WiredWX Christian Hobby Weather Tools
Would you like to react to this message? Create an account in a few clicks or log in to continue.

WiredWX Christian Hobby Weather ToolsLog in

 


Not a valid Win32 Application

2 posters

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Vista Home Premium
Service Pack 1

AMD Athalon X2 Dual core QL-62 2GHz

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Hey. You are running the 1st service pack. There is another one available.

By the looks of this thread: http://social.technet.microsoft.com/Forums/en/itprovistasp/thread/164871b2-46b3-4866-830f-9bf392dc5ad1

tons of people once had trouble. This issue can get resolved by installing Service Pack 2.

Please go to the Windows Update Application. Install any updates. When offered the update for Service Pack 2, please install it.

If you are not offered a SP2, let me know. Then, it would need downloading and installing manually.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Right away. I was having problems with one update, I can't remember which one. Whenever I installed it, My computer crashed, and I had to restore to an earlier date. I ended up doing 40 updates, one by one, and restarting between each, but got all the updates except that one installed. I haven't installed any updates since we started this exercise, so I have 7 to install. Will report back when they are all installed.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
OK. So I downloaded all the updates, one by one, with a restart after each. no problems. I saw a link on the update page about other free microsoft software updates. When I clicked on it, it gave me an update to SP2.
After I had the other updates done, and all restarts, I went for the SP2 update. It sat at 0% complete for 1/2 hour, so I canceled the update. I restarted the computer to try again, and I noticed that it took a LOOOOOONG time to shutdown. It sat at the "Windows is shutting down" page for almost 3 minutes, then shut off. When it restarted, it tried, then shutdown. I ended up having to do a restore to an earlier point to get it to startup. Apparently that point was just before I tried to install SP2.

I will once again restart and try SP2 again and get back shortly.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Now its not giving me the option to update SP2. I downloaded it, but got the same result as usual when I tried to run it Evil or enraged

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I was hoping it would not come to this, but please remove all updates for Windows Vista.

All of them. If some won't remove, I have a way to force remove them. They gotta come off.

Then, we will try to install the service pack.

I fought with Windows Vista to try to remove the Service Pack 2 beta, and install the released service pack. It was tough, but I got it. I know we can do this.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Uninstalling as we speak. 30 down, 90 to go. Sad tearing

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Yeah. Like I said I was hoping it would not come to this.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Is it just the windows updates, or the MS office updates as well?

So far I have one silverlight, and one of three SP1 updates that won't uninstall. I'll update you when I'm done everything I can.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Just Updates for Windows Vista.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Good.

I have 35 left to go, and I have found 3 more that don't give me the option to delete

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I had about 25 updates left to uninstall, and the computer shut down in the middle of uninstalling one. Now it won't start up. I'm going to let it sit, off for about 15 minutes, because it's hot as hell, and I think it may need a rest. as I said, I'll try it again in about 15 mins.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Had to do a system restore to get the computer to start. That means I have to uninstall all 120 updates again.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Hold the phone.

I am investigating this further.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
All windows updates are gone, except for the 5 it would not give me the option of deleting

kb935509
KB937287
KB938371
KB955430
.NET Framework SP1 KB953595

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Oh. Ok.

Can you install Service Pack 2 now?

Try quickly, please. Then, if not worked, then we'll use some power methods.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I have to install SP1 before I can install SP2.

SP1 going in now

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Oh good. Right On!

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
OK. All 3 SP1 files are installed and the only SP2 files I was given the option of (Microsoft.Net framework 2.0 Service Pack 2 Update) has been installed. I'm waiting for your OK before I install any of the other updates.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I just tried to download Avira. The file downloaded, no problems, but I still got the Not a Valid WIN32 Application message

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Install all available Windows Updates, then let me know what happens.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
so far, so good, but I can't figure out why I uninstalled 130 updates, but I only have 72 to install

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
The reason to remove all updates, was to remove the update plaguing the computer from being able to update to Service Pack 2. And since Microsoft does not have an update cleanup tool, they have to be uninstalled manually.

Service Pack 1 and Service Pack 2 have all previously released updates and fix certain incompatibility issues.

The bad part about Vista, is that it does not usually have this type of serious error. But, if it does, it is hard to get back to normal. There was an update in December, where if users installed it, their screen could go black for no reason, and they would only be able to access the task manager.

Hopefully all goes well.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
well, I have all updates installed, but still can't open any downloaded programs. I once again tried to download Avira. and still got the Not a Valid WIN32 Application message. Evil or enraged

Such is my life

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
That's likely. Time to do some fixes and see if we can get it to cooperate.

Download SREng

  • Extract it to Desktop and double click SREngLdr.EXE to run it
  • Select System Repair from the left pane.
  • Click on File Association
  • Select all entries that has an Error status click [Repair]
  • Refer to this image for an example:

    Not a valid Win32 Application - Page 2 SystemRepair_FileAssocs
  • Close SREng now.


NEXT

Please download RBFA to your desktop

  • Double click the program to run it. It will only take a few seconds to run.
  • You will be prompted to press any key at the end to close it
  • Once it is finished, it will remove itself. If not, delete it yourself

Please download DragonFix by DragonMaster Jay, and save it to your Desktop. Right click and Extract All, and save the files to your Desktop.
  • Please disable realtime protection. (If any)
  • Double-click RunFirst.vbs. Follow the prompts and make sure it completes. It will confirm the Restore Point was added.
  • Double-click DragonFix.reg, and follow the prompt(s).
  • Please reboot your computer.


NEXT

Please navigate to this webpage: http://support.microsoft.com/kb/313222 and see the section "Fix it for me" and click the Microsoft Fix-It button. This will download a fix utility to repair the security settings on your computer, due to damages of malware or other harmful system changes. Install the file after download.

==

Then, let me know if you can install programs, like downloads.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
OK. First problem. I downloaded SReng.zip to my flash drive. there are 4 files in the zip. the only thing that extracts is the upload folder. I tried extracting it to different places, same result.

When I ran RBFA, I watched the screen, and everything said Access is Denied. Error occurred while processing ....

Trying to unzip dragonfix, same result as SReng. Will try to unzip to flash drive, then move whole folder to dexktop

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
OK. So I went back to my other computer and unzipped the files to their own folder on the flash drive. worked no problem. Copied the folders to the desktop and ran them. sreng worked as described. rbfa, same result as first time. dragon fix said patches applied.

tried to download avira. not valid win23 app.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Did you run Restore Security?

That one was important.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
yes, I restarted and ran MSFixit. then I downloaded Avast. Not a valid Win32 app.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
If present, uninstall the following Update for Windows Vista: KB952709

Please download and install this:
http://www.microsoft.com/downloads/details.aspx?FamilyId=DF72A9B0-564E-4326-894E-05CBA709CB39

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Done and done. I think the update installed. I didn't get an error message.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I once again tried to download Avast. this time with IE. Still not a valid Win32 Application

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I just fired up m computer for today, and now I have a new login account. it is:

ASP.NET computer account

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Can you log in?

Tell me more details, please.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I tried to log in on it, but there is a password. Any ideas what it may be?

There were two accounts before, Griffin and Guest. Neither had a password. Now there are two accounts. Griffin and ASP.NET computer account. Griffin still has no password, and the desktop is the same as it was. ASP.NET computer account has a password, and I don't know what the password could be.

The new account showed up yesterday after I downloaded the updates.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Ok. It is for Microsoft .net Framework 1.1, which utilizes the account, in case you do work on ASP.net.

You can delete that account via Control Panel > User accounts.

We will replace a few system files.

Go to Start > Search C:\windows\system32\cofire.exe

Let it run. Tell me what happens.

=====

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    Code:


    :filefind
    appidsvc.dll
    apphelp.dll
    dllhost.exe
    es.dll
    imagehlp.dll
    imageres.dll
    imm32.dll
    netapi32.dll
    profapi.dll
    scecli.dll
    comres.dll
    crypt32.dll
    rundll32.exe
    sfc.dll
    svchost.exe
    cngaudit.dll
    beep.sys
    atapi.sys


  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
ok. I ran cofire a couple time. it appeared as nothing happened. I double clicked the link on the search window, and I also right clicked on it and ran as administrator. I know something happened that time, because I was asked for permission to run it. It just doesn't seem that anything happened.

will run systemlook right away

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Hi Dragaonmaster Jay. Here is the Systemlook file

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 09:51 on 26/01/2010 by Griffin (Administrator - Elevation successful)

========== filefind ==========

Searching for "appidsvc.dll"
No files found.

Searching for "apphelp.dll"
C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.0.6002.18005_none_d6fc7cca49dba20f\apphelp.dll --a--- 171008 bytes [10:41 17/09/2009] [06:28 11/04/2009] 1107BD574A84367735FEC38B9BD64E6B
C:\Windows\System32\apphelp.dll --a--- 171008 bytes [02:24 21/01/2008] [02:24 21/01/2008] 53E09730CB6190F6FF7633B8B5B914EC
C:\Windows\winsxs\x86_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.0.6001.18000_none_d51103be4cb9d6c3\apphelp.dll --a--- 171008 bytes [02:24 21/01/2008] [02:24 21/01/2008] 53E09730CB6190F6FF7633B8B5B914EC

Searching for "dllhost.exe"
C:\Windows\System32\dllhost.exe --a--- 7168 bytes [08:50 02/11/2006] [09:45 02/11/2006] BE01E566D1F569AAB32D0335613E1EEA
C:\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.0.6000.16386_none_41ed2cb9f696f0a2\dllhost.exe --a--- 7168 bytes [08:50 02/11/2006] [09:45 02/11/2006] BE01E566D1F569AAB32D0335613E1EEA

Searching for "es.dll"
C:\Windows\ERDNT\cache\es.dll --a--- 269312 bytes [17:30 19/01/2010] [16:26 01/03/2009] 3CB3343D720168B575133A0A20DC2465
C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.0.6002.18005_none_0ed918294edf6b75\es.dll --a--- 268800 bytes [10:42 17/09/2009] [06:28 11/04/2009] 67058C46504BC12D821F38CF99B7B28F
C:\Windows\System32\es.dll --a--- 269312 bytes [00:33 26/01/2010] [05:48 18/04/2008] 3CB3343D720168B575133A0A20DC2465
C:\Windows\winsxs\x86_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.0.6000.16677_none_0ac2b30954c98430\es.dll --a--- 268800 bytes [00:33 26/01/2010] [08:13 19/04/2008] 7B4971C3D43525175A4EA0D143E0412E
C:\Windows\winsxs\x86_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.0.6000.20818_none_0b8e318c6db592d2\es.dll --a--- 268800 bytes [00:33 26/01/2010] [08:27 19/04/2008] 131B7E46A7ACD49CB56BB03917A76DE3
C:\Windows\winsxs\x86_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.0.6001.18000_none_0ced9f1d51bda029\es.dll --a--- 262144 bytes [02:24 21/01/2008] [02:24 21/01/2008] F4BF4FA769DB51B106D2B4B35256988B
C:\Windows\winsxs\x86_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.0.6001.18057_none_0cbe918751dfdd3f\es.dll --a--- 269312 bytes [00:33 26/01/2010] [05:48 18/04/2008] 3CB3343D720168B575133A0A20DC2465
C:\Windows\winsxs\x86_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.0.6001.22162_none_0d385cf46b0a1a47\es.dll --a--- 269312 bytes [00:33 26/01/2010] [05:30 18/04/2008] 776D75AF432C598068CC933C7421171B

Searching for "imagehlp.dll"
C:\Windows\System32\imagehlp.dll --a--- 153088 bytes [02:24 21/01/2008] [02:24 21/01/2008] 8C55A6333DAFAB88E44C040C55179274
C:\Windows\winsxs\x86_microsoft-windows-coreos_31bf3856ad364e35_6.0.6001.18000_none_255246473e514737\imagehlp.dll --a--- 153088 bytes [02:24 21/01/2008] [02:24 21/01/2008] 8C55A6333DAFAB88E44C040C55179274
C:\Windows\winsxs\x86_microsoft-windows-coreos_31bf3856ad364e35_6.0.6002.18005_none_273dbf533b731283\imagehlp.dll --a--- 153088 bytes [02:24 21/01/2008] [02:24 21/01/2008] 8C55A6333DAFAB88E44C040C55179274

Searching for "imageres.dll"
C:\Windows\System32\imageres.dll --a--- 15821312 bytes [07:26 02/11/2006] [09:39 02/11/2006] 111C47816F39A91EAAA18DA0A54E8E63
C:\Windows\winsxs\x86_microsoft-windows-imageres_31bf3856ad364e35_6.0.6000.16386_none_da86e136fafaf563\imageres.dll --a--- 15821312 bytes [07:26 02/11/2006] [09:39 02/11/2006] 111C47816F39A91EAAA18DA0A54E8E63

Searching for "imm32.dll"
C:\Windows\ERDNT\cache\imm32.dll --a--- 114688 bytes [17:30 19/01/2010] [02:24 21/01/2008] EC17194A193CD8E90D27CFB93DFA9A2E
C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-imm32_31bf3856ad364e35_6.0.6002.18005_none_5e419722778cc84e\imm32.dll --a--- 114688 bytes [10:41 17/09/2009] [06:28 11/04/2009] C8BDCECEE082B54F0BAC838BF0A34597
C:\Windows\System32\imm32.dll --a--- 114688 bytes [02:24 21/01/2008] [02:24 21/01/2008] EC17194A193CD8E90D27CFB93DFA9A2E
C:\Windows\winsxs\x86_microsoft-windows-imm32_31bf3856ad364e35_6.0.6001.18000_none_5c561e167a6afd02\imm32.dll --a--- 114688 bytes [02:24 21/01/2008] [02:24 21/01/2008] EC17194A193CD8E90D27CFB93DFA9A2E

Searching for "netapi32.dll"
C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-netapi32_31bf3856ad364e35_6.0.6002.18005_none_8f1f941efeb1a97e\netapi32.dll --a--- 467456 bytes [10:41 17/09/2009] [06:28 11/04/2009] C94108296530A097B2E1E18C101E4703
C:\Windows\System32\netapi32.dll --a--- 466944 bytes [00:33 26/01/2010] [04:47 16/10/2008] F1011BD3AAD22375F34CF48CACD483C1
C:\Windows\winsxs\x86_microsoft-windows-netapi32_31bf3856ad364e35_6.0.6000.16764_none_8b10fff30496576a\netapi32.dll --a--- 425472 bytes [00:33 26/01/2010] [04:40 16/10/2008] E3AFCA30714898BAAE6F12B52627761C
C:\Windows\winsxs\x86_microsoft-windows-netapi32_31bf3856ad364e35_6.0.6000.20937_none_8bbe0f461d98ec8d\netapi32.dll --a--- 425984 bytes [00:33 26/01/2010] [04:22 16/10/2008] 687062AB65F8198F5277C1E3D1180C6B
C:\Windows\winsxs\x86_microsoft-windows-netapi32_31bf3856ad364e35_6.0.6001.18000_none_8d341b13018fde32\netapi32.dll --a--- 466944 bytes [02:23 21/01/2008] [02:23 21/01/2008] E051BBF1F08211310C20EDC2AA4648C7
C:\Windows\winsxs\x86_microsoft-windows-netapi32_31bf3856ad364e35_6.0.6001.18157_none_8d050f6301b2186f\netapi32.dll --a--- 466944 bytes [00:33 26/01/2010] [04:47 16/10/2008] F1011BD3AAD22375F34CF48CACD483C1
C:\Windows\winsxs\x86_microsoft-windows-netapi32_31bf3856ad364e35_6.0.6001.22288_none_8d6f3cb41ae72563\netapi32.dll --a--- 466944 bytes [00:33 26/01/2010] [04:38 16/10/2008] DCD3615E4785692EAB6EA4D3A21E1574

Searching for "profapi.dll"
No files found.

Searching for "scecli.dll"
C:\Windows\ERDNT\cache\scecli.dll --a--- 177152 bytes [17:30 19/01/2010] [02:24 21/01/2008] 28B84EB538F7E8A0FE8B9299D591E0B9
C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll --a--- 177152 bytes [10:41 17/09/2009] [06:28 11/04/2009] 8FC182167381E9915651267044105EE1
C:\Windows\System32\scecli.dll --a--- 177152 bytes [02:24 21/01/2008] [02:24 21/01/2008] 28B84EB538F7E8A0FE8B9299D591E0B9
C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll --a--- 177152 bytes [02:24 21/01/2008] [02:24 21/01/2008] 28B84EB538F7E8A0FE8B9299D591E0B9

Searching for "comres.dll"
C:\Windows\System32\comres.dll --a--- 1291264 bytes [02:24 21/01/2008] [02:24 21/01/2008] 4211249955AF9133E2E357CC92B54DFD
C:\Windows\winsxs\x86_microsoft-windows-com-complus.res_31bf3856ad364e35_6.0.6001.18000_none_2cb0dad7e631d923\comres.dll --a--- 1291264 bytes [02:24 21/01/2008] [02:24 21/01/2008] 4211249955AF9133E2E357CC92B54DFD

Searching for "crypt32.dll"
C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.0.6002.18005_none_5d5b3ae7daf59226\crypt32.dll --a--- 978944 bytes [10:42 17/09/2009] [06:28 11/04/2009] 6659EC6006FD99A3AF1B8A6306F8BE3C
C:\Windows\System32\crypt32.dll --a--- 977408 bytes [02:24 21/01/2008] [02:24 21/01/2008] D4D86075510C02F887528207D8E0D713
C:\Windows\winsxs\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.0.6001.18000_none_5b6fc1dbddd3c6da\crypt32.dll --a--- 977408 bytes [02:24 21/01/2008] [02:24 21/01/2008] D4D86075510C02F887528207D8E0D713

Searching for "rundll32.exe"
C:\Windows\System32\rundll32.exe --a--- 44544 bytes [08:48 02/11/2006] [09:45 02/11/2006] 4B555106290BD117334E9A08761C035A
C:\Windows\winsxs\x86_microsoft-windows-rundll32_31bf3856ad364e35_6.0.6000.16386_none_d5ce8f93adff8210\rundll32.exe --a--- 44544 bytes [08:48 02/11/2006] [09:45 02/11/2006] 4B555106290BD117334E9A08761C035A

Searching for "sfc.dll"
C:\Windows\ERDNT\cache\sfc.dll --a--- 4608 bytes [17:30 19/01/2010] [09:46 02/11/2006] F4E1AA5D59C849A4AB47E895DC76B9C8
C:\Windows\System32\sfc.dll --a--- 4608 bytes [08:33 02/11/2006] [09:46 02/11/2006] F4E1AA5D59C849A4AB47E895DC76B9C8
C:\Windows\winsxs\x86_microsoft-windows-sfc_31bf3856ad364e35_6.0.6001.18000_none_a735c34c5c31a578\sfc.dll --a--- 4608 bytes [08:33 02/11/2006] [09:46 02/11/2006] F4E1AA5D59C849A4AB47E895DC76B9C8

Searching for "svchost.exe"
C:\Windows\ERDNT\cache\svchost.exe --a--- 21504 bytes [17:30 19/01/2010] [02:23 21/01/2008] 3794B461C45882E06856F282EEF025AF
C:\Windows\System32\svchost.exe --a--- 21504 bytes [02:23 21/01/2008] [02:23 21/01/2008] 3794B461C45882E06856F282EEF025AF
C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe --a--- 21504 bytes [02:23 21/01/2008] [02:23 21/01/2008] 3794B461C45882E06856F282EEF025AF

Searching for "cngaudit.dll"
C:\Windows\ERDNT\cache\cngaudit.dll --a--- 11776 bytes [17:30 19/01/2010] [09:46 02/11/2006] 7F15B4953378C8B5161D65C26D5FED4D
C:\Windows\System32\cngaudit.dll --a--- 11776 bytes [08:43 02/11/2006] [09:46 02/11/2006] 7F15B4953378C8B5161D65C26D5FED4D
C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll --a--- 11776 bytes [08:43 02/11/2006] [09:46 02/11/2006] 7F15B4953378C8B5161D65C26D5FED4D

Searching for "beep.sys"
C:\Windows\ERDNT\cache\beep.sys --a--- 6144 bytes [17:30 19/01/2010] [02:23 21/01/2008] 67E506B75BD5326A3EC7B70BD014DFB6
C:\Windows\System32\drivers\beep.sys --a--- 6144 bytes [02:23 21/01/2008] [02:23 21/01/2008] 67E506B75BD5326A3EC7B70BD014DFB6
C:\Windows\winsxs\x86_microsoft-windows-beepsys_31bf3856ad364e35_6.0.6001.18000_none_c420a153079d485b\beep.sys --a--- 6144 bytes [02:23 21/01/2008] [02:23 21/01/2008] 67E506B75BD5326A3EC7B70BD014DFB6

Searching for "atapi.sys"
C:\Windows\ERDNT\cache\atapi.sys --a--- 21560 bytes [17:30 19/01/2010] [02:23 21/01/2008] 2D9C903DC76A66813D350A562DE40ED9
C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys --a--- 19944 bytes [10:41 17/09/2009] [06:32 11/04/2009] 1F05B78AB91C9075565A9D8A4B880BC4
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys --a--- 19048 bytes [10:25 02/11/2006] [09:49 02/11/2006] 4F4FCB8B6EA06784FB6D475B7EC7300F
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys --a--- 21560 bytes [02:23 21/01/2008] [02:23 21/01/2008] 2D9C903DC76A66813D350A562DE40ED9
C:\Windows\System32\drivers\atapi.sys --a--- 21560 bytes [02:23 21/01/2008] [02:23 21/01/2008] 2D9C903DC76A66813D350A562DE40ED9
C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys --a--- 21560 bytes [02:23 21/01/2008] [02:23 21/01/2008] 2D9C903DC76A66813D350A562DE40ED9

-=End Of File=-

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix when you've accomplished that.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Thanks DragonMaster Jay. Here's the Combofix log.

ComboFix 10-01-26.02 - Griffin 26/01/2010 14:10:02.4.2 - x86
Microsoft®️ Windows Vista™️ Home Premium 6.0.6001.1.1252.2.1033.18.2814.1715 [GMT -8:00]
Running from: c:\users\Griffin\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2009-12-26 to 2010-01-26 )))))))))))))))))))))))))))))))
.

2010-01-26 22:21 . 2010-01-26 22:21 -------- d-----w- c:\users\Griffin\AppData\Local\temp
2010-01-26 22:21 . 2010-01-26 22:21 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-26 22:21 . 2010-01-26 22:21 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-01-26 22:21 . 2010-01-26 22:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-26 16:45 . 2010-01-19 13:13 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-26 16:45 . 2010-01-19 11:42 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-26 16:45 . 2010-01-19 11:43 23248 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-26 16:45 . 2010-01-19 11:46 46544 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-26 16:45 . 2010-01-19 11:43 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-01-26 16:44 . 2010-01-19 11:57 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-26 16:44 . 2010-01-19 11:57 152672 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-26 16:44 . 2010-01-26 16:44 -------- d-----w- c:\programdata\Alwil Software
2010-01-26 16:44 . 2010-01-26 16:44 -------- d-----w- c:\program files\Alwil Software
2010-01-26 04:59 . 2010-01-26 04:59 -------- d-----w- c:\users\Griffin\Upload
2010-01-26 02:07 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2010-01-26 02:07 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-01-26 00:55 . 2009-10-29 09:41 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-26 00:42 . 2009-11-09 13:20 31232 ----a-w- c:\windows\system32\httpapi.dll
2010-01-26 00:42 . 2009-11-09 11:04 411136 ----a-w- c:\windows\system32\drivers\http.sys
2010-01-26 00:36 . 2008-10-29 06:29 2927104 ----a-w- c:\windows\explorer.exe
2010-01-26 00:36 . 2009-03-17 03:38 13824 ----a-w- c:\windows\system32\apilogen.dll
2010-01-26 00:36 . 2009-03-17 03:38 24064 ----a-w- c:\windows\system32\amxread.dll
2010-01-26 00:36 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-01-26 00:35 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2010-01-26 00:35 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2010-01-26 00:35 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2010-01-26 00:33 . 2009-06-10 12:11 2868224 ----a-w- c:\windows\system32\mf.dll
2010-01-26 00:22 . 2009-08-31 13:55 428544 ----a-w- c:\windows\system32\EncDec.dll
2010-01-26 00:21 . 2009-10-07 12:41 244224 ----a-w- c:\windows\system32\rastls.dll
2010-01-26 00:21 . 2009-10-07 12:41 281600 ----a-w- c:\windows\system32\raschap.dll
2010-01-26 00:21 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-01-26 00:21 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2010-01-26 00:21 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2010-01-25 17:20 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2010-01-25 17:20 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-01-25 17:20 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-01-25 17:20 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2010-01-25 17:20 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2010-01-25 17:20 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2010-01-25 17:20 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2010-01-25 17:11 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2010-01-25 17:11 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2010-01-25 17:11 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2010-01-25 17:10 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2010-01-25 17:10 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2010-01-23 00:26 . 2010-01-23 00:26 680 ----a-w- c:\users\Griffin\AppData\Local\d3d9caps.dat
2010-01-22 04:56 . 2006-04-11 08:49 118784 ----a-w- c:\windows\system32\PTTreeIcons.dll
2010-01-22 04:11 . 2010-01-22 04:11 -------- d-----w- c:\windows\Sun
2010-01-22 03:06 . 2010-01-22 03:06 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-01-21 01:33 . 2010-01-21 01:33 -------- d-----w- c:\program files\Common Files\Skype
2010-01-20 03:43 . 2010-01-20 03:43 -------- d-----w- c:\program files\ESET
2010-01-19 23:46 . 2010-01-24 16:14 -------- d-----w- c:\users\Griffin\AppData\Roaming\skypePM
2010-01-19 23:43 . 2010-01-24 16:14 -------- d-----w- c:\users\Griffin\AppData\Roaming\Skype
2010-01-19 23:43 . 2010-01-21 01:34 -------- d-----r- c:\program files\Skype
2010-01-19 23:42 . 2010-01-21 01:33 -------- d-----w- c:\programdata\Skype
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- c:\users\Griffin\AppData\Roaming\Malwarebytes
2010-01-19 15:17 . 2010-01-08 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- c:\programdata\Malwarebytes
2010-01-19 15:17 . 2010-01-08 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-19 06:00 . 2010-01-19 06:00 -------- d-----w- c:\windows\McAfee.com
2010-01-19 05:04 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2010-01-19 00:10 . 2009-11-09 13:22 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-01-19 00:08 . 2009-10-19 14:24 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-01-19 00:06 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2010-01-18 23:24 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll
2010-01-18 23:23 . 2009-08-05 14:22 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-01-18 23:23 . 2009-08-05 14:22 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-01-18 23:23 . 2009-08-10 11:01 1399296 ----a-w- c:\windows\system32\msxml6.dll
2010-01-18 23:23 . 2009-08-10 11:00 1257472 ----a-w- c:\windows\system32\msxml3.dll
2010-01-10 01:06 . 2010-01-10 01:08 -------- d-----w- c:\users\Griffin\AppData\Roaming\QuickScan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 14:40 . 2009-01-04 00:44 72056 ----a-w- c:\users\Griffin\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-26 01:04 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-26 01:04 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-01-25 04:08 . 2009-06-30 21:28 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-24 16:08 . 2008-08-19 09:14 -------- d-----w- c:\program files\Microsoft Works
2010-01-22 04:56 . 2009-12-13 04:52 -------- d-----w- c:\program files\Snap 'n Share
2010-01-14 19:12 . 2009-10-03 09:21 181120 ----a-w- c:\windows\system32\MpSigStub.exe
2010-01-02 06:38 . 2010-01-26 00:22 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-26 00:22 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-26 00:22 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-26 00:22 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-13 04:54 . 2008-08-19 02:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-08 01:02 . 2009-01-04 00:43 -------- d-----w- c:\program files\Google
2009-12-03 17:03 . 2009-06-10 00:29 -------- d-----w- c:\program files\Java
2009-12-03 14:29 . 2008-08-19 09:12 -------- d-----w- c:\programdata\Microsoft Help
2009-11-30 16:34 . 2009-05-08 02:43 -------- d-----w- c:\programdata\avg8
2009-11-30 14:58 . 2009-11-30 14:58 -------- d-----w- c:\programdata\avg9
2009-11-30 14:58 . 2009-05-08 02:43 -------- d-----w- c:\program files\AVG
2009-11-09 01:15 . 2009-11-09 01:15 95 ----a-w- c:\users\Griffin\AppData\Local\fusioncache.dat
2009-11-09 01:07 . 2009-11-09 01:07 9662 ----a-r- c:\users\Griffin\AppData\Roaming\Microsoft\Installer\{21209AE8-1E93-4289-A88F-5EE0F22CF9F8}\ARPPRODUCTICON.exe
2009-11-09 01:07 . 2009-11-09 01:07 49152 ----a-r- c:\users\Griffin\AppData\Roaming\Microsoft\Installer\{21209AE8-1E93-4289-A88F-5EE0F22CF9F8}\NewShortcut7_21209AE81E934289A88F5EE0F22CF9F8_1.exe
2009-11-09 01:07 . 2009-11-09 01:07 49152 ----a-r- c:\users\Griffin\AppData\Roaming\Microsoft\Installer\{21209AE8-1E93-4289-A88F-5EE0F22CF9F8}\NewShortcut1_21209AE81E934289A88F5EE0F22CF9F8_6.exe
2009-11-06 16:47 . 2009-11-26 00:20 2064152 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-11-03 16:47 . 2009-11-26 00:20 3513624 ----a-w- c:\programdata\avg8\update\backup\avgui.exe
2009-11-03 16:47 . 2009-11-26 00:20 2028312 ----a-w- c:\programdata\avg8\update\backup\avgtray.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-15 01:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-21 6144000]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"Acer Product Registration"="c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392]
"LXCFCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-09-14 73728]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-26 2029336]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)
"NoChangeAnimation"= 0 (0x0)
"NoThumbnailCache"= 1 (0x1)
"NoDevMgrUpdate"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-05-30 00:44 167936 ------w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
2008-05-15 01:05 526896 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R1 aswSP;aswSP;c:\windows\System32\drivers\aswSP.sys [26/01/2010 8:45 AM 162640]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [07/05/2009 6:44 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [07/05/2009 6:44 PM 108552]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [19/08/2008 1:39 AM 61424]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [26/01/2010 8:45 AM 19024]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [26/01/2010 8:45 AM 51792]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [19/08/2008 1:40 AM 81504]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [19/08/2008 1:36 AM 24576]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [19/08/2008 1:40 AM 122368]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [28/03/2008 3:44 AM 210432]
R3 usbfilter;AMD USB Filter Driver;c:\windows\System32\drivers\usbfilter.sys [03/01/2009 4:44 PM 22072]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/05/2009 6:43 PM 297752]
S3 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 12:11 PM 16384]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [25/04/2008 8:36 PM 45056]
S3 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [25/04/2008 8:36 PM 131072]
S3 SQTECH9090;TOP Cam;c:\windows\System32\drivers\Capt9090.sys [12/12/2009 8:54 PM 48384]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&s=2&o=vp32&d=0309&m=aspire_5535
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Griffin\AppData\Roaming\Mozilla\Firefox\Profiles\ke765pq8.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Griffin\AppData\Roaming\Mozilla\Firefox\Profiles\ke765pq8.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 14:21
Windows 6.0.6001 Service Pack 1 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCFCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hȋdden files ...


c:\windows\TEMP\TMP00000068F6791C1F05093070 524288 bytes executable

scan completed successfully
hȋdden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(1560)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
c:\program files\Adobe\Reader 8.0\Reader\viewerps.dll
.
Completion time: 2010-01-26 14:26:16
ComboFix-quarantined-files.txt 2010-01-26 22:26
ComboFix2.txt 2010-01-21 23:53
ComboFix3.txt 2010-01-21 23:10
ComboFix4.txt 2010-01-19 17:31

Pre-Run: 64,375,279,616 bytes free
Post-Run: 64,078,794,752 bytes free

- - End Of File - - 5A096EA286C825FD6399543177865D88

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I just found that if I go to a site that has a link with a javascript, at the bottom of the screen, I get javascript void, and nothing happens. My wife tried to send an e-mail from shawmail, and not only would it not create it, but when she logged out, she couldn't open any programs. I had to log out of windows, and go back in to open firefox.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Re-running ComboFix to remove infections:

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:
    Registry::
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "ForceStartMenuLogOff"="0"

    NetSvc::
    SQTECH9090

    File::
    c:\windows\System32\drivers\Capt9090.sys
    c:\windows\System32\SysHook.dll

    RegLockDel::
    [-HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
  4. Save this as CFScript.txt, in the same location as ComboFix.exe

    Not a valid Win32 Application - Page 2 2v3rg44

  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


Also, I noticed a broken installation of McAfee and AVG. Did you mean to install both of those? Or tried?

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
The computer had McAfee when it was purchased. When the license ran out, I uninstalled it. then I put AVG on. When my computer was unable to run downloaded files, I couldn't upgrade my AVG. So just in the last few days I tried to uninstall it, and installed Avast.

ComboFix 10-01-26.02 - Griffin 26/01/2010 22:11:14.5.2 - x86
Microsoft®️ Windows Vista™️ Home Premium 6.0.6001.1.1252.2.1033.18.2814.1854 [GMT -8:00]
Running from: c:\users\Griffin\Desktop\ComboFix.exe
Command switches used :: c:\users\Griffin\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\System32\drivers\Capt9090.sys"
"c:\windows\System32\SysHook.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\System32\drivers\Capt9090.sys
c:\windows\System32\SysHook.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SQTECH9090


((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.

2010-01-27 06:22 . 2010-01-27 06:24 -------- d-----w- c:\users\Griffin\AppData\Local\temp
2010-01-27 06:22 . 2010-01-27 06:22 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-27 06:22 . 2010-01-27 06:22 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-01-27 06:22 . 2010-01-27 06:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-26 16:45 . 2010-01-19 13:13 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-26 16:45 . 2010-01-19 11:42 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-26 16:45 . 2010-01-19 11:43 23248 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-26 16:45 . 2010-01-19 11:46 46544 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-26 16:45 . 2010-01-19 11:43 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-01-26 16:44 . 2010-01-19 11:57 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-01-26 16:44 . 2010-01-19 11:57 152672 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-26 16:44 . 2010-01-26 16:44 -------- d-----w- c:\programdata\Alwil Software
2010-01-26 16:44 . 2010-01-26 16:44 -------- d-----w- c:\program files\Alwil Software
2010-01-26 04:59 . 2010-01-26 04:59 -------- d-----w- c:\users\Griffin\Upload
2010-01-26 02:07 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2010-01-26 02:07 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-01-26 00:55 . 2009-10-29 09:41 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-26 00:42 . 2009-11-09 13:20 31232 ----a-w- c:\windows\system32\httpapi.dll
2010-01-26 00:42 . 2009-11-09 11:04 411136 ----a-w- c:\windows\system32\drivers\http.sys
2010-01-26 00:36 . 2008-10-29 06:29 2927104 ----a-w- c:\windows\explorer.exe
2010-01-26 00:36 . 2009-03-17 03:38 13824 ----a-w- c:\windows\system32\apilogen.dll
2010-01-26 00:36 . 2009-03-17 03:38 24064 ----a-w- c:\windows\system32\amxread.dll
2010-01-26 00:36 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-01-26 00:35 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2010-01-26 00:35 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2010-01-26 00:35 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2010-01-26 00:33 . 2009-06-10 12:11 2868224 ----a-w- c:\windows\system32\mf.dll
2010-01-26 00:22 . 2009-08-31 13:55 428544 ----a-w- c:\windows\system32\EncDec.dll
2010-01-26 00:21 . 2009-10-07 12:41 244224 ----a-w- c:\windows\system32\rastls.dll
2010-01-26 00:21 . 2009-10-07 12:41 281600 ----a-w- c:\windows\system32\raschap.dll
2010-01-26 00:21 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-01-26 00:21 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2010-01-26 00:21 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2010-01-25 17:20 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2010-01-25 17:20 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-01-25 17:20 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-01-25 17:20 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2010-01-25 17:20 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2010-01-25 17:20 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2010-01-25 17:20 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2010-01-25 17:11 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2010-01-25 17:11 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2010-01-25 17:11 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2010-01-25 17:10 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2010-01-25 17:10 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2010-01-23 00:26 . 2010-01-23 00:26 680 ----a-w- c:\users\Griffin\AppData\Local\d3d9caps.dat
2010-01-22 04:56 . 2006-04-11 08:49 118784 ----a-w- c:\windows\system32\PTTreeIcons.dll
2010-01-22 04:11 . 2010-01-22 04:11 -------- d-----w- c:\windows\Sun
2010-01-22 03:06 . 2010-01-22 03:06 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-01-21 01:33 . 2010-01-21 01:33 -------- d-----w- c:\program files\Common Files\Skype
2010-01-20 03:43 . 2010-01-20 03:43 -------- d-----w- c:\program files\ESET
2010-01-19 23:46 . 2010-01-27 00:06 -------- d-----w- c:\users\Griffin\AppData\Roaming\skypePM
2010-01-19 23:43 . 2010-01-27 01:16 -------- d-----w- c:\users\Griffin\AppData\Roaming\Skype
2010-01-19 23:43 . 2010-01-21 01:34 -------- d-----r- c:\program files\Skype
2010-01-19 23:42 . 2010-01-21 01:33 -------- d-----w- c:\programdata\Skype
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- c:\users\Griffin\AppData\Roaming\Malwarebytes
2010-01-19 15:17 . 2010-01-08 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- c:\programdata\Malwarebytes
2010-01-19 15:17 . 2010-01-08 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-19 06:00 . 2010-01-19 06:00 -------- d-----w- c:\windows\McAfee.com
2010-01-19 05:04 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2010-01-19 00:10 . 2009-11-09 13:22 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-01-19 00:08 . 2009-10-19 14:24 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-01-19 00:06 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2010-01-18 23:24 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll
2010-01-18 23:23 . 2009-08-05 14:22 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-01-18 23:23 . 2009-08-05 14:22 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-01-18 23:23 . 2009-08-10 11:01 1399296 ----a-w- c:\windows\system32\msxml6.dll
2010-01-18 23:23 . 2009-08-10 11:00 1257472 ----a-w- c:\windows\system32\msxml3.dll
2010-01-10 01:06 . 2010-01-10 01:08 -------- d-----w- c:\users\Griffin\AppData\Roaming\QuickScan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 14:40 . 2009-01-04 00:44 72056 ----a-w- c:\users\Griffin\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-26 01:04 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-26 01:04 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-01-25 04:08 . 2009-06-30 21:28 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-24 16:08 . 2008-08-19 09:14 -------- d-----w- c:\program files\Microsoft Works
2010-01-22 04:56 . 2009-12-13 04:52 -------- d-----w- c:\program files\Snap 'n Share
2010-01-14 19:12 . 2009-10-03 09:21 181120 ----a-w- c:\windows\system32\MpSigStub.exe
2010-01-02 06:38 . 2010-01-26 00:22 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-26 00:22 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-26 00:22 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-26 00:22 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-13 04:54 . 2008-08-19 02:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-08 01:02 . 2009-01-04 00:43 -------- d-----w- c:\program files\Google
2009-12-03 17:03 . 2009-06-10 00:29 -------- d-----w- c:\program files\Java
2009-12-03 14:29 . 2008-08-19 09:12 -------- d-----w- c:\programdata\Microsoft Help
2009-11-30 16:34 . 2009-05-08 02:43 -------- d-----w- c:\programdata\avg8
2009-11-30 14:58 . 2009-11-30 14:58 -------- d-----w- c:\programdata\avg9
2009-11-30 14:58 . 2009-05-08 02:43 -------- d-----w- c:\program files\AVG
2009-11-09 01:15 . 2009-11-09 01:15 95 ----a-w- c:\users\Griffin\AppData\Local\fusioncache.dat
2009-11-09 01:07 . 2009-11-09 01:07 9662 ----a-r- c:\users\Griffin\AppData\Roaming\Microsoft\Installer\{21209AE8-1E93-4289-A88F-5EE0F22CF9F8}\ARPPRODUCTICON.exe
2009-11-09 01:07 . 2009-11-09 01:07 49152 ----a-r- c:\users\Griffin\AppData\Roaming\Microsoft\Installer\{21209AE8-1E93-4289-A88F-5EE0F22CF9F8}\NewShortcut7_21209AE81E934289A88F5EE0F22CF9F8_1.exe
2009-11-09 01:07 . 2009-11-09 01:07 49152 ----a-r- c:\users\Griffin\AppData\Roaming\Microsoft\Installer\{21209AE8-1E93-4289-A88F-5EE0F22CF9F8}\NewShortcut1_21209AE81E934289A88F5EE0F22CF9F8_6.exe
2009-11-06 16:47 . 2009-11-26 00:20 2064152 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-11-03 16:47 . 2009-11-26 00:20 3513624 ----a-w- c:\programdata\avg8\update\backup\avgui.exe
2009-11-03 16:47 . 2009-11-26 00:20 2028312 ----a-w- c:\programdata\avg8\update\backup\avgtray.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-15 01:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-21 6144000]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"Acer Product Registration"="c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392]
"LXCFCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-09-14 73728]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-26 2029336]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-19 2743104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 0
"NoChangeAnimation"= 0 (0x0)
"NoThumbnailCache"= 1 (0x1)
"NoDevMgrUpdate"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-05-30 00:44 167936 ------w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
2008-05-15 01:05 526896 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R1 aswSP;aswSP;c:\windows\System32\drivers\aswSP.sys [26/01/2010 8:45 AM 162640]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [07/05/2009 6:44 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [07/05/2009 6:44 PM 108552]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [19/08/2008 1:39 AM 61424]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [26/01/2010 8:45 AM 19024]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [26/01/2010 8:45 AM 51792]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [19/08/2008 1:40 AM 81504]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [19/08/2008 1:36 AM 24576]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [19/08/2008 1:40 AM 122368]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [28/03/2008 3:44 AM 210432]
R3 usbfilter;AMD USB Filter Driver;c:\windows\System32\drivers\usbfilter.sys [03/01/2009 4:44 PM 22072]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/05/2009 6:43 PM 297752]
S3 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 12:11 PM 16384]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [25/04/2008 8:36 PM 45056]
S3 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [25/04/2008 8:36 PM 131072]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&s=2&o=vp32&d=0309&m=aspire_5535
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Griffin\AppData\Roaming\Mozilla\Firefox\Profiles\ke765pq8.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Griffin\AppData\Roaming\Mozilla\Firefox\Profiles\ke765pq8.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 22:24
Windows 6.0.6001 Service Pack 1 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCFCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3348)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\program files\Adobe\Reader 8.0\Reader\viewerps.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\conime.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
.
**************************************************************************
.
Completion time: 2010-01-26 22:31:41 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-27 06:31
ComboFix2.txt 2010-01-26 22:26
ComboFix3.txt 2010-01-21 23:53
ComboFix4.txt 2010-01-21 23:10
ComboFix5.txt 2010-01-27 06:09

Pre-Run: 64,152,436,736 bytes free
Post-Run: 63,871,954,944 bytes free

- - End Of File - - 64559BE53E532073FFC8C6158D09372C

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Please download and run MCPR.exe

  1. Download the removal tool from: http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe
  2. Click Save and save the file to a folder on your computer.
  3. Navigate to the folder where the file was saved.
  4. Make sure all McAfee windows are closed.
  5. Double-click MCPR.exe to run the removal tool.

    NOTE: Windows Vista users must right-click MCPR.exe and select Run as Administrator.
  6. Restart your computer after receiving the message CleanUp Successful.
    Your McAfee product will not be fully removed until the system is restarted.


==

Completely Uninstall AVG software

Download and run avgremover.exe

For 32-Bit, Download: avgremover.exe

==

After those tools run, let me know if you are still getting the error message.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I just downloaded two files, and they both appear to be working fine. I also just tried my shawmail, and it also appears fine.
Are there any scans I should do, or should I create a restore point and call it good Hooray!

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Did you try to install Avira, like earlier?

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
I installed avast. I loaded the install file onto my flash drive and installed it that way. the files I downloaded were Javara and winlogon.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
Ok. Let's finish up.

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:

  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.


Download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
There were a few files that I have used during this process that are still on the computer. Should I get rid of all of them?



Results of screen317's Security Check version 0.99.1
Windows Vista Service Pack 1 (UAC is enabled)
Out of date service pack!!
``````````````````````````````
Antivirus/Firewall Check:

Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
avast! Free Antivirus
ESET Online Scanner v3
WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:

Java(TM) 6 Update 17
Adobe Flash Player 10
Adobe Reader 8.1.4
Out of date Adobe Reader installed!
``````````````````````````````
Process Check:
objlist.exe by Laurent

Windows Defender MSASCui.exe
``````````````````````````````
DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
If you'd like.

descriptionNot a valid Win32 Application - Page 2 EmptyRe: Not a valid Win32 Application

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum