📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

laptop driving me nuts, i think its vistas fault

Options
135678

Comments

  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Download AVIRA (Make sure you click 'DOWNLOAD LATEST VERSION')
    http://www.filehippo.com/download_antivir/

    Avira is your new anti virus
    UPDATE it and run a complete scan
    :idea:
  • helen_roberts_2
    helen_roberts_2 Posts: 152 Forumite
    done that.... the avira thing has been saying preparimg installation for nearly 10 mins is that normal??
  • helen_roberts_2
    helen_roberts_2 Posts: 152 Forumite
    i think i must have done it wrong because it still says preparing installation
  • macman
    macman Posts: 53,129 Forumite
    Part of the Furniture 10,000 Posts Name Dropper
    So how is it running now?
    You should stay off the internet until you get an antivirus re-installed. I don't quite understand why you removed AVG? A lot of people on this board would not recommend it, but it's better than nothing. Avira or Kaspersky would be your best options.
    No free lunch, and no free laptop ;)
  • helen_roberts_2
    helen_roberts_2 Posts: 152 Forumite
    aftrer preparing for installation nothing happens just disappears. i removed avg because someone told me this was what could be causing my problems

    i dont know what to do
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Please run COMBOFIX
    Follow the simple instructions it gives
    Post the COMPLETE log it creates here (Split into sections if need be)

    If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
    :idea:
  • helen_roberts_2
    helen_roberts_2 Posts: 152 Forumite
    ComboFix 09-06-15.04 - Karl 16/06/2009 3:05.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1013.426 [GMT 1:00]
    Running from: c:\users\Karl\Desktop\ComboFix.exe
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    .
    ((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
    .
    2009-06-16 02:14 . 2009-06-16 02:15
    d
    w- c:\users\Karl\AppData\Local\temp
    2009-06-15 21:19 . 2009-06-15 21:19
    d
    w- c:\windows\Sun
    2009-06-15 21:08 . 2009-06-15 21:11
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-06-15 21:08 . 2009-06-15 21:11
    d
    w- c:\programdata\Spybot - Search & Destroy
    2009-06-15 19:34 . 2009-06-15 19:34
    d
    w- c:\programdata\NortonInstaller
    2009-06-15 15:18 . 2009-06-15 15:18
    d
    w- c:\users\Karl\AppData\Roaming\Malwarebytes
    2009-06-15 15:18 . 2009-05-26 12:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-06-15 15:18 . 2009-06-15 15:18
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-06-15 15:18 . 2009-06-15 15:18
    d
    w- c:\programdata\Malwarebytes
    2009-06-15 15:18 . 2009-05-26 12:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-06-14 19:55 . 2009-06-14 19:55
    d
    w- c:\program files\Trend Micro
    2009-06-14 19:49 . 2008-06-19 16:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
    2009-06-14 19:48 . 2009-06-14 19:48
    d
    w- c:\program files\Panda Security
    2009-06-14 19:41 . 2009-06-14 19:41
    d
    w- c:\programdata\CA
    2009-06-11 05:58 . 2009-06-11 05:58
    d
    w- c:\windows\system32\EventProviders
    2009-06-06 06:43 . 2009-06-06 06:43 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb59DD.tmp.exe
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-06-15 19:38 . 2007-03-22 11:44
    d
    w- c:\program files\Common Files\Symantec Shared
    2009-06-12 09:30 . 2008-04-09 17:49
    d
    w- c:\program files\Actinic v9
    2009-06-12 09:23 . 2007-09-22 17:44
    d
    w- c:\program files\Google
    2009-06-11 11:28 . 2009-05-21 15:40
    d
    w- c:\program files\Sage Payroll
    2009-06-10 16:52 . 2009-04-04 12:23
    d
    w- c:\programdata\avg8
    2009-06-03 14:40 . 2009-04-27 07:47 296 ----a-w- c:\users\Karl\AppData\Roaming\wklnhst.dat
    2009-05-17 06:36 . 2008-10-23 13:30
    d
    w- c:\program files\Common Files\Adobe
    2009-05-14 02:06 . 2007-03-22 11:21
    d
    w- c:\programdata\Microsoft Help
    2009-05-14 02:02 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2009-05-08 14:14 . 2007-08-25 14:26 72720 ----a-w- c:\users\Karl\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-05-04 21:35 . 2007-03-22 11:27
    d
    w- c:\program files\Microsoft Works
    2009-04-27 07:47 . 2009-04-27 07:47
    d
    w- c:\users\Karl\AppData\Roaming\Template
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168]
    "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-12-08 614400]
    "eDSMSNfix"="c:\acer\Empowering Technology\eDSMSNfix.exe" [2007-02-08 13312]
    "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-01-17 151552]
    "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-09-22 185632]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-06 177472]
    "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdc.exe" [2007-01-24 563080]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-11 342312]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-01 4390912]
    c:\users\Karl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Actinic.lnk - c:\program files\Actinic v9\Catalog.exe [2008-4-9 8013096]
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-3-22 528384]
    ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2008-11-7 303104]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{9AD97BE8-9399-41D8-A697-4600EF8BD101}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{A466396A-B9D7-44F7-9D60-3BAE64855644}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
    "{B97FC05B-7756-43D0-B0D3-97D89F6D51F5}"= c:\program files\Acer Arcade Deluxe\VideoMagician\MagicDirector.exe:CyberLink MagicDirector
    "{10A600E2-1475-4D64-97C2-BCAE74289E8F}"= c:\program files\Acer Arcade Deluxe\DV Wizard\PowerDV.exe:CyberLink PowerDV
    "{8C75BAA3-A66D-40DA-987C-A9B3E2A42DD6}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{E68602A6-FF59-4238-980E-8F99D65D7629}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{5E9A58C6-B7ED-4494-A333-ED978AF4835B}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{6721F3D9-3D40-4536-B232-296750C50A06}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{CF074D46-D3C3-4A80-A087-9B434555AECE}c:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:c:\program files\sony ericsson\update service\update service.exe:Update Service
    "UDP Query User{10A0EF5D-6A20-4B86-955C-E8317965C78D}c:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:c:\program files\sony ericsson\update service\update service.exe:Update Service
    "{10F65F19-E15D-40EE-96FC-2EBD2C9E7086}"= UDP:990:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
    "{B0FDDB58-3756-4854-A53A-4E766E3A9B52}"= UDP:5721:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}:@%systemroot%\WindowsMobile\wmdc.exe,-4002
    "{DD6D2CA8-183A-4108-A67A-F23662D55636}"= UDP:1034:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}:@%systemroot%\WindowsMobile\wmdc.exe,-4003
    "{6C6012A9-FD93-4DA1-B5BF-D8993D1D1C5C}"= UDP:5678:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004
    "{4B70F91D-C2E3-46CE-820B-F0588057A742}"= UDP:999:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005
    "{8C6EDEE4-A2C1-446E-B3FC-8FEC9598D27F}"= UDP:26675:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}:@%systemroot%\WindowsMobile\wmdc.exe,-4006
    "{102167E4-CD54-405E-9B84-FB87B7A93D72}"= UDP:990:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001
    "TCP Query User{372F81DC-9668-42F7-B301-41C8D9BED41C}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes
    "UDP Query User{3D946B7D-F7F1-4B08-8514-1C28D5CD70B8}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes
    "{AEFFC175-0455-41C6-8928-50814D577FFF}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{10B53F6A-1FF6-40F9-923F-3793A290EC05}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{2876FA54-666D-4FD7-8603-AC5A1939A227}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{2B0A172E-B159-4856-9F1F-2AF88D1B3C27}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{0BACE527-B5C9-4D82-B94A-F5498812EA4F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
    "{43D3CE9F-642D-41D8-A0B3-0DB53FE4FF36}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
    "{20C2079F-3A0D-4D53-B409-612A4BE6676D}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
    "{08951889-4FFA-4290-AA1E-24034A339406}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
    "{D33574B9-0124-4AF4-873C-A1D756907A08}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
    "{7AB542B9-6DD7-4165-A11B-BFBAC10A5630}"= UDP:c:\users\Karl\AppData\Local\Temp\7zSA556.tmp\SymNRT.exe:Norton Removal Tool
    "{F200E580-199C-474A-ADC4-1C21EEEA20F8}"= TCP:c:\users\Karl\AppData\Local\Temp\7zSA556.tmp\SymNRT.exe:Norton Removal Tool
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)
    R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [14/06/2009 20:49 28544]
    R2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [22/03/2007 12:55 50688]
    S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [23/10/2008 14:21 33752]
    S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [14/10/2008 18:25 13352]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    WindowsMobile REG_MULTI_SZ wcescomm rapimgr
    LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder
    2009-06-08 c:\windows\Tasks\User_Feed_Synchronization-{8E0920E2-C760-4A2D-AC35-CB5712466911}.job
    - c:\windows\system32\msfeedssync.exe [2009-03-23 11:31]
    .
    - - - - ORPHANS REMOVED - - - -
    HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe
    HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd
    HKLM-Run-QBCD Autorun - E:\autorun.exe
    HKLM-Run-Acer Tour - (no file)
    HKLM-Run-eRecoveryService - (no file)

    .
    Supplementary Scan
    .
    uStart Page = hxxp://news.bbc.co.uk/
    uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
    mStart Page = hxxp://en.uk.acer.yahoo.com
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    Trusted Zone: paypal.com\www
    DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
    FF - ProfilePath - c:\users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\6t8c7wpu.default\
    FF - prefs.js: browser.startup.homepage - hxxp://news.bbc.co.uk/
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-06-16 03:15
    Windows 6.0.6001 Service Pack 1 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    LOCKED REGISTRY KEYS
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'Explorer.exe'(860)
    c:\windows\system32\MsnChatHook.dll
    c:\windows\system32\ShowErrMsg.dll
    c:\windows\system32\sysenv.dll
    c:\windows\system32\BatchCrypto.dll
    c:\windows\system32\CryptoAPI.dll
    c:\windows\system32\keyManager.dll
    c:\acer\Empowering Technology\EPOWER\SysHook.dll
    .
    Completion time: 2009-06-16 3:19
    ComboFix-quarantined-files.txt 2009-06-16 02:18
    Pre-Run: 5,305,556,992 bytes free
    Post-Run: 5,969,326,080 bytes free
    190 --- E O F --- 2009-05-29 06:42
  • helen_roberts_2
    helen_roberts_2 Posts: 152 Forumite
    alienrik --- did i do it right?

    cheers
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Open notepad and copy/paste the text in RED below

    File::
    c:\programdata\Google\Google Toolbar\Update\gtb59DD.tmp.exe
    c:\users\Karl\AppData\Roaming\wklnhst.dat
    c:\windows\system32\keyManager.dll
    c:\windows\system32\MsnChatHook.dll
    c:\windows\system32\ShowErrMsg.dll
    c:\windows\system32\sysenv.dll
    c:\windows\system32\BatchCrypto.dll
    c:\windows\system32\CryptoAPI.dll
    c:\acer\Empowering Technology\EPOWER\SysHook.dll

    Save this as "CFScript"

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif


    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    :idea:
  • helen_roberts_2
    helen_roberts_2 Posts: 152 Forumite
    ComboFix 09-06-15.04 - Karl 16/06/2009 20:16.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1013.465 [GMT 1:00]
    Running from: c:\users\Karl\Desktop\ComboFix.exe
    Command switches used :: c:\users\Karl\Desktop\CFScript.txt.lnk
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    .

    ((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
    .

    2009-06-16 19:19 . 2009-06-16 19:19
    d
    w- c:\users\Karl\AppData\Local\temp
    2009-06-15 21:19 . 2009-06-15 21:19
    d
    w- c:\windows\Sun
    2009-06-15 21:08 . 2009-06-15 21:11
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-06-15 21:08 . 2009-06-15 21:11
    d
    w- c:\programdata\Spybot - Search & Destroy
    2009-06-15 19:34 . 2009-06-15 19:34
    d
    w- c:\programdata\NortonInstaller
    2009-06-15 15:18 . 2009-06-15 15:18
    d
    w- c:\users\Karl\AppData\Roaming\Malwarebytes
    2009-06-15 15:18 . 2009-05-26 12:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-06-15 15:18 . 2009-06-15 15:18
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-06-15 15:18 . 2009-06-15 15:18
    d
    w- c:\programdata\Malwarebytes
    2009-06-15 15:18 . 2009-05-26 12:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-06-14 19:55 . 2009-06-14 19:55
    d
    w- c:\program files\Trend Micro
    2009-06-14 19:49 . 2008-06-19 16:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
    2009-06-14 19:48 . 2009-06-14 19:48
    d
    w- c:\program files\Panda Security
    2009-06-14 19:41 . 2009-06-14 19:41
    d
    w- c:\programdata\CA
    2009-06-11 05:58 . 2009-06-11 05:58
    d
    w- c:\windows\system32\EventProviders
    2009-06-06 06:43 . 2009-06-06 06:43 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb59DD.tmp.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-06-15 19:38 . 2007-03-22 11:44
    d
    w- c:\program files\Common Files\Symantec Shared
    2009-06-12 09:30 . 2008-04-09 17:49
    d
    w- c:\program files\Actinic v9
    2009-06-12 09:23 . 2007-09-22 17:44
    d
    w- c:\program files\Google
    2009-06-11 11:28 . 2009-05-21 15:40
    d
    w- c:\program files\Sage Payroll
    2009-06-10 16:52 . 2009-04-04 12:23
    d
    w- c:\programdata\avg8
    2009-06-03 14:40 . 2009-04-27 07:47 296 ----a-w- c:\users\Karl\AppData\Roaming\wklnhst.dat
    2009-05-17 06:36 . 2008-10-23 13:30
    d
    w- c:\program files\Common Files\Adobe
    2009-05-14 02:06 . 2007-03-22 11:21
    d
    w- c:\programdata\Microsoft Help
    2009-05-14 02:02 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2009-05-08 14:14 . 2007-08-25 14:26 72720 ----a-w- c:\users\Karl\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-05-04 21:35 . 2007-03-22 11:27
    d
    w- c:\program files\Microsoft Works
    2009-04-27 07:47 . 2009-04-27 07:47
    d
    w- c:\users\Karl\AppData\Roaming\Template
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-06-16_02.15.35 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2006-11-02 13:05 . 2009-06-16 18:07 69468 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    - 2007-08-25 14:27 . 2009-06-16 01:58 10914 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2198491559-500378422-2097851613-1000_UserData.bin
    + 2007-08-25 14:27 . 2009-06-16 18:07 10914 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2198491559-500378422-2097851613-1000_UserData.bin
    - 2009-05-22 05:03 . 2009-06-16 01:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2009-05-22 05:03 . 2009-06-16 18:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2009-05-22 05:03 . 2009-06-16 01:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-05-22 05:03 . 2009-06-16 18:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2007-08-26 13:53 . 2009-06-16 17:00 252988 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    + 2006-11-02 10:33 . 2009-06-16 18:08 638782 c:\windows\System32\perfh009.dat
    - 2006-11-02 10:33 . 2009-06-16 02:00 638782 c:\windows\System32\perfh009.dat
    + 2006-11-02 10:33 . 2009-06-16 18:08 121746 c:\windows\System32\perfc009.dat
    - 2006-11-02 10:33 . 2009-06-16 02:00 121746 c:\windows\System32\perfc009.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168]
    "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-12-08 614400]
    "eDSMSNfix"="c:\acer\Empowering Technology\eDSMSNfix.exe" [2007-02-08 13312]
    "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-01-17 151552]
    "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-09-22 185632]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-06 177472]
    "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdc.exe" [2007-01-24 563080]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-11 342312]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-01 4390912]

    c:\users\Karl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Actinic.lnk - c:\program files\Actinic v9\Catalog.exe [2008-4-9 8013096]
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-3-22 528384]
    ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2008-11-7 303104]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{9AD97BE8-9399-41D8-A697-4600EF8BD101}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{A466396A-B9D7-44F7-9D60-3BAE64855644}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
    "{B97FC05B-7756-43D0-B0D3-97D89F6D51F5}"= c:\program files\Acer Arcade Deluxe\VideoMagician\MagicDirector.exe:CyberLink MagicDirector
    "{10A600E2-1475-4D64-97C2-BCAE74289E8F}"= c:\program files\Acer Arcade Deluxe\DV Wizard\PowerDV.exe:CyberLink PowerDV
    "{8C75BAA3-A66D-40DA-987C-A9B3E2A42DD6}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{E68602A6-FF59-4238-980E-8F99D65D7629}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{5E9A58C6-B7ED-4494-A333-ED978AF4835B}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{6721F3D9-3D40-4536-B232-296750C50A06}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{CF074D46-D3C3-4A80-A087-9B434555AECE}c:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:c:\program files\sony ericsson\update service\update service.exe:Update Service
    "UDP Query User{10A0EF5D-6A20-4B86-955C-E8317965C78D}c:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:c:\program files\sony ericsson\update service\update service.exe:Update Service
    "{10F65F19-E15D-40EE-96FC-2EBD2C9E7086}"= UDP:990:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
    "{B0FDDB58-3756-4854-A53A-4E766E3A9B52}"= UDP:5721:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}:@%systemroot%\WindowsMobile\wmdc.exe,-4002
    "{DD6D2CA8-183A-4108-A67A-F23662D55636}"= UDP:1034:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}:@%systemroot%\WindowsMobile\wmdc.exe,-4003
    "{6C6012A9-FD93-4DA1-B5BF-D8993D1D1C5C}"= UDP:5678:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004
    "{4B70F91D-C2E3-46CE-820B-F0588057A742}"= UDP:999:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005
    "{8C6EDEE4-A2C1-446E-B3FC-8FEC9598D27F}"= UDP:26675:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}:@%systemroot%\WindowsMobile\wmdc.exe,-4006
    "{102167E4-CD54-405E-9B84-FB87B7A93D72}"= UDP:990:LocalSubnet:LocalSubnet|IF={9F1BF94B-BBE6-480C-B0F3-D84C4B97AD51}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001
    "TCP Query User{372F81DC-9668-42F7-B301-41C8D9BED41C}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes
    "UDP Query User{3D946B7D-F7F1-4B08-8514-1C28D5CD70B8}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes
    "{AEFFC175-0455-41C6-8928-50814D577FFF}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{10B53F6A-1FF6-40F9-923F-3793A290EC05}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{2876FA54-666D-4FD7-8603-AC5A1939A227}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{2B0A172E-B159-4856-9F1F-2AF88D1B3C27}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{0BACE527-B5C9-4D82-B94A-F5498812EA4F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
    "{43D3CE9F-642D-41D8-A0B3-0DB53FE4FF36}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
    "{20C2079F-3A0D-4D53-B409-612A4BE6676D}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
    "{08951889-4FFA-4290-AA1E-24034A339406}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
    "{D33574B9-0124-4AF4-873C-A1D756907A08}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
    "{7AB542B9-6DD7-4165-A11B-BFBAC10A5630}"= UDP:c:\users\Karl\AppData\Local\Temp\7zSA556.tmp\SymNRT.exe:Norton Removal Tool
    "{F200E580-199C-474A-ADC4-1C21EEEA20F8}"= TCP:c:\users\Karl\AppData\Local\Temp\7zSA556.tmp\SymNRT.exe:Norton Removal Tool

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    R3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]
    R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2008-10-14 13352]
    S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544]
    S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    WindowsMobile REG_MULTI_SZ wcescomm rapimgr
    LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-06-08 c:\windows\Tasks\User_Feed_Synchronization-{8E0920E2-C760-4A2D-AC35-CB5712466911}.job
    - c:\windows\system32\msfeedssync.exe [2009-03-23 11:31]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://news.bbc.co.uk/
    uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
    mStart Page = hxxp://en.uk.acer.yahoo.com
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    Trusted Zone: paypal.com\www
    DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
    FF - ProfilePath - c:\users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\6t8c7wpu.default\
    FF - prefs.js: browser.startup.homepage - hxxp://news.bbc.co.uk/
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-06-16 20:19
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    LOCKED REGISTRY KEYS

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'Explorer.exe'(1868)
    c:\windows\system32\MsnChatHook.dll
    c:\windows\system32\ShowErrMsg.dll
    c:\windows\system32\sysenv.dll
    c:\windows\system32\BatchCrypto.dll
    c:\windows\system32\CryptoAPI.dll
    c:\windows\system32\keyManager.dll
    c:\acer\Empowering Technology\EPOWER\SysHook.dll
    .
    Completion time: 2009-06-16 20:21
    ComboFix-quarantined-files.txt 2009-06-16 19:21
    ComboFix2.txt 2009-06-16 02:19

    Pre-Run: 5,968,175,104 bytes free
    Post-Run: 5,939,343,360 bytes free

    201 --- E O F --- 2009-05-29 06:42
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 351.1K Banking & Borrowing
  • 253.2K Reduce Debt & Boost Income
  • 453.6K Spending & Discounts
  • 244.1K Work, Benefits & Business
  • 599.1K Mortgages, Homes & Bills
  • 177K Life & Family
  • 257.5K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.1K Discuss & Feedback
  • 37.6K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture