We'd like to remind Forumites to please avoid political debate on the Forum. This is to keep it a safe and useful space for MoneySaving discussions. Threads that are - or become - political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

cpu usage

2»

Comments

  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Pass. No clue (Unless its to do with the infections)

    Run combofix as above with no av then install AVAST av (If avira still wont install)
    :idea:
  • greenpixey
    greenpixey Posts: 2,806 Forumite
    Thanks, I installed Avast today, just finished running the kaspersky scan and this is the result.



    Wednesday, April 29, 2009
    Operating System: Microsoft Windows Vista Home Basic Edition, 32-bit Service Pack 1 (build 6001)
    Kaspersky Online Scanner version: 7.0.26.13
    Program database last update: Wednesday, April 29, 2009 14:13:39
    Records in database: 2092713

    Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes
    Scan area My Computer C:\
    D:\
    E:\
    G:\
    Scan statistics Files scanned 112708 Threat name 4 Infected objects 5 Suspicious objects 0 Duration of the scan 02:49:46
    File name Threat name Threats count C:\Documents\downloads\install_Winrar_(2).exeInfected: Trojan.Win32.Shutdowner.kz1

    C:\Documents\downloads\install_Winrar_.exeInfected: Trojan.Win32.Shutdowner.kz1

    C:\Users\Home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQDJ4H0O\install[2].exeInfected: Packed.Win32.Tdss.h1

    C:\Users\Home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\R0ABURMG\index[1].htmInfected: Trojan-Downloader.HTML.Agent.ov1

    C:\Users\Home\Pictures\ChairGun2_Setup.exeInfected: not-a-virus:AdWare.Win32.Rabio.mp1

    The selected area was scanned.
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Open notepad and copy/paste the text in RED below

    File::
    C:\Documents\downloads\install_Winrar_.exe
    C:\Users\Home\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Content.IE5\NQDJ4H0O\install[2].exe
    C:\Users\Home\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Low\Content.IE5\R0ABURMG\index[1].htm
    C:\Users\Home\Pictures\ChairGun2_Setup.exe

    Save this as "CFScript"

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif


    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    :idea:
  • greenpixey
    greenpixey Posts: 2,806 Forumite
    ComboFix 09-04-25.A1 - Home 29/04/2009 19:19.3 - NTFSx86
    Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.2037.833 [GMT 1:00]
    Running from: c:\users\Home\Pictures\ComboFix.exe
    Command switches used :: c:\users\Home\Desktop\CFScript2.txt
    * Created a new restore point

    FILE ::
    c:\documents\downloads\install_Winrar_.exe
    c:\users\Home\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Content.IE5\NQDJ4H0O\install[2].exe
    c:\users\Home\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Low\Content.IE5\R0ABURMG\index[1].htm
    c:\users\Home\Pictures\ChairGun2_Setup.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents\downloads\install_Winrar_.exe
    c:\users\Home\Pictures\ChairGun2_Setup.exe

    .
    ((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-29 )))))))))))))))))))))))))))))))
    .

