TechSpot

I have the same problem on the bad image error every time I open a program

Solved
By rae_annabanana
Oct 29, 2012
Topic Status:
Not open for further replies.
  1. Please help. Every time I open a program this Bad Image error appears. :(
     
  2. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Malwarebytes Anti-Malware 1.65.1.1000
    www.malwarebytes.org

    Database version: v2012.10.29.02

    Windows 7 x86 NTFS
    Internet Explorer 8.0.7600.16385
    Aspire 5740 :: ASPIRE5740-PC [administrator]

    10/29/2012 3:33:50 PM
    mbam-log-2012-10-29 (15-33-50).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 191924
    Time elapsed: 11 minute(s), 10 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 9
    HKCR\CLSID\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4F4C5E11-0612-48D2-8055-987992AAC432} (PUP.wxDfast) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Tuto4pc (PUP.Tuto4PC) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1 (PUP.Tuto4PC) -> Quarantined and deleted successfully.

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 2
    C:\ProgramData\wxDfast (PUP.wxDfast) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\data (PUP.wxDfast) -> Quarantined and deleted successfully.

    Files Detected: 13
    C:\ProgramData\wxDfast\bhoclass.dll (PUP.DownloadnSave) -> Quarantined and deleted successfully.
    C:\ProgramData\ADDICT-THING\bhoclass.dll (PUP.DownloadnSave) -> Quarantined and deleted successfully.
    C:\Users\Aspire 5740\AppData\Roaming\Tuto4pc\Tuto4pc\UpdateSangguniStnic.exe (PUP.Tuto4PC) -> Quarantined and deleted successfully.
    C:\Users\Aspire 5740\AppData\Roaming\Tuto4pc\Tuto4pc\UpdateSangguniStnicHP.exe (PUP.Tuto4PC) -> Quarantined and deleted successfully.
    C:\Users\Aspire 5740\AppData\Local\funmoods.crx (PUP.Funmoods) -> Quarantined and deleted successfully.
    C:\Users\Aspire 5740\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\background.html (PUP.wxDfast) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\aaijffeddmbhamopmeiogfalebagdokh.crx (PUP.wxDfast) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\content.js (PUP.wxDfast) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\settings.ini (PUP.wxDfast) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\uninstall.exe (PUP.wxDfast) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\data\content.js (PUP.wxDfast) -> Quarantined and deleted successfully.
    C:\ProgramData\wxDfast\data\jsondb.js (PUP.wxDfast) -> Quarantined and deleted successfully.

    (end)
     
  3. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello, and welcome to TechSpot.


    [​IMG] Please see here for the board rules and other FAQ.

    Please feel free to introduce yourself, after you follow the steps below to get started.

    Information
    • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
    • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
    • If you have already asked for help somewhere, please post the link to the topic you were helped.
    • We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
    • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.
    Please review the 5-Step removal instructions and post the logs back here for my review.

    Also, include this scan:

    Download AdwCleaner by Xplode onto your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Delete.
    • A logfile will automatically open after the scan has finished.
    • Please post the content of that logfile in your reply.
    • You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.
     
  4. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Hi Sir. Thanks for the reply. I'm still on the GMER scan and still can't finish it yet. I have disconnected from the internet and disabled my AVG during the scan; my laptop though crashes on the middle of the scan. I will try again.
     
  5. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Let's try the following:

    ComboFix scan

    Please download ComboFix[​IMG] by sUBs
    From BleepingComputer.com

    Please save the file to your Desktop.

    Important information about ComboFix


    After the download:
    • Close any open browsers.
    • Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
    • If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.
    Running ComboFix:
    • Double click on ComboFix.exe & follow the prompts.
    • When ComboFix finishes, it will produce a report for you.
    • Please post the report, which will launch or be found at "C:\Combo-Fix.txt" in your next reply.
    Troubleshooting ComboFix

    Safe Mode:

    If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

    (To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
    logo appears. A list of options will appear, select "Safe Mode.")

    Re-downloading:

    If this doesn't work either, try the same method (above method), but try to download it again, except name
    ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

    Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

    NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
     
  6. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Hi Sir. Here's the ComboFix log report:
     
  7. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    ComboFix 12-10-29.05 - Aspire 5740 10/30/2012 5:27.1.4 - x86
    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1781.841 [GMT 8:00]
    Running from: c:\users\Aspire 5740\Downloads\Programs\ComboFix.exe
    AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
    FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
    SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\windows\system32\Cache
    c:\windows\system32\Cache\272512937d9e61a4.fb
    c:\windows\system32\Cache\287204568329e189.fb
    c:\windows\system32\Cache\28bc8f716fd76a47.fb
    c:\windows\system32\Cache\2c53092c95605355.fb
    c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
    c:\windows\system32\Cache\32c84fe32bb74d60.fb
    c:\windows\system32\Cache\3917078cb68ec657.fb
    c:\windows\system32\Cache\590ba23ce359fd0c.fb
    c:\windows\system32\Cache\610289e025a3ee9a.fb
    c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
    c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
    c:\windows\system32\Cache\6d03dad1035885d3.fb
    c:\windows\system32\Cache\a8556537add6dfc5.fb
    c:\windows\system32\Cache\ad10a52aff5e038d.fb
    c:\windows\system32\Cache\c1fa887b03019701.fb
    c:\windows\system32\Cache\c4d28dca2e7648be.fb
    c:\windows\system32\Cache\d201ef9910cd39de.fb
    c:\windows\system32\Cache\d2e94710a5708128.fb
    c:\windows\system32\Cache\d79b9dfe81484ec4.fb
    c:\windows\system32\Cache\e81b1c58961dfce1.fb
    c:\windows\system32\Cache\f998975c9cc711ee.fb
    c:\windows\system32\URTTemp
    c:\windows\system32\URTTemp\msvcr71.dll
    c:\windows\system32\URTTemp\regtlib.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-09-28 to 2012-10-29 )))))))))))))))))))))))))))))))
    .
    .
    2012-10-29 21:42 . 2012-10-29 21:42--------d-----w-c:\users\Default\AppData\Local\temp
    2012-10-29 21:20 . 2012-10-11 14:566918632----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2A2C5CA2-DB99-4D4A-B0A3-8999E9005107}\mpengine.dll
    2012-10-29 07:31 . 2012-10-29 07:32--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-10-29 07:31 . 2012-09-29 11:5422856----a-w-c:\windows\system32\drivers\mbam.sys
    2012-10-29 04:31 . 2012-10-29 06:52--------d-----w-c:\program files\Mozilla Maintenance Service
    2012-10-28 14:43 . 2012-10-11 14:566918632----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2012-10-27 18:26 . 2012-10-27 18:54--------d-----w-c:\program files\Advanced PC Tweaker
    2012-10-26 04:20 . 2012-10-26 04:20--------d-----w-c:\programdata\BROWSE~1
    2012-10-26 03:52 . 2012-10-26 03:52--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Babylon
    2012-10-26 03:52 . 2012-10-26 03:52--------d-----w-c:\programdata\Babylon
    2012-10-25 23:49 . 2012-10-25 23:49--------d-----w-c:\users\Aspire 5740\AppData\Local\Wondershare
    2012-10-25 23:49 . 2012-10-25 23:49--------d-----w-c:\program files\Common Files\Wondershare
    2012-10-25 23:48 . 2012-10-25 23:49--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Wondershare
    2012-10-25 12:33 . 2012-10-25 12:39--------d-----w-c:\users\Aspire 5740\AppData\Roaming\calibre
    2012-10-25 10:40 . 2012-10-25 10:41--------d-----w-c:\program files\Amazon
    2012-10-24 03:01 . 2012-10-24 03:01740784------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2CF98EB6-5360-4F96-80A1-28AAC70A6A4C}\gapaengine.dll
    2012-10-24 03:01 . 2012-01-31 12:44237072------w-c:\windows\system32\MpSigStub.exe
    2012-10-24 02:38 . 2012-10-24 02:39--------d-----w-c:\program files\Microsoft Security Client
    2012-10-24 02:38 . 2010-04-09 07:241285000----a-w-c:\windows\system32\drivers\tcpip.sys
    2012-10-24 02:38 . 2010-04-09 07:24240008----a-w-c:\windows\system32\drivers\netio.sys
    2012-10-20 02:54 . 2012-10-20 02:54--------d-----w-c:\users\Aspire 5740\AppData\Local\SlimWare Utilities Inc
    2012-10-20 02:52 . 2012-10-25 08:39--------d-----w-c:\program files\SlimCleaner
    2012-10-19 09:57 . 2012-10-19 09:57--------d-----w-c:\users\Aspire 5740\AppData\Roaming\ParetoLogic
    2012-10-19 09:57 . 2012-10-19 09:57--------d-----w-c:\users\Aspire 5740\AppData\Roaming\DriverCure
    2012-10-19 09:56 . 2012-10-19 11:02--------d-----w-c:\programdata\ParetoLogic
    2012-10-18 05:30 . 2012-10-18 05:30--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Acapela Group
    2012-10-17 19:25 . 2012-10-17 19:25--------d-----w-c:\users\Aspire 5740\AppData\Local\DDMSettings
    2012-10-17 17:21 . 2012-10-18 09:14--------d-----w-c:\program files\Common Files\Symantec Shared
    2012-10-17 16:43 . 2012-10-18 09:38--------d-----w-c:\programdata\Symantec
    2012-10-17 16:43 . 2012-10-18 09:38--------d-----w-c:\programdata\Norton
    2012-10-11 03:03 . 2012-10-11 03:0311776----a-w-c:\program files\Mozilla Firefox\plugins\nprjplug.dll
    2012-10-11 03:03 . 2012-10-11 03:03150736----a-w-c:\program files\Mozilla Firefox\plugins\nppl3260.dll
    2012-10-11 03:02 . 2012-10-11 03:02129176----a-w-c:\program files\Mozilla Firefox\plugins\nprpplugin.dll
    2012-10-08 05:14 . 2012-06-02 22:1953784----a-w-c:\windows\system32\wuauclt.exe
    2012-10-08 05:14 . 2012-06-02 22:1945080----a-w-c:\windows\system32\wups2.dll
    2012-10-08 05:14 . 2012-06-02 22:191933848----a-w-c:\windows\system32\wuaueng.dll
    2012-10-08 05:14 . 2012-06-02 22:122422272----a-w-c:\windows\system32\wucltux.dll
    2012-10-08 05:14 . 2012-06-02 22:1935864----a-w-c:\windows\system32\wups.dll
    2012-10-08 05:14 . 2012-06-02 22:19577048----a-w-c:\windows\system32\wuapi.dll
    2012-10-08 05:14 . 2012-06-02 22:1288576----a-w-c:\windows\system32\wudriver.dll
    2012-10-08 05:13 . 2012-06-02 07:19171904----a-w-c:\windows\system32\wuwebv.dll
    2012-10-08 05:13 . 2012-06-02 07:1233792----a-w-c:\windows\system32\wuapp.exe
    2012-10-08 04:27 . 2012-10-08 04:28--------d-----w-c:\programdata\AVG
    2012-10-08 04:27 . 2012-10-08 04:27--------d-sh--w-c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
    2012-10-07 19:45 . 2012-10-07 19:45--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Nitro PDF
    2012-10-07 19:43 . 2012-09-12 17:4427152----a-w-c:\windows\system32\nitrolocalmon2.dll
    2012-10-07 19:43 . 2012-09-12 17:4418448----a-w-c:\windows\system32\nitrolocalui2.dll
    2012-10-07 19:43 . 2012-10-07 19:43--------d-----w-c:\programdata\Nitro PDF
    2012-10-07 19:43 . 2012-10-07 19:43--------d-----w-c:\program files\Nitro PDF
    2012-10-07 19:43 . 2012-10-07 19:43--------d-----w-c:\program files\Common Files\Nitro PDF
    2012-10-07 19:39 . 2009-11-25 19:4749472----a-w-c:\windows\system32\netfxperf.dll
    2012-10-07 19:39 . 2009-11-25 19:47297808----a-w-c:\windows\system32\mscoree.dll
    2012-10-07 19:39 . 2009-11-25 19:4799176----a-w-c:\windows\system32\PresentationHostProxy.dll
    2012-10-07 19:39 . 2009-11-25 19:47295264----a-w-c:\windows\system32\PresentationHost.exe
    2012-10-07 19:39 . 2009-11-25 19:471130824----a-w-c:\windows\system32\dfshim.dll
    2012-10-07 19:34 . 2012-10-07 19:34--------d-----w-c:\programdata\Freemake
    2012-10-07 19:34 . 2012-10-07 19:34--------d-----w-c:\users\Aspire 5740\AppData\Roaming\OpenCandy
    2012-10-07 19:34 . 2012-10-07 19:34--------d-----w-c:\program files\Freemake
    2012-10-07 01:39 . 2012-10-07 01:39--------d-----w-c:\programdata\Uniblue
    2012-10-06 05:50 . 2012-10-08 11:17--------d-----w-c:\users\Aspire 5740\AppData\Local\WMTools Downloaded Files
    2012-10-06 05:46 . 2012-10-06 05:46--------d-----w-c:\program files\Movie Maker 2.6
    2012-10-04 03:37 . 2012-10-04 03:37--------d-----w-c:\users\Aspire 5740\AppData\Roaming\com.eslevier.saunders.QA.nclexrn.4e.8288D116C4BB0E42CE038F51E5C88B9A1A22B7A0.1
    2012-10-01 03:49 . 2012-10-01 03:49--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Kodak
    2012-10-01 03:49 . 2012-10-01 03:49--------d-----w-c:\program files\Common Files\Kodak
    2012-10-01 03:49 . 2012-10-01 03:49--------d-----w-c:\program files\Kodak
    2012-10-01 03:48 . 2012-10-01 03:48--------d-----w-c:\programdata\{C3B35EBF-B1F6-4DE1-9682-ED71913E187B}
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-10-11 03:02 . 2010-07-10 13:44499712----a-w-c:\windows\system32\msvcp71.dll
    2012-10-11 03:02 . 2010-07-10 13:44348160----a-w-c:\windows\system32\msvcr71.dll
    2012-10-09 15:18 . 2012-06-05 20:42696760----a-w-c:\windows\system32\FlashPlayerApp.exe
    2012-10-09 15:18 . 2012-01-17 17:1373656----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-08-30 14:03 . 2012-08-30 14:0399272----a-w-c:\windows\system32\drivers\NisDrvWFP.sys
    2012-08-30 14:03 . 2012-08-30 14:03193552----a-w-c:\windows\system32\drivers\MpFilter.sys
    2012-08-27 03:29 . 2012-08-27 03:2920893456----a-w-c:\windows\Camera_Suyin_App_v2.0.7.1_Driver_v5.8.33.501_XP.zip
    2012-08-22 11:48 . 2012-08-22 11:4840064----a-w-C:\things_we_said.zip
    2012-08-22 11:46 . 2012-08-22 11:46559713----a-w-C:\jellyka_kings_hat.zip
    2012-08-03 11:41 . 2012-08-03 11:41739840----a-w-c:\windows\system32\d2d1.dll
    2012-08-03 11:41 . 2012-08-03 11:41283648----a-w-c:\windows\system32\XpsGdiConverter.dll
    2012-08-03 11:41 . 2012-08-03 11:411619456----a-w-c:\windows\system32\WMVDECOD.DLL
    2012-08-03 11:41 . 2012-08-03 11:41135168----a-w-c:\windows\system32\XpsRasterService.dll
    2012-08-03 11:41 . 2012-08-03 11:411074176----a-w-c:\windows\system32\DWrite.dll
    2012-08-03 11:41 . 2012-08-03 11:41801792----a-w-c:\windows\system32\FntCache.dll
    2012-08-03 11:41 . 2012-08-03 11:41728448----a-w-c:\windows\system32\drivers\dxgkrnl.sys
    2012-08-03 11:41 . 2012-08-03 11:41219008----a-w-c:\windows\system32\drivers\dxgmms1.sys
    2012-08-03 11:41 . 2012-08-03 11:41218624----a-w-c:\windows\system32\d3d10_1core.dll
    2012-08-03 11:41 . 2012-08-03 11:41161792----a-w-c:\windows\system32\d3d10_1.dll
    2012-08-03 11:41 . 2012-08-03 11:411495040----a-w-c:\windows\system32\ExplorerFrame.dll
    2012-08-03 11:41 . 2012-08-03 11:411170944----a-w-c:\windows\system32\d3d10warp.dll
    2012-08-03 11:41 . 2012-08-03 11:41107520----a-w-c:\windows\system32\cdd.dll
    2012-08-03 11:41 . 2012-08-03 11:41442880----a-w-c:\windows\system32\XpsPrint.dll
    2012-08-03 11:41 . 2012-08-03 11:413181568----a-w-c:\windows\system32\mf.dll
    2012-08-03 11:41 . 2012-08-03 11:41196608----a-w-c:\windows\system32\mfreadwrite.dll
    2012-08-01 18:13 . 2012-08-01 18:1335560----a-w-c:\windows\system32\drivers\hssdrv6.sys
    2012-08-01 18:13 . 2012-08-01 18:1333512----a-w-c:\windows\system32\drivers\taphss.sys
    2012-10-24 17:50 . 2012-10-29 04:30261600----a-w-c:\program files\mozilla firefox\components\browsercomps.dll
    2004-05-07 07:31 . 2012-09-26 17:55348160----a-w-c:\program files\mozilla firefox\components\MSVCR71.DLL
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
    @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
    [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
    2011-05-30 16:5021864----a-w-c:\program files\Internet Download Manager\IDMShellExt.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
    "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-12-29 3462552]
    "Adobe Acrobat Synchronizer"="c:\program files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe" [2012-07-27 1261512]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]
    "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-06-01 5252408]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
    "Facebook Update"="c:\users\Aspire 5740\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-08-28 138096]
    "KGShareApp"="c:\program files\Kodak\KODAK Share Button App\KGShare_App.exe" [2012-06-26 394752]
    "ChikkaV5"="c:\users\Aspire 5740\AppData\Roaming\Chikka Messenger\Chikka v.5\ChikkaLauncher.exe" [2011-02-25 40960]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-28 7862816]
    "AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2009-07-22 233472]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-13 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-13 175128]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-13 166424]
    "LManager"="c:\program files\Launch Manager\LManager.exe" [2010-02-25 1289296]
    "AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2012-07-31 2345592]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]
    "AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-11 1523360]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-07-27 823224]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
    "Tutorials"="c:\program files\Tuto4pc\sangguni.exe" [2012-06-11 3674984]
    "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
    .
    c:\users\Aspire 5740\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveTrack"= 1 (0x1)
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveTrack"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer9"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecuteREG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKLM\~\startupfolder\C:^Users^Aspire 5740^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
    backup=c:\windows\pss\Microsoft Office Groove.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
    .
    R2 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [x]
    R2 HssWd;Hotspot Shield Monitoring Service; [x]
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
    R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
    R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
    R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
    R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
    R3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv.sys [x]
    R3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv.sys [x]
    R3 MozillaMaintenance;Mozilla Maintenance Service; [x]
    S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
    S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
    S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [x]
    S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
    S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
    S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
    S2 avgfws;AVG Firewall;c:\program files\AVG\AVG10\avgfws.exe [x]
    S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [x]
    S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [x]
    S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [x]
    S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
    S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
    S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
    S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
    S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [x]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-10-29 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-05 15:18]
    .
    2012-10-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1667783729-939607240-2383125832-1000Core.job
    - c:\users\Aspire 5740\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-28 10:53]
    .
    2012-10-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1667783729-939607240-2383125832-1000UA.job
    - c:\users\Aspire 5740\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-28 10:53]
    .
    2012-10-28 c:\windows\Tasks\One-Click Tweak.job
    - c:\program files\Advanced PC Tweaker\OneClick.exe [2012-10-27 02:02]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://search.babylon.com/?affID=112457&tt=4312_8&babsrc=HP_ss&mntrId=d20de60200000000000070f1a1147a62
    mStart Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzuyBtD0FtC0AtCtCyEyB0AyCtB0EyCtDtBtN0D0TzutBtDtCtBtDyCtByD&cr=1170999599
    IE: &Block This Image (ABP)
    IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
    IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Upload to Facebook
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{98AE5FAC-F128-47F9-B21B-792AA22C52DF}: NameServer = 86.51.34.24 86.51.35.24
    TCP: Interfaces\{B189CD74-BFEA-4D7B-ADA0-F82555B91495}: NameServer = 86.51.34.18 86.51.35.18
    TCP: Interfaces\{FC2216C1-64ED-463E-A964-13E48F33AECF}: NameServer = 86.51.34.24 86.51.35.24
    FF - ProfilePath - c:\users\Aspire 5740\AppData\Roaming\Mozilla\Firefox\Profiles\c5eo8ltr.default\
    FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
    FF - ExtSQL: 2012-09-18 00:44; {1E73965B-8B48-48be-9C8D-68B920ABC1C4}; c:\program files\AVG\AVG10\Firefox4
    FF - ExtSQL: 2012-10-08 03:34; fmconverter@gmail.com; c:\program files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox
    FF - ExtSQL: 2012-10-11 11:03; {0153E448-190B-4987-BDE1-F256CADA672F}; c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - ExtSQL: 2012-10-17 19:54; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files\DivX\DivX Plus Web Player\firefox\DivXHTML5
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
    WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
    ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-1667783729-939607240-2383125832-1000_Classes\CLSID\{24db6e2c-ffbc-4ebc-b6ca-d0a488754792}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "Model"=dword:00000057
    "Therad"=dword:0000000f
    .
    [HKEY_USERS\S-1-5-21-1667783729-939607240-2383125832-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
    @Denied: (Full) (Everyone)
    "scansk"=hex(0):e7,7f,30,36,b2,cd,d7,1d,16,6f,cb,30,2f,c0,0b,4c,8b,59,1f,f0,f3,
    78,9d,c4,10,66,0d,4d,9e,5a,04,b7,9e,3a,25,69,ee,c7,9d,7a,00,00,00,00,00,00,\
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2012-10-30 05:44:52
    ComboFix-quarantined-files.txt 2012-10-29 21:44
    .
    Pre-Run: 25,261,367,296 bytes free
    Post-Run: 25,354,665,984 bytes free
    .
    - - End Of File - - DE4CFBB1423C631C22426A2A7A79DDCA
     
  8. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Oh, and the Bad Image error have stopped appearing.
     
  9. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Good...moving along here to find more viruses/infection...

    TDSSKiller Scan

    Please download and run TDSSKiller to your desktop as outlined below:

    Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

    For Windows XP, double-click to start.
    For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

    [​IMG]

    -------------------------

    Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

    [​IMG]

    ------------------------

    Click the Start Scan button.

    [​IMG]

    -----------------------

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue


    [​IMG]

    ----------------------

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.


    [​IMG]


    --------------------

    A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
    Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

    -------------------

    Here's a summary of what to do if you would like to print it out:

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

    avast! aswMBR

    Please download aswMBR from here
    • Save aswMBR.exe to your Desktop
    • Double click aswMBR.exe to run it
    • Uncheck "Trace disk IO calls".
    • Click the Scan button to start the scan as illustrated below
    [​IMG]
    Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives.
    • Once the scan finishes click Save log to save the log to your Desktop
      [​IMG]
    • Copy and paste the contents of aswMBR.txt back here for review
    • Please also find MBR.dat on your Desktop, and rename it to MBRscan.txt. Upload that as well. Do not copy and paste MBR.dat/txt, it needs to be uploaded.
     
  10. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Hi Sir. Here's the TDSS Log.
     

    Attached Files:

  11. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-10-31 07:17:43
    -----------------------------
    07:17:43.472 OS Version: Windows 6.1.7600
    07:17:43.472 Number of processors: 4 586 0x2502
    07:17:43.472 ComputerName: ASPIRE5740-PC UserName: Aspire 5740
    07:17:44.205 Initialize success
    07:17:49.946 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    07:17:49.961 Disk 0 Vendor: TOSHIBA_MK3265GSX GJ002J Size: 305245MB BusType: 11
    07:17:49.992 Disk 0 MBR read successfully
    07:17:50.008 Disk 0 MBR scan
    07:17:50.008 Disk 0 Windows 7 default MBR code
    07:17:50.024 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
    07:17:50.039 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 99899 MB offset 206848
    07:17:50.055 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 205244 MB offset 204800000
    07:17:50.070 Disk 0 scanning sectors +625139712
    07:17:50.148 Disk 0 scanning C:\Windows\system32\drivers
    07:17:57.855 Service scanning
    07:18:10.569 Service MpKsl0695d8a9 C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{758CE9C0-9473-470B-89E7-4E71C90531C7}\MpKsl0695d8a9.sys **LOCKED** 32
    07:18:25.139 Modules scanning
    07:18:35.420 Scan finished successfully
    07:19:28.990 Disk 0 MBR has been saved successfully to "C:\Users\Aspire 5740\Desktop\MBR.dat"
    07:19:29.006 The log file has been saved successfully to "C:\Users\Aspire 5740\Desktop\aswMBR.txt"
     
     
  12. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Uhm Sir, I can't seem to find the MBR.dat anywhere.
     
  13. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Oh Sir sorry about that, it's on my desktop and I have renamed it to MBRscan.txt but it doesn't show when I try to upload it. I can't open it as well. It says "VLC can't recognize the input's format:

    The format of 'C:\Users\Aspire 5740\Desktop\MBRscan.txt.dat' cannot be detected. Have a look at the log for details." So sorry what do I need to do Sir?
     
  14. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    That's okay. MBR is clean anyway. :)

    ESET Online Scan

    Please run a free online scan with the ESET Online Scanner
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • When asked, allow the ActiveX control to install, or it will ask to download an installer. Please do so an install it.
    • Click Start or wait for the scanner to load.
    • Make sure that the options Remove found threats and the option Scan unwanted applications are checked.
    • Click Scan (This scan can take several hours, so please be patient)
    • Once the scan is completed, there are a couple of things to keep in mind:
    • 1. If NO threats were found, allow the scanner to Uninstall on close and then close the Window.
    • 2. If threats WERE detected, click on List of Threats Found, Export to Text File...save it as ESET-Scan-Log.txt. Click the back button/link, put a checkmark to Uninstall Application on Close and then close the window.
    • Open the logfile from wherever you saved it
    • Copy and paste the contents in your next reply.

    Any more issues?

    We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

    Many of the things to note for us would be:

    • Slow computer
    • Error messages
    • Fake antivirus alerts or the icon in the system tray
    • svchost.exe running at 100%
    • System crashes or blue screen of death
     
  15. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    OK Sir thank you very much. :)

    Other issues would be, my laptop gets blue screen / system crashes frequently; almost everyday these last few days. There was this one time I have to run on Safe Mode otherwise it won't fail to display the terrible blue screen again. I think I did the System Restore and that have fixed it and I can run on normal mode again. But a crash happened again maybe a day after or so. The last time was on Monday I guess when I was running the GMER scan which I was not able to finish because of the crash. Would be pleased to know anything to prevent crashes Sir. :) Thank you so much!
     
  16. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Upload Dump Files:
    Please go to C:\Windows\Minidump and zip up the contents of the folder. Then upload/attach the .zip file with your next post.
    Left click on the first minidump file.
    Hold down the "Shift" key and left click on the last minidump file.
    Right click on the blue highlighted area and select "Send to"
    Select "Compressed (zipped) folder" and note where the folder is saved.
    Upload that .zip file with your next post.

    If you have issues with "Access Denied" errors, try copying the files to your desktop and zipping them up from there. If it still won't let you zip them up, post back for further advice.

    If you don't have anything in that folder, please check in C:\Windows for a file named MEMORY.DMP. If you find it, zip it up and upload it to a free file hosting service . I recommend Windows Live SkyDrive - http://skydrive.live.com or another free, file-hosting service. Then post the link to it in your topic so that we can download it.

    Then, follow the directions here to set your system for Minidumps (much smaller than the MEMORY.DMP file): http://www.carrona.org/setmini.html
     
  17. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Thank you Sir. Here is the zipped folder:
     

    Attached Files:

  18. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    I have a feeling it is related to AVG for some reason. Then again, you're running and out-of-date AVG program. Let's do the following for further diagnosis:

    SystemLook x86 scan

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
  19. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    SystemLook 30.07.11 by jpshortstuff
    Log created at 03:10 on 01/11/2012 by Aspire 5740
    Administrator - Elevation successful

    ========== filefind ==========

    Searching for "kwtyyfow.sys"
    No files found.

    Searching for "MpKslc55d90db.sys"
    No files found.

    -= EOF =-
     
  20. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Please upgrade to the newest version of your AVG software: http://www.avg.com/us-en/upgrade

    Have your license key? How to find it - you'll need it to upgrade. :)

    Let me know that's done, and also do the following please:

    Verifier:
    in an elevated (run as admin) CMD prompt:
    VERIFIER /FLAGS 1 /ALL
    <reboot>

    Please upload any minidumps from subsequent crashes for analysis.
    Afterwards, when this is all over, go back to default settings by running:
    VERIFIER /RESET
     
  21. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Thank you Sir :) I am now on AVG 2013 and I have done the Verifier CMD prompt.
     
  22. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Still going through the ESET scanner Sir. Takes too long though but I will post the log as soon as it's done. :)
     
  23. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Okay. Look forward to it. :)
     
  24. rae_annabanana

    rae_annabanana TS Rookie Topic Starter Posts: 23

    Can't seem to finish the ESET scan Sir. My laptop either freezes or shuts down halfway through the scan.
     
  25. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Ah, ouch. Let's try the following, so we can make sure the infection is gone...

    Kaspersky Virus Removal Tool

    The Kaspersky Virus Removal Tool is a scan-and-remove solution from Kaspersky that searches out the most common malware and attempts to remove it from your computer.

    Please download the Kaspersky Virus Removal Tool from Kaspersky's Official Link and save it to your Desktop.

    • Double-click the Setup file to install it on your computer.
    • Once it has installed, review and accept the agreement and press the Start button.
    • You will presented with the main interface, but don't scan yet, click the options tab (gear icon):
      [​IMG]
    • On the Scan Scope tab, make sure to checkmark all the options, except for the CD/DVD drive:
      [​IMG]
    • On the Security Level tab, make sure to move the slider up denoting "Current Security Level: High":
      [​IMG]
    • Now, go back to the Automatic Scan tab, and choose "Start Scanning". It may take several hours to complete. Please allow it to do so.
    • Once done scanning, choose the Report tab (page icon), select Detected Threats tab on left, and choose Disinfect All:
      [​IMG]
    • Then, choose Save. Also, in the Automatic Report tab, select Save:
      [​IMG]
    • Please post the reports in your next reply.
    • Once you exit, the tool should uninstall automatically.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.