Windows 10: More or less daily unexpected restarts

My Adwarecleaner properties are different from yours. Unblock doesn't seem to exist.

 

Does this latest version run now for you?

 

Nope, still the same problem!

I do use all anyway. Looking at anti exploit I saw reference to "tor browser.exe" I believe it's associated with Firefox, which I haven't used for a long while. The nearest to anything Mozilla is the Palemoon Fossamail email client. Very puzzlimg!

 

Please download and run RKILL.
Once it has run, it will put a text file on your desktop with results. Please post that here.
There are three different versions; try the *.exe first. If it won't run, try the other two.

Then try running AdwCleaner after RKILL has been run (do not reboot).

Malwarebytes AntiExploit has protection for all browsers listed, whether you have them installed on your system or not.

I will wait for your post with the RKILL text file.

 

Code: Rkill 2.8.4 by Lawrence Abrams (Grinler)BleepingComputer Copyright 2008-2016 BleepingComputer.com More Information about Rkill can be found at this link: RKill - What it does and What it Doesn't - A brief introduction to the program - Anti-Virus, Anti-Malware, and Privacy Software Program started at: 04/14/2016 08:10:04 PM in x64 mode. Windows Version: Windows 10 Home Checking for Windows services to stop: * No malware services found to stop. Checking for processes to terminate: * C:\Users\Gordon\AppData\Local\dslstats32W-5.6.2\dslstats.exe (PID: 4656) [UP-HEUR] 1 proccess terminated! Checking Registry for malware related settings: * No issues found in the Registry. Resetting .EXE, .COM, & .BAT associations in the Windows Registry. Performing miscellaneous checks: * No issues found. Checking Windows Service Integrity: * tunnel [Missing Service] Searching for Missing Digital Signatures: * No issues found. Checking HOSTS File: * HOSTS file entries found: 127.0.0.1 localhost 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com 0.0.0.0 media.opencandy.com 0.0.0.0 cdn.opencandy.com 0.0.0.0 tracking.opencandy.com 0.0.0.0 api.opencandy.com 0.0.0.0 api.recommendedsw.com 0.0.0.0 installer.betterinstaller.com 0.0.0.0 installer.filebulldog.com 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net 0.0.0.0 inno.bisrv.com 0.0.0.0 nsis.bisrv.com 0.0.0.0 cdn.file2desktop.com 0.0.0.0 cdn.goateastcach.us 0.0.0.0 cdn.guttastatdk.us 0.0.0.0 cdn.inskinmedia.com 0.0.0.0 cdn.insta.oibundles2.com 0.0.0.0 cdn.insta.playbryte.com 0.0.0.0 cdn.llogetfastcach.us 20 out of 36 HOSTS entries shown. Please review HOSTS file for further entries. Program finished at: 04/14/2016 08:11:13 PM Execution time: 0 hours(s), 1 minute(s), and 9 seconds(s)[/quote] DSLstats is a router monitoring program.

 

DSLstats is a router monitoring program.[/quote] Yes, thanks, I see that. As long as you're good on your hosts file entries (20 out of 36 shown), everything else looks fine. I don't understand why AdwCleaner wouldn't run. Have you tried it now that RKILL has been run? Have you had any more restarts?

 

Restarts. none like the others AFAICS
About ADWcleaner it was run post Rkill. Event viewer report (if you understand it
Code: - System - Provider [ Name] Application Hang - EventID 1002 [ Qualifiers] 0 Level 2 Task 101 Keywords 0x80000000000000 - TimeCreated [ SystemTime] 2016-04-14T18:02:02.128947200Z EventRecordID 972 Channel Application Computer Gordon-PC Security - EventData adwcleaner_5.111.exe 5.1.1.1 1bbc 01d196776aeffed5 4294967295 C:\Users\Gordon\Downloads\adwcleaner_5.111.exe fc5bba57-026a-11e6-9c15-00256485166c 54006F00700020006C006500760065006C002000770069006E0064006F0077002000690073002000690064006C00650000000000 Binary data: In Words 0000: 006F0054 00200070 0065006C 00650076 0010: 0020006C 00690077 0064006E 0077006F 0020: 00690020 00200073 00640069 0065006C 0030: 00000000 In Bytes 0000: 54 00 6F 00 70 00 20 00 T.o.p. . 0008: 6C 00 65 00 76 00 65 00 l.e.v.e. 0010: 6C 00 20 00 77 00 69 00 l. .w.i. 0018: 6E 00 64 00 6F 00 77 00 n.d.o.w. 0020: 20 00 69 00 73 00 20 00 .i.s. . 0028: 69 00 64 00 6C 00 65 00 i.d.l.e. 0030: 00 00 00 00 ....[/quote]

 

There should be a log file at C:\AdwCleaner\AdwCleaner.txt. Please post that here.

If you experience any more sudden restarts, you might try the clean boot, and the Memtest.


EDIT: Here is some documentation for dealing with a crash in AdwCleaner:
ToolsLib - [EN] - AdwCleaner documentation - Forum

.

 

C:\ADWcleaner folder is empty. Am about to read link.

Edit
Is this the bit you mean? I'm having trouble making out what I have to put into the prompt
Code: for %x in (c:\windows\system32\*.dll) do regsvr32 %x /s[/quote] , especially the * + and %.
This must sound stupid to you!*Redface

 

*Redface upon *Redface! I must have had a very senior moment last evening. Thought I had run Rkill but hadn't. Sorry simrick and others.
Here is the log from ADWcleaner.
Code: # AdwCleaner v5.111 - Logfile created 15/04/2016 at 07:51:27# Updated 14/04/2016 by Xplode # Database : 2016-04-11.4 [Server] # Operating system : Windows 10 Home (X64) # Username : Gordon - GORDON-PC # Running from : C:\Users\Gordon\Downloads\adwcleaner_5.111.exe # Option : Clean # Support : ToolsLib ***** [ Services ] ***** ***** [ Folders ] ***** [-] Folder Deleted : C:\Program Files\Easeware [-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverNavigator [-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Registry Cleaner [-] Folder Deleted : C:\Users\Gordon\AppData\Roaming\Easeware ***** [ Files ] ***** [-] File Deleted : C:\Users\Gordon\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage [-] File Deleted : C:\Users\Gordon\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage-journal ***** [ DLLs ] ***** ***** [ Shortcuts ] ***** ***** [ Scheduled tasks ] ***** ***** [ Registry ] ***** [-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DisplayName] [#] Value Deleted : HKU\S-1-5-21-2830489159-1404018476-1906715735-1000\Software\Microsoft\Internet Explorer\SearchScopes [DisplayName] ***** [ Web browsers ] ***** ************************* :: "Tracing" keys deleted :: Winsock settings cleared :: Chrome preferences reset : C:\Users\Gordon\AppData\Local\Google\Chrome\User Data\Default :: Chrome preferences reset : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default ************************* C:\AdwCleaner\AdwCleaner[C1].txt - [1710 bytes] - [15/04/2016 07:51:27] C:\AdwCleaner\AdwCleaner[S1].txt - [1532 bytes] - [15/04/2016 07:46:48] ########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1856 bytes] ##########[/quote]

 

[/quote] Thanks. No worries.
How is the system running now? Any unexpected shutdowns?

 

I’m starting to wonder if my system is breaking up! I was about to reply, when a restart happened
Code: Faulting application name: svchost.exe_stisvc, version: 10.0.10586.0, time stamp: 0x5632d7ba Faulting module name: CNC540C.DLL, version: 1.1.2.0, time stamp: 0x4b21c853 Exception code: 0xc0000005 Fault offset: 0x0000000000004160 Faulting process id: 0x808 Faulting application start time: 0x01d1972760c5631c Faulting application path: C:\WINDOWS\system32\svchost.exe Faulting module path: C:\WINDOWS\system32\CNC540C.DLL Report Id: d7cff1a5-9d67-40b1-b33d-e8e56c57b2a8 Faulting package full name: Faulting package-relative application ID:[/quote] Code: The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.[/quote] At same time several print service problems were reported (see zipped evtc folder A
With also
Code: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f Exception code: 0xc0000005 Fault offset: 0x000000000001aa84 Faulting process id: 0xb7c Faulting application start time: 0x01d19727c234650a Faulting application path: C:\Program Files\Dell\DellDataVault\DellDataVault.exe Faulting module path: C:\Program Files\Dell\DellDataVault\DellDataVault.exe Report Id: d247bc07-9098-472c-949b-83c7daa2e7fd Faulting package full name: Faulting package-relative application ID:[/quote] Code: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user Gordon-PC\Gordon SID (S-1-5-21-2830489159-1404018476-1906715735-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.FeatureOnDemand.InsiderHub_10.0.10586.0_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795). This security permission can be modified using the Component Services administrative tool.[/quote] also the warnings (zipped evtc file B) are worrying.
Am I unnecessarily concerned?

 

Looks like the CNC540C.dll refers to Canon WIA scanner driver. Do you have one, and if so, have you checked for updated drivers?
Do you use Dell Data Vault? If not, please uninstall it. Also uninstall Dell Support Assist.

 

Back in post #9, you indicated that sfc /scannow reported "no integrity violations", so your system files are intact.

There are some conflicts of some sort going on here. I'd like to see what is installed on the system.

Please download and install Ccleaner Free.

Run the program. Select TOOLS in the very left pane, and UNINSTALL in the next column. Once the list has populated, click SAVE TO TEXT FILE in the bottom right corner. Please post that text file in a code box here for us to have a look.

 

As suggested I've deleted the Dell items; am wondering how they might cause problems?
Yes. I do have a Canon Pixma MP540 Multifunction. It has not been tested for Windows 10 compatabilty, but has seemed to work. I'll look for a driver update, but am thinking of a newer wi-fi model.