    2009-04-29 08:44 . 2009-02-05 20:06 51792 ----a-w c:\windows\system32\drivers\aswMonFlt.sys
    2009-04-27 18:45 . 2009-04-27 18:45
    dc----w c:\users\Home\AppData\Local\Apps
    2009-04-26 20:35 . 2009-04-26 20:35
    dc----w c:\users\Public\CyberLink
    2009-04-26 20:34 . 2009-04-26 20:35
    dc----w c:\users\Home\AppData\Roaming\CyberLink
    2009-04-26 15:42 . 2009-04-26 15:42 10520 -c--a-w c:\windows\system32\avgrsstx.dll.old
    2009-04-18 20:52 . 2009-04-18 20:57
    dc----w c:\users\Home\AppData\Roaming\Spotify
    2009-04-18 20:52 . 2009-04-18 20:53
    dc----w c:\users\Home\AppData\Local\Spotify
    2009-04-16 16:21 . 2008-12-06 04:42 376832 -c--a-w c:\windows\system32\winhttp.dll
    2009-04-16 16:21 . 2009-03-03 04:46 3599328 -c--a-w c:\windows\system32\ntkrnlpa.exe
    2009-04-16 16:21 . 2009-03-03 04:46 3547632 -c--a-w c:\windows\system32\ntoskrnl.exe
    2009-04-16 16:21 . 2009-03-03 04:39 551424 -c--a-w c:\windows\system32\rpcss.dll
    2009-04-16 16:21 . 2009-03-03 03:04 666624 -c--a-w c:\windows\system32\printfilterpipelinesvc.exe
    2009-04-16 16:21 . 2009-03-03 04:39 183296 -c--a-w c:\windows\system32\sdohlp.dll
    2009-04-16 16:21 . 2009-03-03 04:39 26112 -c--a-w c:\windows\system32\printfilterpipelineprxy.dll
    2009-04-16 16:21 . 2009-03-03 04:37 98304 -c--a-w c:\windows\system32\iasrecst.dll
    2009-04-16 16:21 . 2009-03-03 04:37 54784 -c--a-w c:\windows\system32\iasads.dll
    2009-04-16 16:21 . 2009-03-03 04:37 44032 -c--a-w c:\windows\system32\iasdatastore.dll
    2009-04-16 16:21 . 2009-03-03 02:38 17408 -c--a-w c:\windows\system32\iashost.exe
    2009-04-16 16:19 . 2009-03-17 03:38 13824 -c--a-w c:\windows\system32\apilogen.dll
    2009-04-16 16:19 . 2009-03-17 03:38 24064 -c--a-w c:\windows\system32\amxread.dll
    2009-04-16 16:19 . 2009-02-13 08:49 72704 -c--a-w c:\windows\system32\secur32.dll
    2009-04-16 16:19 . 2009-02-13 08:49 1255936 -c--a-w c:\windows\system32\lsasrv.dll
    2009-04-16 16:19 . 2008-06-06 03:27 38912 -c--a-w c:\windows\system32\xolehlp.dll
    2009-04-16 16:19 . 2008-06-06 03:27 562176 -c--a-w c:\windows\system32\msdtcprx.dll
    2009-04-12 23:01 . 2009-04-12 23:02
    dc----w c:\users\Home\AppData\Roaming\vlc
    2009-04-11 20:52 . 1998-06-24 00:00 140096 -c----w c:\windows\system32\Comdlg32.ocx

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-04-29 12:12 . 2008-07-30 09:41
    dc----w c:\program files\Java
    2009-04-29 08:44 . 2009-04-29 08:44
    dc----w c:\program files\Alwil Software
    2009-04-28 18:29 . 2008-06-30 03:53
    dc----w c:\programdata\Google Updater
    2009-04-27 18:45 . 2008-06-23 20:28
    dc----w c:\program files\Mozilla Thunderbird
    2009-04-27 14:23 . 2009-04-27 14:23 10740 -c--a-w C:\avenger.txt
    2009-04-26 20:34 . 2008-02-26 03:45
    dc----w c:\programdata\CyberLink
    2009-04-25 17:21 . 2009-04-25 17:21
    dc----w c:\program files\CCleaner
    2009-04-25 16:54 . 2008-09-06 20:58
    dc----w c:\program files\free-downloads.net
    2009-04-24 20:12 . 2009-04-24 20:12
    dc----w c:\program files\Trend Micro
    2009-04-24 18:30 . 2009-01-25 13:26
    dc----w c:\program files\Malwarebytes' Anti-Malware
    2009-04-18 20:52 . 2009-04-18 20:52
    dc----w c:\program files\Spotify
    2009-04-16 23:55 . 2006-11-02 11:18
    dc----w c:\program files\Windows Mail
    2009-04-16 23:14 . 2008-02-26 03:14
    dc----w c:\programdata\Microsoft Help
    2009-04-12 23:00 . 2009-04-12 23:00
    dc----w c:\program files\VideoLAN
    2009-04-11 20:52 . 2009-04-11 20:52
    dc----w c:\program files\RealWorldPOI
    2009-04-06 14:32 . 2009-01-25 13:26 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2009-04-06 14:32 . 2009-01-25 13:26 15504 ----a-w c:\windows\system32\drivers\mbam.sys
    2009-03-17 03:38 . 2009-04-16 16:19 40960 -c--a-w c:\windows\AppPatch\apihex86.dll
    2009-03-09 04:19 . 2009-02-25 22:44 410984 -c--a-w c:\windows\System32\deploytk.dll
    2009-03-07 07:54 . 2008-06-30 03:53
    dc----w c:\program files\Google
    2009-03-06 18:50 . 2009-03-06 18:50 0 -c--a-w c:\users\Home\jagex_runescape_preferences.dat
    2009-03-05 21:21 . 2008-06-30 06:33
    dc----w c:\program files\Windows Live
    2009-03-05 21:20 . 2008-06-30 06:45
    dc----w c:\program files\Windows Live Toolbar
    2009-03-05 21:20 . 2009-03-05 21:20
    dc----w c:\program files\Microsoft Sync Framework
    2009-03-05 21:14 . 2009-03-05 21:14
    dc----w c:\program files\Microsoft
    2009-03-05 21:13 . 2009-03-05 21:13
    dc----w c:\program files\Windows Live SkyDrive
    2009-03-05 20:33 . 2009-03-05 20:33
    dc----w c:\program files\Common Files\Windows Live
    2009-03-04 09:57 . 2009-03-04 09:57 266240 -c--a-w c:\windows\System32\CSHelper.exe
    2009-03-04 09:57 . 2009-03-04 09:57 225280 -c--a-w c:\windows\System32\CSInstru.DLL
    2009-03-03 04:40 . 2009-04-16 16:18 827392 -c--a-w c:\windows\System32\wininet.dll
    2009-03-03 04:37 . 2009-04-16 16:18 78336 -c--a-w c:\windows\System32\ieencode.dll
    2009-03-03 02:28 . 2009-04-16 16:18 26624 -c--a-w c:\windows\System32\ieUnatt.exe
    2009-03-02 21:43 . 2009-03-02 21:43
    dc----w c:\program files\Windows Resource Kits
    2009-02-09 03:10 . 2009-03-11 06:51 2033152 -c--a-w c:\windows\System32\win32k.sys
    2009-02-06 18:52 . 2009-02-06 18:52 49504 -c--a-w c:\windows\System32\sirenacm.dll
    2008-10-26 10:46 . 2008-06-26 01:37 106168 ----a-w c:\users\kids\AppData\Local\GDIPFONTCACHEV1.DAT
    2008-09-05 19:45 . 2008-06-23 23:20 106168 -c--a-w c:\users\Home\AppData\Local\GDIPFONTCACHEV1.DAT
    2008-08-06 14:52 . 2008-07-26 01:58 680 -c--a-w c:\users\Home\AppData\Local\d3d9caps.dat
    2008-01-21 02:57 . 2006-11-02 12:48 174 --sha-w c:\program files\desktop.ini
    2008-06-23 20:21 . 2008-06-23 20:04 16384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2008-06-23 20:21 . 2008-06-23 20:04 32768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2008-06-23 20:21 . 2008-06-23 20:04 16384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    ((((((((((((((((((((((((((((( SnapShot_2009-04-29_08.24.22 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-01-21 01:58 . 2009-04-29 12:24 64196 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2006-11-02 13:02 . 2009-04-29 12:24 86232 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2009-04-29 08:44 . 2009-02-05 20:06 51376 c:\windows\System32\drivers\aswTdi.sys
    + 2009-04-29 08:44 . 2009-02-05 20:06 23152 c:\windows\System32\drivers\aswRdr.sys
    + 2009-04-29 08:44 . 2009-02-05 20:07 20560 c:\windows\System32\drivers\aswFsBlk.sys
    + 2008-06-23 23:16 . 2009-04-29 16:21 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-06-23 23:16 . 2009-04-28 18:29 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-04-29 12:17 . 2009-04-29 12:17 20480 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6baea4fe-4322e992-n\jogl_awt.dll
    + 2009-04-29 12:17 . 2009-04-29 12:17 57344 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\5b902232-2e005a93-n\Decora-SSE.dll
    + 2009-04-29 12:17 . 2009-04-29 12:17 20480 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\4f710eed-176d28a4-n\gluegen-rt.dll
    + 2009-04-29 12:17 . 2009-04-29 12:17 24064 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\4e09eacf-1b9dcbea-n\Decora-D3D.dll
    + 2008-06-23 23:16 . 2009-04-29 16:21 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-06-23 23:16 . 2009-04-28 18:29 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-06-23 23:16 . 2009-04-28 18:29 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-06-23 23:16 . 2009-04-29 16:21 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-04-29 08:44 . 2009-02-05 20:04 97480 c:\windows\System32\AvastSS.scr
    + 2008-06-23 23:22 . 2009-04-29 12:24 9884 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3929813110-840122575-3204768853-1000_UserData.bin
    + 2009-04-29 12:20 . 2009-04-29 12:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2009-04-28 18:26 . 2009-04-28 18:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2009-04-28 18:26 . 2009-04-28 18:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-04-29 12:20 . 2009-04-29 12:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2008-06-24 00:16 . 2009-04-29 11:39 307246 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    + 2006-11-02 10:33 . 2009-04-29 12:26 601008 c:\windows\System32\perfh009.dat
    - 2006-11-02 10:33 . 2009-04-29 08:20 601008 c:\windows\System32\perfh009.dat
    - 2006-11-02 10:33 . 2009-04-29 08:20 106498 c:\windows\System32\perfc009.dat
    + 2006-11-02 10:33 . 2009-04-29 12:26 106498 c:\windows\System32\perfc009.dat
    - 2009-02-25 22:44 . 2009-02-25 22:43 148888 c:\windows\System32\javaws.exe
    + 2009-04-29 12:12 . 2009-03-09 04:19 148888 c:\windows\System32\javaws.exe
    + 2009-04-29 12:12 . 2009-03-09 04:19 144792 c:\windows\System32\javaw.exe
    - 2009-02-25 22:44 . 2009-02-25 22:43 144792 c:\windows\System32\javaw.exe
    + 2009-04-29 12:12 . 2009-03-09 04:19 144792 c:\windows\System32\java.exe
    - 2009-02-25 22:44 . 2009-02-25 22:43 144792 c:\windows\System32\java.exe
    + 2009-04-29 08:44 . 2009-02-05 20:07 114768 c:\windows\System32\drivers\aswSP.sys
    + 2009-04-29 12:17 . 2009-04-29 12:17 114688 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6baea4fe-4322e992-n\jogl_cg.dll
    + 2009-04-29 12:17 . 2009-04-29 12:17 315392 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6baea4fe-4322e992-n\jogl.dll
    + 2009-04-29 12:17 . 2009-04-29 12:17 348160 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\258cea61-52368906-n\msvcr71.dll
    + 2009-04-29 12:17 . 2009-04-29 12:17 499712 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\258cea61-52368906-n\msvcp71.dll
    + 2009-04-29 12:17 . 2009-04-29 12:17 499712 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\258cea61-52368906-n\jmc.dll
    - 2006-11-02 12:45 . 2009-04-28 18:29 262144 c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2006-11-02 12:45 . 2009-04-29 12:24 262144 c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2006-11-02 12:45 . 2009-04-29 12:24 262144 c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
    - 2006-11-02 12:45 . 2009-04-28 18:29 262144 c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
    + 2009-04-29 08:44 . 2009-02-05 20:11 1256296 c:\windows\System32\aswBoot.exe
    .
    -- Snapshot reset to current date --
    .
  • greenpixey
    greenpixey Posts: 2,806 Forumite
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2008-01-03 10:00 39472 ----a-w c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
    "BitComet"="c:\program files\BitComet\BitComet.exe" [2008-06-03 2596152]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-30 68856]
    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
    "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 217544]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-05 525360]
    "PCMService"="c:\program files\Acer\Acer Arcade\PCMService.exe" [2008-01-25 155648]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-22 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-22 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-22 133656]
    "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-01-04 768520]
    "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-07-21 159744]
    "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-06 57344]
    "fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
    "Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
    "WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
    "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-09-03 4702208]

    c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-9-5 113664]
    Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2008-2-26 535336]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{DF60EEC8-0880-4246-9F1B-E1A10310EF84}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{64BC88D6-9B44-490A-BC4D-A944E6E3591F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{13ADE3BD-099C-44B2-A160-5484D6802808}"= c:\program files\Acer\Acer Arcade\PowerCinema.exe:CyberLink PowerCinema
    "{B6B81CF0-2AE4-455F-98A8-CA8E19F5FCDD}"= c:\program files\Acer\Acer Arcade\PCMService.exe:CyberLink PowerCinema Resident Program
    "{20859917-0498-405B-A496-2F5D40E2B014}"= c:\program files\Acer\Acer Arcade\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
    "{0123652C-844A-43DE-831A-EA7BA4B67C78}"= c:\program files\Acer\Acer Arcade\Kernel\DMS\CLMSService.exe:CyberLink Media Server
    "{AB2CA533-4D4A-4EAB-98B3-BACD35DA0665}"= c:\program files\Acer\HomeMedia\HomeMedia.exe:HomeMedia
    "{09DC3416-BD03-46A4-8BAC-BDBBB2CD50F0}"= UDP:c:\users\Home\AppData\Local\Temp\Installer.exe:SpeedTouch Home Install Wizard
    "{DEE1C961-DD91-4148-915B-7FB8ACADE30E}"= TCP:c:\users\Home\AppData\Local\Temp\Installer.exe:SpeedTouch Home Install Wizard
    "{5A583172-BFA5-49A1-865C-C4F4B84F875A}"= UDP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
    "{8615FDF5-DFAE-45F5-A4A1-F1D194BE367D}"= TCP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
    "TCP Query User{F7E7C38F-15FE-4841-9E79-9D5086A8AE60}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{587E3BB9-21D6-4B05-B868-8A5E5C063F2C}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "{BFCEB77B-2070-4CB2-B9C2-2A55FBB1556E}"= UDP:c:\program files\TalkTalk\agent\bin\bcont.exe:bcont.exe
    "{E5619BFF-30DC-483F-B45B-A485884D89A6}"= TCP:c:\program files\TalkTalk\agent\bin\bcont.exe:bcont.exe
    "{369D153B-DFB4-432E-89EE-08B3EFD89436}"= UDP:c:\program files\Common Files\SupportSoft\bin\tgsrvc.exe:tgsrvc.exe
    "{DDF9A213-91FD-416A-B3AE-B39B3BFA08E2}"= TCP:c:\program files\Common Files\SupportSoft\bin\tgsrvc.exe:tgsrvc.exe
    "{29F42DC9-DF98-45AE-87DF-43A1EAD9BD45}"= UDP:c:\program files\TalkTalk\agent\bin\bcont_nm.exe:bcont_nm.exe
    "{1BC47C04-5E79-4BC8-B239-F9935BBD938C}"= TCP:c:\program files\TalkTalk\agent\bin\bcont_nm.exe:bcont_nm.exe
    "{E0CFAD7A-94AA-48EF-B1CF-3465E9A6C504}"= UDP:c:\program files\TalkTalk\bin\sprtcmd.exe:sprtcmd.exe
    "{ADB14288-E77F-4A1B-8E02-FCBC95088432}"= TCP:c:\program files\TalkTalk\bin\sprtcmd.exe:sprtcmd.exe
    "TCP Query User{E8213B60-A003-4E2F-B7D8-964BCC091568}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{2D0FE775-5340-4A14-91EC-FA175653C179}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "{BADE3396-F0B9-47F0-A9B6-476162614135}"= UDP:c:\program files\BitComet\tools\CometBrowser.exe:BitComet Resource Browser
    "{FB2258FA-EE8A-4426-8BF9-EC5BF8367754}"= TCP:c:\program files\BitComet\tools\CometBrowser.exe:BitComet Resource Browser
    "{99699AA4-35E0-4751-8D21-768BB1704EB3}"= Disabled:UDP:d:\aoc\Age of Conan\AgeOfConan.exe:AgeOfConan
    "{B30A5948-33C4-4C05-BB99-F6C6861D9A49}"= Disabled:TCP:d:\aoc\Age of Conan\AgeOfConan.exe:AgeOfConan
    "TCP Query User{1F9E4127-B56E-4A33-AFF1-037646C61604}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{560861C6-4AAB-480C-8D4D-6CF1D57D73C0}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "TCP Query User{C695BAB6-565B-4BE3-82B4-BEC645D90FDC}c:\\program files\\microsoft office\\office\\frontpg.exe"= UDP:c:\program files\microsoft office\office\frontpg.exe:Microsoft FrontPage
    "UDP Query User{58CE2173-AA8C-418F-87D7-CFAED159352B}c:\\program files\\microsoft office\\office\\frontpg.exe"= TCP:c:\program files\microsoft office\office\frontpg.exe:Microsoft FrontPage
    "{1270A110-1698-48DB-85B2-0720D39F28C9}"= UDP:24240:BitComet 24240 TCP
    "{D618A038-2EDE-4085-AC80-F91ABD65D822}"= TCP:24240:BitComet 24240 UDP
    "TCP Query User{48AA258C-EC5E-42E1-859A-949D56B196C3}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{5387266C-607A-4A46-8F6C-B830FD944AEE}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{1700C60C-3C7A-4857-BB02-48DA59A1FBFF}d:\\games\\doom 3\\doom3.exe"= Disabled:UDP:d:\games\doom 3\doom3.exe:DOOM 3
    "UDP Query User{DE7D802F-89A2-474D-B48A-7035C3A723C9}d:\\games\\doom 3\\doom3.exe"= Disabled:TCP:d:\games\doom 3\doom3.exe:DOOM 3
    "TCP Query User{AE2EFF4C-DD3F-4A84-98E8-7F4A05229B81}c:\\sierra\\empire earth\\empire earth.exe"= UDP:c:\sierra\empire earth\empire earth.exe:Empire Earth
    "UDP Query User{21A74C02-E95A-4A61-9E91-373EA4ACEADF}c:\\sierra\\empire earth\\empire earth.exe"= TCP:c:\sierra\empire earth\empire earth.exe:Empire Earth
    "TCP Query User{51A6C1B8-2BDC-4BA8-B822-92E93C5C8E6D}c:\\sierra\\empire earth\\empire earth.exe"= UDP:c:\sierra\empire earth\empire earth.exe:Empire Earth
    "UDP Query User{CCB41075-1A98-41DB-8619-CBB9DF7BC3FB}c:\\sierra\\empire earth\\empire earth.exe"= TCP:c:\sierra\empire earth\empire earth.exe:Empire Earth
    "{B2E342D6-7D4F-4731-AEAB-9E6BEC10BDC0}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSfsu.exe"= c:\acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x86\\encryption.exe"= c:\acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x86\\decryption.exe"= c:\acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSMgr.exe"= c:\acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDStbmngr.exe"= c:\acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSfsu.exe"= c:\acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x64\\encryption.exe"= c:\acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x64\\decryption.exe"= c:\acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSMgr.exe"= c:\acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr
    "c:\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDStbmngr.exe"= c:\acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr

    R3 ALSysIO;ALSysIO; [x]
    R3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2008-06-24 30464]
    R3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2008-06-24 12672]
    R3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\DRIVERS\stppp.sys [2008-06-24 35328]
    S1 aswSP;avast! Self Protection; [x]
    S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2007-09-19 51200]
    S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-02-05 51792]
    S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2009-03-04 266240]
    S2 fssfltr;fssfltr;c:\windows\system32\DRIVERS\fssfltr.sys [2009-02-06 55280]
    S2 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
    S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 180736]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    WindowsMobile REG_MULTI_SZ wcescomm rapimgr
    LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    \shell\AutoRun\command - F:\autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
    \shell\AutoRun\command - G:\RunGame.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64209611-7c55-11dd-a654-001b38d82d23}]
    \shell\AutoRun\command - G:\autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e71e270c-f204-11dc-b29a-806e6f6e6963}]
    \shell\AutoRun\command - E:\Setup.now.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-04-29 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-30 07:41]

    2009-04-28 c:\windows\Tasks\User_Feed_Synchronization-{6C865D70-FEB0-4153-B906-1B807149BF08}.job
    - c:\windows\system32\msfeedssync.exe [2008-01-21 02:34]
    .
    .
    Supplementary Scan
    .
    mStart Page = hxxp://en.uk.acer.yahoo.com
    uInternet Settings,ProxyServer = http=localhost:7171
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
    IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    LSP: c:\windows\system32\wpclsp.dll
    DPF: {0CFA086E-6336-4D95-B6AA-90F564E99631} - hxxp://www.shopandscan.com/TNSClicker.CAB
    FF - ProfilePath - c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\aytilme9.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.startup.homepage - hxxp://www.itsmylife.talktalk.net/
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=vmn&type=vdio5&p=
    FF - prefs.js: network.proxy.type - 4
    FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npArtistScope42.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npArtistScopeDRM11.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: c:\windows\system32\C2MP\npdivx32.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-04-29 19:24
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    LOCKED REGISTRY KEYS

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2009-04-29 19:27
    ComboFix-quarantined-files.txt 2009-04-29 18:27
    ComboFix2.txt 2009-04-29 08:25
    ComboFix3.txt 2009-04-25 19:46

    Pre-Run: 3,220,357,120 bytes free
    Post-Run: 3,514,220,544 bytes free

    324 --- E O F --- 2009-04-22 07:05
  • greenpixey
    greenpixey Posts: 2,806 Forumite
    Is there anything else to be done now or is that it?
  • Jakg
    Jakg Posts: 2,267 Forumite
    Part of the Furniture 1,000 Posts Name Dropper
    Go to task manager (CTRL + SHIFT + ESC), process, and see whats actually eating your CPU rather than going on a hopeless goose-chase for a virus you may or may not have.
    Nothing I say represents any past, present or future employer.
  • greenpixey
    greenpixey Posts: 2,806 Forumite
    edited 30 April 2009 at 10:01PM
    Jakg wrote: »
    Go to task manager (CTRL + SHIFT + ESC), process, and see whats actually eating your CPU rather than going on a hopeless goose-chase for a virus you may or may not have.


    So far the stuff aliEnRIK has asked me to do has actually helped. My laptop is working faster, I cleared trojans and infections, it hasn't crashed since and the cpu is more or less back to normal....
    I wouldn't say he has sent me on a "hopeless goose-chase"
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Jakg wrote: »
    Go to task manager (CTRL + SHIFT + ESC), process, and see whats actually eating your CPU rather than going on a hopeless goose-chase for a virus you may or may not have.

    Your telling me that the OPs computer has NOT been infected??

    You defy belief..........

    ..........on second thoughts. I'll sit back and see how you get on...........
    :idea:
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Looks ok to me

    Id suggest giving your comp a good clean then your good to go

    Download CCLEANER (Make sure you click 'DOWNLOAD LATEST VERSION' ~ make sure YAHOO TOOLBAR is unticked on installation)
    http://www.filehippo.com/download_ccleaner/
    Run the CLEANER scan (UNTICK 'cookies')
    Then run the REGISTRY scan (Backup the registry when it asks)


    reboot

    Download GLARY UTILITIES (Make sure you click 'DOWNLOAD NOW' ~ UNTICK the ASK toolbar on installation)
    http://www.download.com/Glary-Utilities/3000-2094_4-10508531.html
    Run the ONE CLICK scan


    ps ~ thanks for the LITTLE BIG PLANET link you posted :)
    :idea:
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 348.9K Banking & Borrowing
  • 252.4K Reduce Debt & Boost Income
  • 452.6K Spending & Discounts
  • 241.7K Work, Benefits & Business
  • 618.3K Mortgages, Homes & Bills
  • 176K Life & Family
  • 254.8K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.1K Discuss & Feedback
  • 15.1K Coronavirus Support Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture