Solved I have the same problem on the bad image error every time I open a program

rae_annabanana · Oct 29, 2012

Please help. Every time I open a program this Bad Image error appears.

rae_annabanana · Oct 29, 2012

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2012.10.29.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Aspire 5740 :: ASPIRE5740-PC [administrator]

10/29/2012 3:33:50 PM
mbam-log-2012-10-29 (15-33-50).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 191924
Time elapsed: 11 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 9
HKCR\CLSID\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1246D20-F67B-1A10-485B-9EF1994FAABF} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4F4C5E11-0612-48D2-8055-987992AAC432} (PUP.wxDfast) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Tuto4pc (PUP.Tuto4PC) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1 (PUP.Tuto4PC) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 2
C:\ProgramData\wxDfast (PUP.wxDfast) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\data (PUP.wxDfast) -> Quarantined and deleted successfully.

Files Detected: 13
C:\ProgramData\wxDfast\bhoclass.dll (PUP.DownloadnSave) -> Quarantined and deleted successfully.
C:\ProgramData\ADDICT-THING\bhoclass.dll (PUP.DownloadnSave) -> Quarantined and deleted successfully.
C:\Users\Aspire 5740\AppData\Roaming\Tuto4pc\Tuto4pc\UpdateSangguniStnic.exe (PUP.Tuto4PC) -> Quarantined and deleted successfully.
C:\Users\Aspire 5740\AppData\Roaming\Tuto4pc\Tuto4pc\UpdateSangguniStnicHP.exe (PUP.Tuto4PC) -> Quarantined and deleted successfully.
C:\Users\Aspire 5740\AppData\Local\funmoods.crx (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Aspire 5740\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\background.html (PUP.wxDfast) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\aaijffeddmbhamopmeiogfalebagdokh.crx (PUP.wxDfast) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\content.js (PUP.wxDfast) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\settings.ini (PUP.wxDfast) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\uninstall.exe (PUP.wxDfast) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\data\content.js (PUP.wxDfast) -> Quarantined and deleted successfully.
C:\ProgramData\wxDfast\data\jsondb.js (PUP.wxDfast) -> Quarantined and deleted successfully.

(end)

Jay Pfoutz · Oct 29, 2012

Hello, and welcome to TechSpot.

Please see here for the board rules and other FAQ.

Please feel free to introduce yourself, after you follow the steps below to get started.

Information

From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
If you have already asked for help somewhere, please post the link to the topic you were helped.
We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

Please review the 5-Step removal instructions and post the logs back here for my review.

Also, include this scan:

Download AdwCleaner by Xplode onto your Desktop.

Double click on AdwCleaner.exe to run the tool.
Click on Delete.
A logfile will automatically open after the scan has finished.
Please post the content of that logfile in your reply.
You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.

rae_annabanana · Oct 29, 2012

Hi Sir. Thanks for the reply. I'm still on the GMER scan and still can't finish it yet. I have disconnected from the internet and disabled my AVG during the scan; my laptop though crashes on the middle of the scan. I will try again.

Jay Pfoutz · Oct 29, 2012

Let's try the following:

ComboFix scan

Please download ComboFix

by sUBs
From BleepingComputer.com

Please save the file to your Desktop.

Important information about ComboFix

After the download:

Close any open browsers.
Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.

Running ComboFix:

Double click on ComboFix.exe & follow the prompts.
When ComboFix finishes, it will produce a report for you.
Please post the report, which will launch or be found at "C:\Combo-Fix.txt" in your next reply.

Troubleshooting ComboFix

Safe Mode:

If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

(To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
logo appears. A list of options will appear, select "Safe Mode.")

Re-downloading:

If this doesn't work either, try the same method (above method), but try to download it again, except name
ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

rae_annabanana · Oct 29, 2012

Hi Sir. Here's the ComboFix log report:

rae_annabanana · Oct 29, 2012

ComboFix 12-10-29.05 - Aspire 5740 10/30/2012 5:27.1.4 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1781.841 [GMT 8:00]
Running from: c:\users\Aspire 5740\Downloads\Programs\ComboFix.exe
AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e81b1c58961dfce1.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-09-28 to 2012-10-29 )))))))))))))))))))))))))))))))
.
.
2012-10-29 21:42 . 2012-10-29 21:42--------d-----w-c:\users\Default\AppData\Local\temp
2012-10-29 21:20 . 2012-10-11 14:566918632----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2A2C5CA2-DB99-4D4A-B0A3-8999E9005107}\mpengine.dll
2012-10-29 07:31 . 2012-10-29 07:32--------d-----w-c:\program files\Malwarebytes' Anti-Malware
2012-10-29 07:31 . 2012-09-29 11:5422856----a-w-c:\windows\system32\drivers\mbam.sys
2012-10-29 04:31 . 2012-10-29 06:52--------d-----w-c:\program files\Mozilla Maintenance Service
2012-10-28 14:43 . 2012-10-11 14:566918632----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-27 18:26 . 2012-10-27 18:54--------d-----w-c:\program files\Advanced PC Tweaker
2012-10-26 04:20 . 2012-10-26 04:20--------d-----w-c:\programdata\BROWSE~1
2012-10-26 03:52 . 2012-10-26 03:52--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Babylon
2012-10-26 03:52 . 2012-10-26 03:52--------d-----w-c:\programdata\Babylon
2012-10-25 23:49 . 2012-10-25 23:49--------d-----w-c:\users\Aspire 5740\AppData\Local\Wondershare
2012-10-25 23:49 . 2012-10-25 23:49--------d-----w-c:\program files\Common Files\Wondershare
2012-10-25 23:48 . 2012-10-25 23:49--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Wondershare
2012-10-25 12:33 . 2012-10-25 12:39--------d-----w-c:\users\Aspire 5740\AppData\Roaming\calibre
2012-10-25 10:40 . 2012-10-25 10:41--------d-----w-c:\program files\Amazon
2012-10-24 03:01 . 2012-10-24 03:01740784------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2CF98EB6-5360-4F96-80A1-28AAC70A6A4C}\gapaengine.dll
2012-10-24 03:01 . 2012-01-31 12:44237072------w-c:\windows\system32\MpSigStub.exe
2012-10-24 02:38 . 2012-10-24 02:39--------d-----w-c:\program files\Microsoft Security Client
2012-10-24 02:38 . 2010-04-09 07:241285000----a-w-c:\windows\system32\drivers\tcpip.sys
2012-10-24 02:38 . 2010-04-09 07:24240008----a-w-c:\windows\system32\drivers\netio.sys
2012-10-20 02:54 . 2012-10-20 02:54--------d-----w-c:\users\Aspire 5740\AppData\Local\SlimWare Utilities Inc
2012-10-20 02:52 . 2012-10-25 08:39--------d-----w-c:\program files\SlimCleaner
2012-10-19 09:57 . 2012-10-19 09:57--------d-----w-c:\users\Aspire 5740\AppData\Roaming\ParetoLogic
2012-10-19 09:57 . 2012-10-19 09:57--------d-----w-c:\users\Aspire 5740\AppData\Roaming\DriverCure
2012-10-19 09:56 . 2012-10-19 11:02--------d-----w-c:\programdata\ParetoLogic
2012-10-18 05:30 . 2012-10-18 05:30--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Acapela Group
2012-10-17 19:25 . 2012-10-17 19:25--------d-----w-c:\users\Aspire 5740\AppData\Local\DDMSettings
2012-10-17 17:21 . 2012-10-18 09:14--------d-----w-c:\program files\Common Files\Symantec Shared
2012-10-17 16:43 . 2012-10-18 09:38--------d-----w-c:\programdata\Symantec
2012-10-17 16:43 . 2012-10-18 09:38--------d-----w-c:\programdata\Norton
2012-10-11 03:03 . 2012-10-11 03:0311776----a-w-c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2012-10-11 03:03 . 2012-10-11 03:03150736----a-w-c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2012-10-11 03:02 . 2012-10-11 03:02129176----a-w-c:\program files\Mozilla Firefox\plugins\nprpplugin.dll
2012-10-08 05:14 . 2012-06-02 22:1953784----a-w-c:\windows\system32\wuauclt.exe
2012-10-08 05:14 . 2012-06-02 22:1945080----a-w-c:\windows\system32\wups2.dll
2012-10-08 05:14 . 2012-06-02 22:191933848----a-w-c:\windows\system32\wuaueng.dll
2012-10-08 05:14 . 2012-06-02 22:122422272----a-w-c:\windows\system32\wucltux.dll
2012-10-08 05:14 . 2012-06-02 22:1935864----a-w-c:\windows\system32\wups.dll
2012-10-08 05:14 . 2012-06-02 22:19577048----a-w-c:\windows\system32\wuapi.dll
2012-10-08 05:14 . 2012-06-02 22:1288576----a-w-c:\windows\system32\wudriver.dll
2012-10-08 05:13 . 2012-06-02 07:19171904----a-w-c:\windows\system32\wuwebv.dll
2012-10-08 05:13 . 2012-06-02 07:1233792----a-w-c:\windows\system32\wuapp.exe
2012-10-08 04:27 . 2012-10-08 04:28--------d-----w-c:\programdata\AVG
2012-10-08 04:27 . 2012-10-08 04:27--------d-sh--w-c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2012-10-07 19:45 . 2012-10-07 19:45--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Nitro PDF
2012-10-07 19:43 . 2012-09-12 17:4427152----a-w-c:\windows\system32\nitrolocalmon2.dll
2012-10-07 19:43 . 2012-09-12 17:4418448----a-w-c:\windows\system32\nitrolocalui2.dll
2012-10-07 19:43 . 2012-10-07 19:43--------d-----w-c:\programdata\Nitro PDF
2012-10-07 19:43 . 2012-10-07 19:43--------d-----w-c:\program files\Nitro PDF
2012-10-07 19:43 . 2012-10-07 19:43--------d-----w-c:\program files\Common Files\Nitro PDF
2012-10-07 19:39 . 2009-11-25 19:4749472----a-w-c:\windows\system32\netfxperf.dll
2012-10-07 19:39 . 2009-11-25 19:47297808----a-w-c:\windows\system32\mscoree.dll
2012-10-07 19:39 . 2009-11-25 19:4799176----a-w-c:\windows\system32\PresentationHostProxy.dll
2012-10-07 19:39 . 2009-11-25 19:47295264----a-w-c:\windows\system32\PresentationHost.exe
2012-10-07 19:39 . 2009-11-25 19:471130824----a-w-c:\windows\system32\dfshim.dll
2012-10-07 19:34 . 2012-10-07 19:34--------d-----w-c:\programdata\Freemake
2012-10-07 19:34 . 2012-10-07 19:34--------d-----w-c:\users\Aspire 5740\AppData\Roaming\OpenCandy
2012-10-07 19:34 . 2012-10-07 19:34--------d-----w-c:\program files\Freemake
2012-10-07 01:39 . 2012-10-07 01:39--------d-----w-c:\programdata\Uniblue
2012-10-06 05:50 . 2012-10-08 11:17--------d-----w-c:\users\Aspire 5740\AppData\Local\WMTools Downloaded Files
2012-10-06 05:46 . 2012-10-06 05:46--------d-----w-c:\program files\Movie Maker 2.6
2012-10-04 03:37 . 2012-10-04 03:37--------d-----w-c:\users\Aspire 5740\AppData\Roaming\com.eslevier.saunders.QA.nclexrn.4e.8288D116C4BB0E42CE038F51E5C88B9A1A22B7A0.1
2012-10-01 03:49 . 2012-10-01 03:49--------d-----w-c:\users\Aspire 5740\AppData\Roaming\Kodak
2012-10-01 03:49 . 2012-10-01 03:49--------d-----w-c:\program files\Common Files\Kodak
2012-10-01 03:49 . 2012-10-01 03:49--------d-----w-c:\program files\Kodak
2012-10-01 03:48 . 2012-10-01 03:48--------d-----w-c:\programdata\{C3B35EBF-B1F6-4DE1-9682-ED71913E187B}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-11 03:02 . 2010-07-10 13:44499712----a-w-c:\windows\system32\msvcp71.dll
2012-10-11 03:02 . 2010-07-10 13:44348160----a-w-c:\windows\system32\msvcr71.dll
2012-10-09 15:18 . 2012-06-05 20:42696760----a-w-c:\windows\system32\FlashPlayerApp.exe
2012-10-09 15:18 . 2012-01-17 17:1373656----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-30 14:03 . 2012-08-30 14:0399272----a-w-c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-30 14:03 . 2012-08-30 14:03193552----a-w-c:\windows\system32\drivers\MpFilter.sys
2012-08-27 03:29 . 2012-08-27 03:2920893456----a-w-c:\windows\Camera_Suyin_App_v2.0.7.1_Driver_v5.8.33.501_XP.zip
2012-08-22 11:48 . 2012-08-22 11:4840064----a-w-C:\things_we_said.zip
2012-08-22 11:46 . 2012-08-22 11:46559713----a-w-C:\jellyka_kings_hat.zip
2012-08-03 11:41 . 2012-08-03 11:41739840----a-w-c:\windows\system32\d2d1.dll
2012-08-03 11:41 . 2012-08-03 11:41283648----a-w-c:\windows\system32\XpsGdiConverter.dll
2012-08-03 11:41 . 2012-08-03 11:411619456----a-w-c:\windows\system32\WMVDECOD.DLL
2012-08-03 11:41 . 2012-08-03 11:41135168----a-w-c:\windows\system32\XpsRasterService.dll
2012-08-03 11:41 . 2012-08-03 11:411074176----a-w-c:\windows\system32\DWrite.dll
2012-08-03 11:41 . 2012-08-03 11:41801792----a-w-c:\windows\system32\FntCache.dll
2012-08-03 11:41 . 2012-08-03 11:41728448----a-w-c:\windows\system32\drivers\dxgkrnl.sys
2012-08-03 11:41 . 2012-08-03 11:41219008----a-w-c:\windows\system32\drivers\dxgmms1.sys
2012-08-03 11:41 . 2012-08-03 11:41218624----a-w-c:\windows\system32\d3d10_1core.dll
2012-08-03 11:41 . 2012-08-03 11:41161792----a-w-c:\windows\system32\d3d10_1.dll
2012-08-03 11:41 . 2012-08-03 11:411495040----a-w-c:\windows\system32\ExplorerFrame.dll
2012-08-03 11:41 . 2012-08-03 11:411170944----a-w-c:\windows\system32\d3d10warp.dll
2012-08-03 11:41 . 2012-08-03 11:41107520----a-w-c:\windows\system32\cdd.dll
2012-08-03 11:41 . 2012-08-03 11:41442880----a-w-c:\windows\system32\XpsPrint.dll
2012-08-03 11:41 . 2012-08-03 11:413181568----a-w-c:\windows\system32\mf.dll
2012-08-03 11:41 . 2012-08-03 11:41196608----a-w-c:\windows\system32\mfreadwrite.dll
2012-08-01 18:13 . 2012-08-01 18:1335560----a-w-c:\windows\system32\drivers\hssdrv6.sys
2012-08-01 18:13 . 2012-08-01 18:1333512----a-w-c:\windows\system32\drivers\taphss.sys
2012-10-24 17:50 . 2012-10-29 04:30261600----a-w-c:\program files\mozilla firefox\components\browsercomps.dll
2004-05-07 07:31 . 2012-09-26 17:55348160----a-w-c:\program files\mozilla firefox\components\MSVCR71.DLL
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2011-05-30 16:5021864----a-w-c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-12-29 3462552]
"Adobe Acrobat Synchronizer"="c:\program files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe" [2012-07-27 1261512]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-06-01 5252408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"Facebook Update"="c:\users\Aspire 5740\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-08-28 138096]
"KGShareApp"="c:\program files\Kodak\KODAK Share Button App\KGShare_App.exe" [2012-06-26 394752]
"ChikkaV5"="c:\users\Aspire 5740\AppData\Roaming\Chikka Messenger\Chikka v.5\ChikkaLauncher.exe" [2011-02-25 40960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-28 7862816]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2009-07-22 233472]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-13 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-13 175128]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-13 166424]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2010-02-25 1289296]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2012-07-31 2345592]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-11 1523360]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-07-27 823224]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Tutorials"="c:\program files\Tuto4pc\sangguni.exe" [2012-06-11 3674984]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
.
c:\users\Aspire 5740\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecuteREG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^Aspire 5740^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
backup=c:\windows\pss\Microsoft Office Groove.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
.
R2 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [x]
R2 HssWd;Hotspot Shield Monitoring Service; [x]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv.sys [x]
R3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service; [x]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [x]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 avgfws;AVG Firewall;c:\program files\AVG\AVG10\avgfws.exe [x]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [x]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-05 15:18]
.
2012-10-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1667783729-939607240-2383125832-1000Core.job
- c:\users\Aspire 5740\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-28 10:53]
.
2012-10-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1667783729-939607240-2383125832-1000UA.job
- c:\users\Aspire 5740\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-28 10:53]
.
2012-10-28 c:\windows\Tasks\One-Click Tweak.job
- c:\program files\Advanced PC Tweaker\OneClick.exe [2012-10-27 02:02]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/?affID=112457&tt=4312_8&babsrc=HP_ss&mntrId=d20de60200000000000070f1a1147a62
mStart Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzuyBtD0FtC0AtCtCyEyB0AyCtB0EyCtDtBtN0D0TzutBtDtCtBtDyCtByD&cr=1170999599
IE: &Block This Image (ABP)
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Upload to Facebook
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{98AE5FAC-F128-47F9-B21B-792AA22C52DF}: NameServer = 86.51.34.24 86.51.35.24
TCP: Interfaces\{B189CD74-BFEA-4D7B-ADA0-F82555B91495}: NameServer = 86.51.34.18 86.51.35.18
TCP: Interfaces\{FC2216C1-64ED-463E-A964-13E48F33AECF}: NameServer = 86.51.34.24 86.51.35.24
FF - ProfilePath - c:\users\Aspire 5740\AppData\Roaming\Mozilla\Firefox\Profiles\c5eo8ltr.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - ExtSQL: 2012-09-18 00:44; {1E73965B-8B48-48be-9C8D-68B920ABC1C4}; c:\program files\AVG\AVG10\Firefox4
FF - ExtSQL: 2012-10-08 03:34; fmconverter@gmail.com; c:\program files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox
FF - ExtSQL: 2012-10-11 11:03; {0153E448-190B-4987-BDE1-F256CADA672F}; c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - ExtSQL: 2012-10-17 19:54; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files\DivX\DivX Plus Web Player\firefox\DivXHTML5
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1667783729-939607240-2383125832-1000_Classes\CLSID\{24db6e2c-ffbc-4ebc-b6ca-d0a488754792}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000057
"Therad"=dword:0000000f
.
[HKEY_USERS\S-1-5-21-1667783729-939607240-2383125832-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e7,7f,30,36,b2,cd,d7,1d,16,6f,cb,30,2f,c0,0b,4c,8b,59,1f,f0,f3,
78,9d,c4,10,66,0d,4d,9e,5a,04,b7,9e,3a,25,69,ee,c7,9d,7a,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-10-30 05:44:52
ComboFix-quarantined-files.txt 2012-10-29 21:44
.
Pre-Run: 25,261,367,296 bytes free
Post-Run: 25,354,665,984 bytes free
.
- - End Of File - - DE4CFBB1423C631C22426A2A7A79DDCA

rae_annabanana · Oct 29, 2012

Oh, and the Bad Image error have stopped appearing.

Jay Pfoutz · Oct 30, 2012

Good...moving along here to find more viruses/infection...

TDSSKiller Scan

Please download and run TDSSKiller to your desktop as outlined below:

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

For Windows XP, double-click to start.
For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

-------------------------

Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

------------------------

Click the Start Scan button.

-----------------------

If a suspicious object is detected, the default action will be Skip, click on Continue
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

----------------------

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

--------------------

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

-------------------

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

avast! aswMBR

Please download aswMBR from here

Save aswMBR.exe to your Desktop
Double click aswMBR.exe to run it
Uncheck "Trace disk IO calls".
Click the Scan button to start the scan as illustrated below

Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives.

Once the scan finishes click Save log to save the log to your Desktop
Copy and paste the contents of aswMBR.txt back here for review
Please also find MBR.dat on your Desktop, and rename it to MBRscan.txt. Upload that as well. Do not copy and paste MBR.dat/txt, it needs to be uploaded.

rae_annabanana · Oct 30, 2012

Hi Sir. Here's the TDSS Log.

rae_annabanana · Oct 30, 2012

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-31 07:17:43
-----------------------------
07:17:43.472 OS Version: Windows 6.1.7600
07:17:43.472 Number of processors: 4 586 0x2502
07:17:43.472 ComputerName: ASPIRE5740-PC UserName: Aspire 5740
07:17:44.205 Initialize success
07:17:49.946 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
07:17:49.961 Disk 0 Vendor: TOSHIBA_MK3265GSX GJ002J Size: 305245MB BusType: 11
07:17:49.992 Disk 0 MBR read successfully
07:17:50.008 Disk 0 MBR scan
07:17:50.008 Disk 0 Windows 7 default MBR code
07:17:50.024 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
07:17:50.039 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 99899 MB offset 206848
07:17:50.055 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 205244 MB offset 204800000
07:17:50.070 Disk 0 scanning sectors +625139712
07:17:50.148 Disk 0 scanning C:\Windows\system32\drivers
07:17:57.855 Service scanning
07:18:10.569 Service MpKsl0695d8a9 C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{758CE9C0-9473-470B-89E7-4E71C90531C7}\MpKsl0695d8a9.sys **LOCKED** 32
07:18:25.139 Modules scanning
07:18:35.420 Scan finished successfully
07:19:28.990 Disk 0 MBR has been saved successfully to "C:\Users\Aspire 5740\Desktop\MBR.dat"
07:19:29.006 The log file has been saved successfully to "C:\Users\Aspire 5740\Desktop\aswMBR.txt"

rae_annabanana · Oct 30, 2012

Uhm Sir, I can't seem to find the MBR.dat anywhere.

rae_annabanana · Oct 30, 2012

Oh Sir sorry about that, it's on my desktop and I have renamed it to MBRscan.txt but it doesn't show when I try to upload it. I can't open it as well. It says "VLC can't recognize the input's format:

The format of 'C:\Users\Aspire 5740\Desktop\MBRscan.txt.dat' cannot be detected. Have a look at the log for details." So sorry what do I need to do Sir?

Jay Pfoutz · Oct 31, 2012

That's okay. MBR is clean anyway.

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install, or it will ask to download an installer. Please do so an install it.
Click Start or wait for the scanner to load.
Make sure that the options Remove found threats and the option Scan unwanted applications are checked.
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, there are a couple of things to keep in mind:
1. If NO threats were found, allow the scanner to Uninstall on close and then close the Window.
2. If threats WERE detected, click on List of Threats Found, Export to Text File...save it as ESET-Scan-Log.txt. Click the back button/link, put a checkmark to Uninstall Application on Close and then close the window.
Open the logfile from wherever you saved it
Copy and paste the contents in your next reply.

Any more issues?

We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

Many of the things to note for us would be:

Slow computer
Error messages
Fake antivirus alerts or the icon in the system tray
svchost.exe running at 100%
System crashes or blue screen of death

rae_annabanana · Oct 31, 2012

OK Sir thank you very much.

Other issues would be, my laptop gets blue screen / system crashes frequently; almost everyday these last few days. There was this one time I have to run on Safe Mode otherwise it won't fail to display the terrible blue screen again. I think I did the System Restore and that have fixed it and I can run on normal mode again. But a crash happened again maybe a day after or so. The last time was on Monday I guess when I was running the GMER scan which I was not able to finish because of the crash. Would be pleased to know anything to prevent crashes Sir.

Thank you so much!

Jay Pfoutz · Oct 31, 2012

Upload Dump Files:
Please go to C:\Windows\Minidump and zip up the contents of the folder. Then upload/attach the .zip file with your next post.
Left click on the first minidump file.
Hold down the "Shift" key and left click on the last minidump file.
Right click on the blue highlighted area and select "Send to"
Select "Compressed (zipped) folder" and note where the folder is saved.
Upload that .zip file with your next post.

If you have issues with "Access Denied" errors, try copying the files to your desktop and zipping them up from there. If it still won't let you zip them up, post back for further advice.

If you don't have anything in that folder, please check in C:\Windows for a file named MEMORY.DMP. If you find it, zip it up and upload it to a free file hosting service . I recommend Windows Live SkyDrive - http://skydrive.live.com or another free, file-hosting service. Then post the link to it in your topic so that we can download it.

Then, follow the directions here to set your system for Minidumps (much smaller than the MEMORY.DMP file): http://www.carrona.org/setmini.html

rae_annabanana · Oct 31, 2012

Thank you Sir. Here is the zipped folder:

Jay Pfoutz · Oct 31, 2012

I have a feeling it is related to AVG for some reason. Then again, you're running and out-of-date AVG program. Let's do the following for further diagnosis:

SystemLook x86 scan

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:filefind
kwtyyfow.sys
MpKslc55d90db.sys

Click to expand...
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

rae_annabanana · Oct 31, 2012

SystemLook 30.07.11 by jpshortstuff
Log created at 03:10 on 01/11/2012 by Aspire 5740
Administrator - Elevation successful

========== filefind ==========

Searching for "kwtyyfow.sys"
No files found.

Searching for "MpKslc55d90db.sys"
No files found.

-= EOF =-

Jay Pfoutz · Oct 31, 2012

Please upgrade to the newest version of your AVG software: http://www.avg.com/us-en/upgrade

Have your license key? How to find it - you'll need it to upgrade.

Let me know that's done, and also do the following please:

Verifier:
in an elevated (run as admin) CMD prompt:
VERIFIER /FLAGS 1 /ALL
<reboot>

Please upload any minidumps from subsequent crashes for analysis.
Afterwards, when this is all over, go back to default settings by running:
VERIFIER /RESET

rae_annabanana · Oct 31, 2012

Thank you Sir

I am now on AVG 2013 and I have done the Verifier CMD prompt.

rae_annabanana · Oct 31, 2012

Still going through the ESET scanner Sir. Takes too long though but I will post the log as soon as it's done.

Jay Pfoutz · Nov 1, 2012

Okay. Look forward to it.

rae_annabanana · Nov 5, 2012

Can't seem to finish the ESET scan Sir. My laptop either freezes or shuts down halfway through the scan.

Jay Pfoutz · Nov 5, 2012

Ah, ouch. Let's try the following, so we can make sure the infection is gone...

Kaspersky Virus Removal Tool

The Kaspersky Virus Removal Tool is a scan-and-remove solution from Kaspersky that searches out the most common malware and attempts to remove it from your computer.

Please download the Kaspersky Virus Removal Tool from Kaspersky's Official Link and save it to your Desktop.

Double-click the Setup file to install it on your computer.
Once it has installed, review and accept the agreement and press the Start button.
You will presented with the main interface, but don't scan yet, click the options tab (gear icon):
On the Scan Scope tab, make sure to checkmark all the options, except for the CD/DVD drive:
On the Security Level tab, make sure to move the slider up denoting "Current Security Level: High":
Now, go back to the Automatic Scan tab, and choose "Start Scanning". It may take several hours to complete. Please allow it to do so.
Once done scanning, choose the Report tab (page icon), select Detected Threats tab on left, and choose Disinfect All:
Then, choose Save. Also, in the Automatic Report tab, select Save:
Please post the reports in your next reply.
Once you exit, the tool should uninstall automatically.

Solved I have the same problem on the bad image error every time I open a program

Posts: 22 +0

Posts: 22 +0

Posts: 4,279 +49

Posts: 22 +0

Posts: 4,279 +49

Posts: 22 +0

Posts: 22 +0

Posts: 22 +0

Posts: 4,279 +49

Posts: 22 +0

Attachments

Posts: 22 +0

Posts: 22 +0

Posts: 22 +0

Posts: 4,279 +49

Posts: 22 +0

Posts: 4,279 +49

Posts: 22 +0

Attachments

Posts: 4,279 +49

Posts: 22 +0

Posts: 4,279 +49

Posts: 22 +0

Posts: 22 +0

Posts: 4,279 +49

Posts: 22 +0

Posts: 4,279 +49

Similar threads