What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Antivir 2010

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi there WTT. This isn't my laptop but i do have permission to do anything i need to it, so that isn't a problem. My friend installed Antivir 2010 and now keeps getting pop-ups saying that he's got 31 infections. Please help in removal of this as it doesn't display in add / remove programs N.B. OS is Legitimate Vista The computer is a Toshiba Satellite Model No. PSLC-0E - 00900DEN Thanks Duey

Attachments:

Post #2
[external image: Posted Image]


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • [external image: Posted Image]
  • Then click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.


Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .
Post #3
As i said earlier

This isn't my laptop but i do have permission to do anything i need to it, so that isn't a problem.

I may not have access to the computer for upto 7 days so please don't lock this topic. I know this is your policy but it seems pointless for you to close it and for me to have to open a new one for every step as I only have limited access to the computer

Thanks

Duey
Post #5 last edited
followed instructions outlined in previous post.

only infections shown in screen shot have been found. no C:\System Volume Information ones. Do i delete all the ones shown?

When i booted the computer, it seemed as if the virus had 'stopped working' (btw. it was off all last night). I've just looked on start menu but it is still there and the uninstall like just opens the program so it would seem that it is still there but just not annoying me today.

Thanks in advance

Duey

Reason for edit 1 - Broken File
Reason for edit 2 - Not described how PC is behaving as requested earlier

Attachments:

Post #9 last edited
MBAM Log As Requested: Malwarebytes' Anti-Malware 1.44 Database version: 3684 Windows 6.0.6001 Service Pack 1 Internet Explorer 8.0.6001.18882 03/02/2010 17:04:49 mbam-log-2010-02-03 (17-04-49).txt Scan type: Quick Scan Objects scanned: 120588 Time elapsed: 4 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 3 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 1 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\Windows\System32\UpdateCheck.dll (Trojan.FakeAlert) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{d34d56e9-b37b-4c37-a854-1ac144592d5c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d34d56e9-b37b-4c37-a854-1ac144592d5c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d34d56e9-b37b-4c37-a854-1ac144592d5c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\Common Files\Uninstall\AV (Rogue.Antivir2010) -> Quarantined and deleted successfully. Files Infected: C:\Windows\System32\UpdateCheck.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Program Files\Common Files\Uninstall\AV\Uninstall.lnk (Rogue.Antivir2010) -> Quarantined and deleted successfully. C:\Users\The Computers Owner\Desktop\Antivir.lnk (Rogue.Antivir2010) -> Quarantined and deleted successfully. C:\Program Files\AV\antivir.exe (Rogue.Antivir2010) -> Quarantined and deleted successfully. Reason For Edit: Removal of Username
Post #10
Lets do one more thing.

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Note: Combofix will run without the Recovery Console installed.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
Post #11 last edited
Quick FYI, The PC is running AVG 9.0 and there is no OFF button for it, shall i leave it running or uninstall it?

Thanks for all your help so far LDTate

Duey

EDIT:
Computer runs the same as

When i booted the computer, it seemed as if the virus had 'stopped working' (btw. it was off all last night). I've just looked on start menu but it is still there and the uninstall like just opens the program so it would seem that it is still there but just not annoying me today

now, the links on the start menu point to nothing when i clicked them a few mins ago before installing ComboFix So it now no longer displays on the start menu. The PC seems fine but from reading other posts, i know to stay with it until i am given the "All Clear"

Thanks

Duey
Post #13
ComboFix Log As Requested…

ComboFix 10-02-03.01 - Me 03/02/2010 17:20:08.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1917.1204 [GMT 0:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\av
c:\program files\Common Files\Uninstall
c:\windows\jestertb.dll

.
((((((((((((((((((((((((( Files Created from 2010-01-03 to 2010-02-03 )))))))))))))))))))))))))))))))
.

2010-02-03 17:26 . 2010-02-03 17:28 ——– d—–w- c:\users\Me\AppData\Local\temp
2010-02-03 17:26 . 2010-02-03 17:26 ——– d—–w- c:\users\User 1\AppData\Local\temp
2010-02-03 17:26 . 2010-02-03 17:26 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-02-03 17:26 . 2010-02-03 17:26 ——– d—–w- c:\users\The Computers Owner\AppData\Local\temp
2010-02-02 19:42 . 2010-02-02 19:43 ——– d—–w- c:\program files\ERUNT
2010-02-02 18:42 . 2010-02-03 17:07 ——– d—–w- c:\users\Me\Tracing
2010-02-02 18:24 . 2010-02-02 18:24 ——– d—–w- c:\users\Me\AppData\Roaming\Yahoo!
2010-02-02 18:24 . 2010-02-02 18:24 ——– d—–w- c:\users\Me\AppData\Local\Toshiba
2010-02-02 18:24 . 2010-02-02 18:24 ——– d—–w- c:\users\Me\AppData\Roaming\ATI
2010-02-02 18:24 . 2010-02-02 18:24 ——– d—–w- c:\users\Me\AppData\Local\ATI
2010-01-27 00:24 . 2010-01-18 11:29 1260800 —-a-w- c:\programdata\avg9\update\backup\avgfrw.exe
2010-01-27 00:24 . 2010-01-18 11:29 3777280 —-a-w- c:\programdata\avg9\update\backup\setup.exe
2010-01-14 13:40 . 2010-01-14 15:24 ——– d—–w- c:\users\User 1\AppData\Local\Microsoft Games
2010-01-13 15:34 . 2009-10-19 14:27 156672 —-a-w- c:\windows\system32\t2embed.dll
2010-01-13 15:34 . 2009-10-19 14:24 72704 —-a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-03 16:08 . 2010-02-03 16:08 ——– d—–w- c:\users\Me\AppData\Roaming\Malwarebytes
2010-02-03 16:08 . 2010-02-03 16:08 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-03 16:08 . 2010-02-03 16:08 ——– d—–w- c:\programdata\Malwarebytes
2010-02-02 17:45 . 2009-12-16 10:48 69 —-a-w- c:\users\The Computers Owner\jagex_runescape_preferences2.dat
2010-02-02 17:45 . 2009-12-16 10:48 69 —-a-w- c:\users\The Computers Owner\jagex_runescape_preferences.dat
2010-01-14 03:00 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-01-07 16:07 . 2010-02-03 16:08 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 . 2010-02-03 16:08 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 06:38 . 2010-01-21 18:21 916480 —-a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-21 18:21 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-21 18:21 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-21 18:21 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2009-12-25 14:43 . 2009-12-25 14:41 ——– d—–w- c:\programdata\Norton
2009-12-25 14:41 . 2009-12-25 14:41 ——– d—–w- c:\programdata\Symantec
2009-12-25 14:41 . 2009-12-25 14:41 ——– d—–w- c:\programdata\NortonInstaller
2009-12-13 16:21 . 2009-12-13 16:21 96960 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-12-13 16:21 . 2009-12-13 14:38 8224 —-a-w- c:\users\User 1\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-13 16:03 . 2009-10-09 19:47 96960 —-a-w- c:\users\The Computers Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-13 16:02 . 2008-02-22 11:23 ——– d—–w- c:\programdata\McAfee
2009-12-13 15:58 . 2008-02-29 12:16 ——– d—–w- c:\programdata\Microsoft Help
2009-12-13 15:50 . 2009-12-13 15:50 ——– d—–w- c:\program files\Microsoft ActiveSync
2009-12-13 15:20 . 2009-12-13 15:20 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-13 15:20 . 2008-02-22 10:44 ——– d—–w- c:\program files\Java
2009-12-13 15:19 . 2009-12-13 15:19 ——– d—–w- c:\users\User 1\AppData\Roaming\DesktopSMS
2009-12-13 15:19 . 2009-12-13 15:19 ——– d—–w- c:\users\User 1\AppData\Roaming\AVG9
2009-12-13 15:14 . 2009-12-13 15:14 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2009-12-13 15:14 . 2009-12-13 15:14 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-13 15:14 . 2009-12-13 15:14 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-13 15:14 . 2009-12-13 15:14 28424 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-13 15:13 . 2009-12-13 15:13 ——– d—–w- c:\program files\AVG
2009-12-13 15:13 . 2009-12-13 15:13 ——– d—–w- c:\programdata\avg9
2009-12-13 15:07 . 2009-10-28 17:09 ——– d—–w- c:\programdata\Yahoo! Companion
2009-12-13 14:48 . 2009-11-22 17:17 ——– d—–w- c:\program files\Full Tilt Poker
2009-12-13 14:39 . 2009-12-13 14:39 ——– d—–w- c:\users\User 1\AppData\Roaming\Yahoo!
2009-12-13 14:39 . 2009-12-13 14:39 ——– d—–w- c:\users\User 1\AppData\Roaming\ATI
2009-12-08 20:12 . 2009-12-08 20:12 ——– d—–w- c:\programdata\WindowsSearch
2009-12-06 19:14 . 2009-12-06 19:14 784136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-05 04:09 . 2009-12-05 04:09 484976 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtb6D9F.tmp.exe
2009-11-09 13:22 . 2009-12-09 03:02 24064 —-a-w- c:\windows\system32\nshhttp.dll
2009-11-09 13:20 . 2009-12-09 03:02 31232 —-a-w- c:\windows\system32\httpapi.dll
2009-11-09 11:04 . 2009-12-09 03:02 411136 —-a-w- c:\windows\system32\drivers\http.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-01-29 430080]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-09 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-13 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-29 4911104]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"NDSTray.exe"="NDSTray.exe" [BU]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-22 1836544]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-10-25 413696]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 571024]

c:\users\User 1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\TOSHIBA\TRDCReminder\TRDCReminder.exe [2007-7-27 389120]

c:\users\Me\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1960473578-385667962-1657965932-1000]
"EnableNotificationsRef"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1960473578-385667962-1657965932-1001]
"EnableNotificationsRef"=dword:00000001

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [13/12/2009 15:14 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\drivers\avgtdix.sys [13/12/2009 15:14 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [13/12/2009 15:13 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [13/12/2009 15:13 285392]
R2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [25/12/2007 13:07 40960]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [03/12/2007 16:03 126976]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [22/02/2008 11:01 7168]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\RTL8187B.sys [10/06/2009 04:52 347648]
S2 gupdate1ca60de1783cbc0;Google Update Service (gupdate1ca60de1783cbc0);c:\program files\Google\Update\GoogleUpdate.exe [09/11/2009 01:43 133104]
.
Contents of the 'Scheduled Tasks' folder

2010-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-09 01:43]

2010-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-09 01:43]

2010-02-03 c:\windows\Tasks\User_Feed_Synchronization-{C0D504FF-692D-48C0-B877-714A6CE56114}.job
- c:\windows\system32\msfeedssync.exe [2010-01-21 04:56]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redire…1&site=home
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\The Computers Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-03 17:28
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i??????T]r{?????V???V???V?0 V?X

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-02-03 17:30:58
ComboFix-quarantined-files.txt 2010-02-03 17:30

Pre-Run: 44,888,829,952 bytes free
Post-Run: 45,398,863,872 bytes free

- - End Of File - - 5A9B6E02910C4C399147D323FE2C9F70


N.B. I have edited this log to remove Usernames (the owner's files are identified by "The Computers Owner", My files (created for the removal of Antivir 2010 are identified as "Me" and "User 1" is another computer user (with limited access)
Post #14
I see 3 anti-virus programs installed.
Which one are you running?

Norton
AVG9
McAfee

Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!
The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.
Also because more than one Antivirus and Firewall installed are not compatible with each other, it can cause system performance problems and a serious system slowdown.
Post #15
Well spotted, i missed this myself :smack: Norton is a paid for one so i will uninstall the other 2. will you need any more logs after i uninstallMcAfee and AVG9? Thanks Duey

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI