorporated)
Video Web Camera (HKLM-x32\...\{12A1B519-5934-4508-ADBD-335347B0DC87}) (Version: 1.7.137.706 - Chicony Electronics Co.,Ltd.)
Welcome Center (HKLM-x32\...\Gateway Welcome Center) (Version: 1.02.3004 - Gateway Incorporated)
==================== Restore Points =========================

==================== Hosts content: ==========================
2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {A0C20AC6-63F8-4CB6-912F-EDB458C7AA85} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Gateway\Gateway Recovery Management\NotificationCenter\Notification.exe [2010-06-23] (Acer)
==================== Loaded Modules (whitelisted) =============
2014-05-28 17:24 - 2010-06-09 03:54 - 00206208 _____ () C:\Windows\PLFSetI.exe
2010-03-08 10:57 - 2010-03-08 10:57 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-05-28 17:19 - 2014-05-28 17:19 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-06-28 15:20 - 2010-06-28 15:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\sqlite3.dll
2010-06-28 15:12 - 2010-06-28 15:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\ACE.dll
2010-09-23 00:31 - 2009-05-19 23:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll
==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

==================== EXE Association (whitelisted) =============

==================== Disabled items from MSCONFIG ==============

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
Application errors:
==================
Error: (06/02/2014 09:13:51 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\servicing\TrustedInstaller.exe; Description = Windows Modules Installer; Error = 0x8007043c).
Error: (06/02/2014 09:13:49 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x8007043c).
Error: (05/30/2014 07:05:21 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\servicing\TrustedInstaller.exe; Description = Windows Modules Installer; Error = 0x8007043c).
Error: (05/30/2014 07:05:17 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\servicing\TrustedInstaller.exe; Description = Windows Modules Installer; Error = 0x8007043c).
Error: (05/30/2014 07:05:13 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\servicing\TrustedInstaller.exe; Description = Windows Modules Installer; Error = 0x8007043c).
Error: (05/30/2014 07:05:11 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x8007043c).
Error: (05/30/2014 06:06:44 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Microsoft Windows Debugging Symbols; Error = 0x8007043c).
Error: (05/30/2014 06:06:17 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Microsoft Windows Debugging Symbols; Error = 0x8007043c).
Error: (05/30/2014 05:59:57 PM) (Source: System Restore) (EventID: 8211) (User: )
Description: The scheduled restore point could not be created. Additional information: (0x8007043c).
Error: (05/30/2014 05:59:57 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Description = Scheduled Checkpoint; Error = 0x8007043c).

System errors:
=============
Error: (05/30/2014 07:12:58 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: The Windows Update service did not shut down properly after receiving a preshutdown control.
Error: (05/30/2014 04:51:05 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (05/28/2014 05:17:28 PM) (Source: Microsoft-Windows-Application-Experience) (EventID: 205) (User: NT AUTHORITY)
Description: The Program Compatibility Assistant service failed to perform the phase two initialization.

Microsoft Office Sessions:
=========================
Error: (06/02/2014 09:13:51 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\servicing\TrustedInstaller.exeWindows Modules Installer0x8007043c
Error: (06/02/2014 09:13:49 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x8007043c
Error: (05/30/2014 07:05:21 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\servicing\TrustedInstaller.exeWindows Modules Installer0x8007043c
Error: (05/30/2014 07:05:17 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\servicing\TrustedInstaller.exeWindows Modules Installer0x8007043c
Error: (05/30/2014 07:05:13 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\servicing\TrustedInstaller.exeWindows Modules Installer0x8007043c
Error: (05/30/2014 07:05:11 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x8007043c
Error: (05/30/2014 06:06:44 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\msiexec.exe /VInstalled Microsoft Windows Debugging Symbols0x8007043c
Error: (05/30/2014 06:06:17 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\msiexec.exe /VInstalled Microsoft Windows Debugging Symbols0x8007043c
Error: (05/30/2014 05:59:57 PM) (Source: System Restore) (EventID: 8211) (User: )
Description: 0x8007043c
Error: (05/30/2014 05:59:57 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationScheduled Checkpoint0x8007043c

==================== Memory info =========================== 
Percentage of memory in use: 38%
Total physical RAM: 3834.9 MB
Available physical RAM: 2376.28 MB
Total Pagefile: 7669.8 MB
Available Pagefile: 6030.52 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (Gateway) (Fixed) (Total:452.66 GB) (Free:423.66 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 421FDB4F)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=453 GB) - (Type=07 NTFS)
==================== End Of Log ============================


----------



## Mark1956 (May 7, 2011)

Follow these instructions and you should find the issue has gone when you reboot the PC.

We are now going to run FRST in a different way.


*IMPORTANT---> *First download the attachment at the bottom of this post by clicking on it and save it in the same location as FRST.
Launch FRST by double clicking on it. *DO NOT* click on the *Scan* button or check any of the boxes.
You may see a message that an update is installing, if so the program will close when the update completes, you will then need to double click on FRST to open it again.
When the *FRST* window opens click on the *Fix* button *just once* and wait.
You will see a message confirming the fix has been run and the log saved, click on OK and the Fixlog will open. *Copy & Paste* the full log it into your next reply.

*NOTE:* This fix has been written specifically for the PC being dealt with in this thread, if you run it on another system it may have undesirable consequences. If you have a similar problem, ask for help by opening a new thread in the appropriate forum.


----------



## WyteNyte (May 22, 2014)

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-06-2014
Ran by Administrator at 2014-06-03 10:42:28 Run:1
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKLM\...\Run: [Trigger New Acer AlaunchX] => c:\OEM\Preload\Command\AlaunchX\AppInRun.exe [304672 2009-09-21] ()
HKLM\...\RunOnce: [New Acer AlaunchX] - c:\OEM\Preload\Command\AlaunchX\LaunchAlaunchX.exe [300064 2009-09-21] (Acer Inc.)
c:\OEM\Preload\Command\AlaunchX
*****************
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Trigger New Acer AlaunchX => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\New Acer AlaunchX => Value deleted successfully.
c:\OEM\Preload\Command\AlaunchX => Moved successfully.
==== End of Fixlog ====


----------



## Mark1956 (May 7, 2011)

Did that fix the issue??


----------



## WyteNyte (May 22, 2014)

Wayne, Lance, Mark, thank you soo much for the help. I am not sure what other programs (after the office installation) wont be installed, but I can cross that bridge if I run into it. Take care gentlemen, and again, my heartfelt thanks.


----------



## Mark1956 (May 7, 2011)

You're welcome.

You can remove FRST by right clicking on the icon and selecting Delete, the same can be applied to any saved logs.


----------

