Problem: : This device is disabled. 2014-08-26 15:18 - 2009-07-13 22:13 - 00783606 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-14 13:03 - 2014-07-25 06:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-14 13:03 - 2014-07-25 05:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-14 13:03 - 2014-07-08 15:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls The "AlternateShell" will be restored. ), (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Intel Corporation) C:\Program Files\Intel\Intel Rapid Storage Technology\IAStorDataMgrSvc.exe Exception code: 0xc0000005 127.0.0.1 localhost, ==================== Scheduled Tasks (whitelisted) =============, (If an entry is included in the fixlist, it will be removed from registry. Faulting application start time: 0xsvchost.exe0 2014-09-05 07:51 - 2014-04-14 08:12 - 00002185 _____ () C:\Users\Public\Desktop\Google Chrome.lnk ), ==================== Safe Mode (whitelisted) ===================, (If an item is included in the fixlist, it will be removed from the registry. # compatibility_mode_1='Microsoft Security Essentials' R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation) (Intel Corporation) C:\Windows\System32\igfxpers.exe 2014-09-05 11:26 - 2014-09-05 11:26 - 00003608 _____ () C:\Users\auto6\Desktop\attach.txt 2014-09-05 10:23 - 2011-06-25 23:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-04-09 07:57 - 2012-11-25 20:20 - 00117608 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\zlib1.dll I don't need the log file. SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = Follow these steps carefully to get rid of Chrome Startup with the Registry Editor: If your problem is persistent, you can eliminate it like this: Maybe all you need is a clean slate. 2014-08-14 13:03 - 2014-07-25 06:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-05 10:23 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe Total Pagefile: 8024.08 MB Ran by Auto6 at 2014-09-05 17:03:02 Run:1 ESET hasn't found any active malware so we're done. This way, you will get rid of cookies and extensions, and your startup problem might go away. 2014-08-26 15:18 - 2014-08-26 15:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-14 13:03 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL Description: Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1 # archives_checked=true 2014-08-15 03:01 - 2014-03-09 14:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll What exactly do you mean by "which one to use"? Exception code: 0xc0000005 *" => File/Directory not found. (Microsoft Corporation) C:\Windows\System32\rundll32.exe AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} Faulting application path: svchost.exe1 2014-08-14 13:03 - 2014-07-25 04:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll Download link from any site other than Bleeping Computer is unpermitted or outdated. 2014-08-14 13:03 - 2014-07-25 07:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll Report Id: ipmGui.exe3, Error: (09/03/2014 05:09:37 PM) (Source: Application Error) (EventID: 1000) (User: ) I had the same problem on my home PC which has :Windows7, Microsfot Office 2003 I followed your instructions and now do not have the problem!! Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system.

2014-08-14 13:03 - 2014-07-25 05:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll Dell WLAN and Bluetooth Client Installation (HKLM-x32\\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)

Can a timeseries with a clear trend be considered stationary? The backup browser is stopping.

2014-08-14 13:03 - 2014-07-25 05:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-14 13:03 - 2014-07-25 06:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll This starts the Enable Device wizard. Simply drag it or paste it here and it will kill the Chrome process on Startup, not allowing it to start. 2014-08-26 15:17 - 2014-08-26 15:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-09-05 17:35 - 2014-04-14 08:10 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job # scanned=122261 2014-08-14 13:03 - 2014-07-08 15:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls 2014-08-14 13:03 - 2014-07-25 05:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-05 10:23 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe (SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe The file will not be moved. S3 Intel Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel Corporation) 2014-08-26 15:17 - 2014-08-26 13:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\auto6\Documents\mbam-setup-2.0.2.1012.exe Intrusive startup programs can be a nuisance, but there are ways to prevent them from bugging you. Description: Faulting application name: iexplore.exe, version: 11.0.9600.17239, time stamp: 0x4a5bc6b7 CHR Extension: (Gmail) - C:\Users\auto6\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-14], ==================== Services (Whitelisted) =================, (If an entry is included in the fixlist, the service will be removed from the registry. This service may not function properly. ), ==================== MSCONFIG/TASK MANAGER disabled items =========, (Currently there is no automatic fix for this section. Date: 2014-09-05 10:36:57.805 Making statements based on opinion; back them up with references or personal experience. Report Id: svchost.exe3, Error: (09/02/2014 03:53:06 PM) (Source: Application Error) (EventID: 1000) (User: ) Let us know! 2014-08-15 04:05 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\rescache Description: ipmGui.exe14.0.6.52253bec647ntdll.dll6.1.7601.18247521ea8e7c000000500037b349a401cfc55d1523ec31C:\program files (x86)\avira\antivir desktop\ipmGui.exeC:\Windows\SysWOW64\ntdll.dllc1bd377a-33c7-11e4-9e0d-9cd21ebabc50, Error: (09/03/2014 05:09:37 PM) (Source: Application Error) (EventID: 1000) (User: ) If I close the chrome browser, another window pops open again. The chrome browser is no longer popping up continuously anymore. Adobe Reader XI MUI (HKLM-x32\\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)

In case you havent already, try reinstalling Chrome from scratch. Faulting application start time: 0xiexplore.exe0 Now, you can reinstall Chrome and see if it still opens on Startup. CHR Extension: (Google Wallet) - C:\Users\auto6\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-14] 2014-09-05 10:51 - 2014-09-05 10:23 - 00000000 ____D () C:\ComboFix Task: {2BE73EDB-3B2D-4131-9F2A-BC0D822B2E2E} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-10] (PC-Doctor, Inc.) 2014-08-14 13:03 - 2014-06-03 03:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe Description: Faulting application name: ipmGui.exe, version: 14.0.6.522, time stamp: 0x53bec647 2014-09-05 12:22 - 2014-09-05 12:21 - 00026066 _____ () C:\Users\auto6\Desktop\Addition.txt ShellIconOverlayIdentifiers: DBARFileNotBackuped -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll (Microsoft Corporation), ==================== Internet (Whitelisted) ====================, (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default. eBay (HKLM-x32\\{A8B88634-7F90-402F-B66A-86429755F6A5}) (Version: 1.4.0 - eBay Inc.) Open up Run, by pressing the Windows key and R key simultaneously. rev2022.7.21.42639. Description: Faulting application name: ipmGui.exe, version: 14.0.6.522, time stamp: 0x53bec647 Exception code: 0xc0000005 So i proceed to post it to this forum, I followed this guide, as stated to do before posting. 2014-08-14 13:03 - 2014-07-25 06:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-14 13:03 - 2014-07-25 07:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-26 15:18 - 2014-08-26 15:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys C:\Users\auto6\AppData\Local\ModulatorMobile => Moved successfully. HKLM\\Run: [IAStorIcon] => C:\Program Files\Intel\Intel Rapid Storage Technology\IAStorIcon.exe [286056 2013-07-30] (Intel Corporation) How did this note help previous owner of this old film camera? 2014-08-14 13:03 - 2014-07-25 05:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe If that is not the case and you need or wish to continue with this topic, please send me or any, Virus, Trojan, Spyware, and Malware Removal Help, C:\Program Files\ESET\EsetOnlineScanner\log.txt, This is not recommended for shared computers, Windows 11 KB5015882 update fixes bugs causing File Explorer to freeze, Master Python from basics to graduate with this training bundle deal, http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/, http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/, http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/, http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch, http://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=DCJB, http://search.tb.ask.com/search/GGmain.jhtml?searchfor={searchTerms}&st=kwd&ptb=6C94A817-EA6F-4EC7-84D5-F326AF5E6C36&n=780c4876&ind=2014070902&p2=^YL^chr998^YYA^us&si=CD15543, http://ssmsp.ask.com/query?q={searchTerms}&li=ff&sstype=prefix, Back to Virus, Trojan, Spyware, and Malware Removal Help, When finished, FRST will produce two logs (. June 28, 2021. Intel Rapid Storage Technology (HKLM\\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.7.3.1001 - Intel Corporation) 2014-08-26 15:17 - 2014-08-26 15:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware Disable the realtime-protection of your antivirus and anti-malware programs because they might interfere with the scan. Error: (09/05/2014 08:13:00 AM) (Source: BROWSER) (EventID: 8032) (User: ) How to Open PDFs From Chrome in Adobe Reader, The Best Chrome Extensions for Changing Your IP Address, How to Change the Location on a FireStick, How to Download Photos from Google Photos, How to Remove Netflix Recently Watched Shows. 2014-08-14 13:03 - 2014-07-25 03:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll Exception code: 0xc0000005 Description: Dell Wireless 1705 802.11b/g/n (2.4GHZ) 2014-08-14 13:03 - 2014-07-08 18:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL I read through the whole thing, then proceeded to complete step 2- run combofix. "C:\Users\auto6\Application Data\{0000267A-7510-7610-340C-A6A5B31B19B0}. Faulting process id: 0x3b5c 2014-08-14 13:03 - 2014-07-25 03:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll (Intel Corporation) C:\Program Files (x86)\Intel\Intel Management Engine Components\LMS\LMS.exe Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 02 Announcing the Stacks Editor Beta release! 2014-08-26 15:17 - 2014-08-26 15:17 - 00000000 ____D () C:\ProgramData\Malwarebytes SearchScopes: HKCU - DefaultScope {430F891F-299B-4293-947E-8F802B6655AD} URL = 2014-09-05 11:59 - 2014-04-14 08:10 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job None default entries will be removed. 2014-08-14 13:03 - 2014-07-25 05:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll Google Chrome (HKLM-x32\\Google Chrome) (Version: 37.0.2062.103 - Google Inc.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe Find centralized, trusted content and collaborate around the technologies you use most. C:\Windows\SysWOW64\wininit.exe => File is digitally signed

(10.14) Thanks! 2014-08-15 03:00 - 2014-06-05 23:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe Description: The PEVSystemStart service is marked as an interactive service. In queue: 80, 17:39:48.0595 0x10e8 Waiting for KSN requests completion. 2014-08-26 15:33 - 2014-08-26 15:33 - 00000000 ____D () C:\Program Files\Microsoft Security Client Description: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{0742C2C3-9DCB-4308-AF4A-0425B1C9EAAA}. Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Running from C:\Users\auto6\Desktop 2014-08-14 13:03 - 2014-07-25 06:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-14 13:03 - 2014-07-25 05:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

?\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. 2014-08-14 13:03 - 2014-07-25 07:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

ESETSmartInstaller@High as downloader log: 2014-08-14 13:00 - 2014-07-13 18:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll, 2014-09-05 17:44 - 2014-09-05 12:21 - 00013706 _____ () C:\Users\auto6\Desktop\FRST.txt 2014-08-14 13:03 - 2014-06-24 18:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-08-14 13:03 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1915920 2013-11-21] (SoftThinks SAS) Microsoft Office Sessions: Error: (09/05/2014 00:00:43 PM) (Source: WinMgmt) (EventID: 10) (User: ) 2014-09-05 10:37 - 2009-07-13 19:34 - 00000215 _____ () C:\Windows\system.ini ), C:\Windows\System32\winlogon.exe => File is digitally signed TRACS 7.6.0.17 (HKLM-x32\\{A1E4482B-B79A-432A-B1D1-70C7C2D2A099}) (Version: 7.6.0.17 - Genuine Parts Company) 2014-09-05 12:20 - 2014-09-05 12:20 - 02104832 _____ (Farbar) C:\Users\auto6\Desktop\FRST64.exe

AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F} R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation) 2014-09-05 10:14 - 2014-09-05 10:38 - 00000000 ____D () C:\Windows\erdnt R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-07-30] (Intel Corporation) Faulting application start time: 0xipmGui.exe0 I think OP is asking about an EULA pop up in their product, not Chrome itself. Faulting process id: 0x2824 2014-08-26 15:33 - 2014-08-26 15:33 - 00002119 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk # OnlineScanner.ocx=1.0.0.7623 Dell Digital Delivery (HKLM-x32\\{D850CB7E-72BC-4510-BA4F-48932BFAB295}) (Version: 2.9.901.0 - Dell Products, LP) Should I remove older low level jobs/education from my CV at this point? Report Id: svchost.exe3, Error: (09/02/2014 01:16:44 PM) (Source: Application Error) (EventID: 1000) (User: ) 2014-09-05 10:23 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-08-15 03:27 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-14 13:03 - 2014-07-25 06:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll Description: Faulting application name: iexplore.exe, version: 11.0.9600.17239, time stamp: 0x4a5bc6b7 Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States) Contact Us | Privacy Policy | TOS | All Rights Reserved. 2014-08-22 17:59 - 2014-08-28 02:01 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-14 13:03 - 2014-07-25 04:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll HKLM\\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-07-29] (Realtek Semiconductor) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}. (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe 2014-08-14 13:03 - 2014-07-25 06:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-05 07:57 - 2014-09-05 07:57 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} C:\Users\auto6\Application Data\{0000267A-7510-7610-340C-A6A5B31B19B0}. Faulting process id: 0x332c SUCCESS: The process with PID 2472 (child process of PID 2272) has been terminated. Report Id: iexplore.exe3, Error: (09/05/2014 07:54:23 AM) (Source: Application Error) (EventID: 1000) (User: ) Intel Management Engine Components (HKLM-x32\\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) These PUPs are anything but cute they can get installed as a side deal with some another program or if you browse a shady website.

(Intel Corporation) C:\Program Files\Intel\Intel Rapid Storage Technology\IAStorIcon.exe =================================== Internet Explorer Version 11 2014-08-14 13:03 - 2014-07-25 05:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-15 03:01 - 2014-03-09 14:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe ), R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-12] (Avira Operations GmbH & Co. KG) 2014-08-22 20:07 - 2014-08-22 20:07 - 00301568 _____ () C:\Users\auto6\AppData\Local\ModulatorMobile\ModulatorMobile.dll Any idea how to do this on a Mac? Microsoft .NET Framework 4.5.1 (HKLM\\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

What's the use of 100k resistors in this schematic? 2014-09-05 10:13 - 2014-09-05 10:13 - 05576440 ____R (Swearware) C:\Users\auto6\Desktop\ComboFix.exe Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden Close ALL Microsoft Office related programs (Outlook, Publisher, Powerpoint, Excel, or Word), The program will start and ask you to agree to the EULA (agreement) again and click I agree or Yes.

There are several ways to fix this reoccurring problem, which will not just improve your PCs startup time, but will speed up your Chrome experience overall. ============= # found=3 2014-08-14 13:03 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

2014-08-28 02:01 - 2014-08-22 19:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

SUCCESS: The process with PID 6748 (child process of PID 6440) has been terminated. 2014-09-05 10:23 - 2000-08-30 17:00 - 00068096 _____ () C:\Windows\zip.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe 2014-09-05 10:51 - 2014-09-05 10:15 - 00000000 ____D () C:\Qoobox

Of course, just because Chrome is popular doesnt mean its perfect. 2014-08-22 18:45 - 2014-08-28 02:01 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-26 15:17 - 2014-08-26 15:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware DSC/AA Factory Installer (Version: 3.5.6426.22 - PC-Doctor, Inc.) Hidden 2014-08-22 17:59 - 2014-08-28 02:01 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-14 13:03 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL