Solved Win 32 malware-gen found.

[Resolved] Win 32 malware-gen found.

My avast found this virus with the following description.

Sign of "Win32:Malware-gen has been found in "C:/Program files|Acer\Empowering Technology\eRecovery\HidChk.exe" file.

I am unsure if this is something to be concerned about or not.

When any antisypware of malware finds anything what is the correct action to take as do you delete from quarantine or what?

Please advise and thanks in advance.

DDS (Ver_09-10-12.01) - NTFSx86
Run by STEVEN at 16:47:37.18 on Mon 10/12/2009
Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.3069.1916 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Acer\Mobility Center\MobilityService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\STEVEN\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashLogV.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\STEVEN\Downloads\dds(3).scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://my.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=0309&m=aspire_4730z
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Speech Recognition] "c:\windows\speech\common\sapisvr.exe" -SpeechUX -Startup
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe
mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ArcadeDeluxeAgent] "c:\program files\acer arcade deluxe\acer arcade deluxe\ArcadeDeluxeAgent.exe "
mRun: [PlayMovie] "c:\program files\acer arcade deluxe\playmovie\PMVService.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Skytel] Skytel.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [CLMLServer] "c:\program files\acer arcade deluxe\acer arcade deluxe\kernel\clml\CLMLSvc.exe "
StartupFolder: c:\users\steven\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\users\steven\appdata\roaming\micros~1\windows\startm~1\programs\startup\sberem~1.lnk - c:\program files\quicken legal products\small business expert\Reminder.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\steven\appdata\roaming\mozilla\firefox\profiles\2kx89zjo.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/?_bc=1
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - plugin: c:\program files\google\google updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-8-14 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-9-4 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-4 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-14 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-8-14 53328]
R2 CLHNService;CLHNService;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\CLHNService.exe [2009-3-26 69632]
R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2009-2-24 24576]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2009-3-26 233472]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2009-7-9 116064]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\drivers\netr28.sys [2009-8-3 569856]
S2 gupdate1ca108c8b90e090;Google Update Service (gupdate1ca108c8b90e090);c:\program files\google\update\GoogleUpdate.exe [2009-7-29 133104]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-2-24 30192]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
S3 Partner Service;Partner Service;c:\programdata\partner\partner.exe [2009-7-29 110576]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-4 7408]
S3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2009-7-30 81704]

=============== Created Last 30 ================

2009-10-09 21:25 <DIR> -cds---- C:\ComboFix
2009-10-09 21:25 318,976 a------- c:\windows\system32\CF3006.exe
2009-10-08 09:38 195,440 -------- c:\windows\system32\MpSigStub.exe
2009-10-05 13:51 18,688 a------- c:\windows\system32\drivers\afc.sys
2009-10-05 13:51 <DIR> --d----- c:\programdata\ArcSoft
2009-10-05 13:51 <DIR> --d----- c:\progra~2\ArcSoft
2009-10-03 11:48 2,421,760 a------- c:\windows\system32\wucltux.dll
2009-10-03 11:47 87,552 a------- c:\windows\system32\wudriver.dll
2009-10-03 11:47 171,608 a------- c:\windows\system32\wuwebv.dll
2009-10-03 11:47 33,792 a------- c:\windows\system32\wuapp.exe
2009-09-18 11:30 <DIR> --d----- c:\users\steven\Tracing
2009-09-17 22:32 <DIR> --d----- c:\program files\COMODO
2009-09-17 21:24 <DIR> -cdsh--- C:\$RECYCLE.BIN
2009-09-17 14:38 229,888 a------- c:\windows\PEV.exe
2009-09-17 14:38 161,792 a------- c:\windows\SWREG.exe
2009-09-17 14:38 98,816 a------- c:\windows\sed.exe
2009-09-17 03:03 <DIR> --d----- c:\program files\Trend Micro
2009-09-17 00:51 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-09-17 00:44 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 00:44 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-09-16 21:03 <DIR> --d----- c:\users\steven\appdata\roaming\Malwarebytes
2009-09-16 21:03 <DIR> --d----- c:\programdata\Malwarebytes
2009-09-16 21:03 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-09-16 21:03 <DIR> --d----- c:\progra~2\Malwarebytes
2009-09-16 21:00 <DIR> --d----- c:\programdata\SUPERAntiSpyware.com
2009-09-16 21:00 <DIR> --d----- c:\progra~2\SUPERAntiSpyware.com
2009-09-16 20:59 <DIR> --d----- c:\users\steven\appdata\roaming\SUPERAntiSpyware.com
2009-09-16 20:59 <DIR> --d----- c:\program files\SUPERAntiSpyware

==================== Find3M ====================

2009-10-07 14:06 143,360 a------- c:\windows\inf\infstrng.dat
2009-10-07 14:06 51,200 a------- c:\windows\inf\infpub.dat
2009-10-07 14:06 86,016 a------- c:\windows\inf\infstor.dat
2009-09-02 03:09 176,128 a------- c:\windows\system32\drivers\Rtlh86.sys
2009-08-28 22:30 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-08-28 22:30 458,752 a------- c:\windows\apppatch\AcSpecfc.dll
2009-08-28 22:30 2,159,616 a------- c:\windows\apppatch\AcGenral.dll
2009-08-28 22:30 542,720 a------- c:\windows\apppatch\AcLayers.dll
2009-08-28 20:27 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-28 20:14 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-08-17 12:05 53,328 a------- c:\windows\system32\drivers\aswMonFlt.sys
2009-08-14 12:27 904,776 a------- c:\windows\system32\drivers\tcpip.sys
2009-08-14 11:53 17,920 a------- c:\windows\system32\netevent.dll
2009-08-14 09:49 9,728 a------- c:\windows\system32\TCPSVCS.EXE
2009-08-14 09:49 17,920 a------- c:\windows\system32\ROUTE.EXE
2009-08-14 09:49 11,264 a------- c:\windows\system32\MRINFO.EXE
2009-08-14 09:49 27,136 a------- c:\windows\system32\NETSTAT.EXE
2009-08-14 09:49 19,968 a------- c:\windows\system32\ARP.EXE
2009-08-14 09:49 8,704 a------- c:\windows\system32\HOSTNAME.EXE
2009-08-14 09:49 10,240 a------- c:\windows\system32\finger.exe
2009-08-14 09:48 30,720 a------- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 09:48 105,984 a------- c:\windows\system32\netiohlp.dll
2009-08-03 13:50 221,184 a------- c:\windows\system32\RaCoInst.dll
2009-08-03 13:50 13,931 a------- c:\windows\system32\RaCoInst.dat
2009-07-31 04:02 665,600 a------- c:\windows\inf\drvindex.dat
2009-07-29 20:20 141,215 a------- c:\windows\hpoins14.dat
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-22 10:24 94,208 a------- c:\windows\system32\RTNUninst32.dll
2009-07-21 17:52 915,456 a------- c:\windows\system32\wininet.dll
2009-07-21 17:47 109,056 a------- c:\windows\system32\iesysprep.dll
2009-07-21 17:47 71,680 a------- c:\windows\system32\iesetup.dll
2009-07-21 16:13 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-07-17 09:54 71,680 a------- c:\windows\system32\atl.dll
2009-07-15 08:40 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-07-15 08:39 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-07-15 08:39 4,096 a------- c:\windows\system32\dxmasf.dll
2009-07-15 08:39 7,680 a------- c:\windows\system32\spwmp.dll
2008-01-20 22:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-12.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 3/26/2009 6:42:44 PM
System Uptime: 10/12/2009 4:36:17 PM (0 hours ago)

Motherboard: Acer | | Aspire 4730Z
Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz | uPGA-478 | 2000/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 143 GiB total, 96.285 GiB free.
D: is FIXED (NTFS) - 143 GiB total, 135.811 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP187: 9/17/2009 10:27:03 PM - Clean 9/17/2009
RP188: 9/17/2009 10:34:04 PM - Device Driver Package Install: COMODO Network Service
RP189: 9/17/2009 10:43:30 PM - Windows Update
RP190: 9/18/2009 9:01:12 AM - Windows Update
RP191: 9/22/2009 8:26:53 AM - Windows Update
RP192: 9/24/2009 9:53:55 AM - Windows Update
RP193: 9/29/2009 12:17:23 PM - Windows Update
RP194: 10/3/2009 11:47:23 AM - Windows Update
RP195: 10/3/2009 11:51:36 AM - Windows Update
RP196: 10/4/2009 3:57:55 PM - Scheduled Checkpoint
RP198: 10/5/2009 1:49:20 PM - Installed MediaImpression
RP200: 10/5/2009 3:16:17 PM - Removed MediaImpression
RP201: 10/6/2009 10:23:03 AM - Windows Update
RP202: 10/7/2009 2:06:21 PM - Windows Update
RP203: 10/8/2009 9:38:39 AM - Windows Update
RP204: 10/12/2009 9:37:44 AM - Windows Update
RP205: 10/12/2009 4:34:13 PM - Restore Operation
RP206: 10/12/2009 4:41:15 PM - Windows Update

==== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 2 (SP2)
32 Bit HP CIO Components Installer
Acer Arcade Deluxe
Acer Assist
Acer Crystal Eye Webcam 2.0.7
Acer eDataSecurity Management
Acer Empowering Technology
Acer ePower Management
Acer eRecovery Management
Acer eSettings Management
Acer GridVista
Acer Mobility Center Plug-In
Acer Registration
Acer ScreenSaver
Acer VCM
Acrobat.com
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 9.1.3
Agere Systems HDA Modem
AIO_Scan
ATI Catalyst Install Manager
avast! Antivirus
BufferChm
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization Finnish
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Greek
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Norwegian
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Russian
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Choice Guard
Copy
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DeviceManagementQFolder
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
eSobi v2
eSupportQFolder
F4100
F4100_doccd
F4100_Help
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Participation Program 9.0
HP Deskjet All-In-One Software 9.0
HP Imaging Device Functions 9.0
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Solution Center 9.0
HP Update
HPProductAssistant
HPSSupply
Intel Performance Power Manager
Java(TM) 6 Update 15
JMicron JMB38X Flash Media Controller
Junk Mail filter update
Launch Manager
Lernout & Hauspie TruVoice American English TTS Engine
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.5.3)
MSVCRT
MSXML 4.0 SP2 (KB954430)
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
PhotoNow!
PokerStars
PSSWCORE
Quicken Lawyer 2002 Personal Deluxe
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek High Definition Audio Driver
Scan
Skins
Skype web features
Skypeâ„¢ 4.1
SolutionCenter
SopCast 3.2.4
Status
SUPERAntiSpyware Free Edition
Synaptics Pointing Device Driver
Toolbox
TrayApp
TVAnts 1.0
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VideoToolkit01
WebReg
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Player Firefox Plugin

==== Event Viewer Messages From Past Week ========

10/9/2009 10:07:33 PM, Error: Service Control Manager [7034] - The Raw Socket Service service terminated unexpectedly. It has done this 1 time(s).
10/9/2009 10:07:33 PM, Error: Service Control Manager [7034] - The NTI Backup Now 5 Scheduler Service service terminated unexpectedly. It has done this 1 time(s).
10/9/2009 10:07:33 PM, Error: Service Control Manager [7034] - The MobilityService service terminated unexpectedly. It has done this 1 time(s).
10/9/2009 10:07:33 PM, Error: Service Control Manager [7034] - The eDataSecurity Service service terminated unexpectedly. It has done this 1 time(s).
10/9/2009 10:07:33 PM, Error: Service Control Manager [7034] - The CLHNService service terminated unexpectedly. It has done this 1 time(s).
10/9/2009 10:07:33 PM, Error: Service Control Manager [7034] - The Ati External Event Utility service terminated unexpectedly. It has done this 1 time(s).
10/9/2009 10:07:33 PM, Error: Service Control Manager [7034] - The Agere Modem Call Progress Audio service terminated unexpectedly. It has done this 1 time(s).
10/9/2009 10:07:33 PM, Error: Service Control Manager [7031] - The Empowering Technology Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
10/7/2009 2:06:45 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070103: Ralink Technology, Corp. - Network - Ralink 802.11n Wireless LAN Card.
10/5/2009 2:39:10 PM, Error: PlugPlayManager [12] - The device 'JMB38X SD/MMC Host Controller' (PCI\VEN_197B&DEV_2382&SUBSYS_01401025&REV_00\4&1f1c355f&0&00E4) disappeared from the system without first being prepared for removal.
10/5/2009 2:39:10 PM, Error: PlugPlayManager [12] - The device 'JMB38X SD Host Controller' (PCI\VEN_197B&DEV_2381&SUBSYS_01401025&REV_00\4&1f1c355f&0&02E4) disappeared from the system without first being prepared for removal.
10/5/2009 2:06:31 PM, Error: disk [15] - The device, \Device\Harddisk1\DR9, is not ready for access yet.
10/5/2009 2:05:40 PM, Error: Microsoft-Windows-DriverFrameworks-UserMode [10101] - The driver package installation has failed. The final status was 5.
10/5/2009 2:05:39 PM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
10/5/2009 1:40:50 PM, Error: EventLog [6008] - The previous system shutdown at 1:39:49 PM on 10/5/2009 was unexpected.
10/5/2009 1:37:49 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
10/5/2009 1:37:19 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the UxSms service.
10/5/2009 1:36:49 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TabletInputService service.
10/5/2009 1:36:19 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.
10/5/2009 1:35:48 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
10/5/2009 1:35:19 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the hidserv service.
10/5/2009 1:34:48 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AudioEndpointBuilder service.
10/5/2009 1:28:29 PM, Error: Service Control Manager [7022] - The Portable Device Enumerator Service service hung on starting.
10/5/2009 1:25:11 PM, Error: EventLog [6008] - The previous system shutdown at 1:23:22 PM on 10/5/2009 was unexpected.
10/12/2009 4:37:28 PM, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.67.543.0 Loading engine version: 1.1.5101.0
10/12/2009 4:36:39 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\RAIHV.dll Error Code: 126
10/12/2009 12:37:14 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.

 

Malwarebytes and Super antispyware find nothing. I can re-run and post those logs if necessary. This infection appears to me to be in the Acer backup function so I am totally unsure as to how it got there in the first place.

 

Avast also came up with a list of objects that it was unable to scan. Can post if necessary.

 

ComboFix 09-10-12.03 - STEVEN 10/13/2009 10:40.3.2 - NTFSx86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.3069.1978 [GMT -4:00]
Running from: c:\users\STEVEN\Desktop\ComboFix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2009-09-13 to 2009-10-13 )))))))))))))))))))))))))))))))
.

2009-10-13 14:45 . 2009-10-13 14:45 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-13 14:45 . 2009-10-13 14:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-08 13:38 . 2009-10-01 14:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-05 17:52 . 2009-10-05 17:52 -------- d-----w- c:\users\STEVEN\AppData\Local\ArcSoft
2009-10-05 17:51 . 2006-11-10 19:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys
2009-10-05 17:51 . 2009-10-05 18:00 -------- d-----w- c:\programdata\ArcSoft
2009-10-05 17:49 . 2009-10-05 19:17 -------- d-----w- c:\program files\Common Files\ArcSoft
2009-10-05 17:47 . 2009-10-05 17:54 -------- d-----w- c:\users\STEVEN\AppData\Roaming\ArcSoft
2009-10-03 15:48 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-03 15:48 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-03 15:48 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-03 15:48 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-03 15:47 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-03 15:47 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-03 15:47 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-03 15:47 . 2009-08-06 23:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-03 15:47 . 2009-08-06 22:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-09-18 15:30 . 2009-10-12 22:37 -------- d-----w- c:\users\STEVEN\Tracing
2009-09-18 02:32 . 2009-09-18 02:44 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-09-18 02:32 . 2009-10-07 15:43 -------- d-----w- c:\program files\COMODO
2009-09-17 07:03 . 2009-09-17 07:03 -------- d-----w- c:\program files\Trend Micro
2009-09-17 04:51 . 2009-09-17 04:51 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-17 04:44 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 04:44 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-17 01:03 . 2009-09-17 01:03 -------- d-----w- c:\users\STEVEN\AppData\Roaming\Malwarebytes
2009-09-17 01:03 . 2009-09-17 04:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-17 01:03 . 2009-09-17 01:03 -------- d-----w- c:\programdata\Malwarebytes
2009-09-17 01:00 . 2009-09-17 01:00 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-09-17 00:59 . 2009-09-18 15:34 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-17 00:59 . 2009-09-17 00:59 -------- d-----w- c:\users\STEVEN\AppData\Roaming\SUPERAntiSpyware.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-05 19:17 . 2009-02-24 13:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-17 06:33 . 2009-07-29 18:21 -------- d-----w- c:\programdata\Partner
2009-09-17 05:26 . 2009-07-30 00:41 1356 ----a-w- c:\users\STEVEN\AppData\Local\d3d9caps.dat
2009-09-17 02:13 . 2009-07-30 00:09 -------- d-----w- c:\programdata\HP Product Assistant
2009-09-15 10:59 . 2009-08-14 04:11 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 10:55 . 2009-08-14 04:11 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2009-08-14 04:11 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:55 . 2009-08-14 04:11 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-09-15 10:54 . 2009-08-14 04:11 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2009-08-14 04:11 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2009-08-14 04:11 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-09 11:09 . 2009-08-08 21:41 -------- d-----w- c:\users\STEVEN\AppData\Roaming\Skype
2009-09-09 04:00 . 2009-08-08 21:43 -------- d-----w- c:\users\STEVEN\AppData\Roaming\skypePM
2009-09-09 03:18 . 2009-02-24 14:00 -------- d-----w- c:\programdata\eSobi
2009-09-09 02:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-06 17:13 . 2009-03-26 22:48 -------- d-----w- c:\programdata\CyberLink
2009-09-04 02:28 . 2009-07-29 20:16 -------- d-----w- c:\users\STEVEN\AppData\Roaming\U3
2009-09-02 07:09 . 2009-09-02 07:09 176128 ----a-w- c:\windows\system32\drivers\Rtlh86.sys
2009-08-29 00:27 . 2009-09-02 21:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-02 21:35 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-21 20:30 . 2009-07-30 00:04 -------- d-----w- c:\programdata\HP
2009-08-15 16:04 . 2009-08-14 15:54 -------- d-----w- c:\program files\QLP 2002 Deluxe
2009-08-14 16:27 . 2009-09-09 02:06 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:06 . 2009-07-29 18:21 73688 ----a-w- c:\users\STEVEN\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-14 15:53 . 2009-09-09 02:06 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-09 02:06 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-09 02:06 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-09 02:06 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-09 02:06 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-09 02:06 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-09 02:06 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-09 02:06 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-09 02:06 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-09 02:06 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-03 17:54 . 2009-08-03 17:54 569856 ----a-w- c:\windows\system32\drivers\netr28.sys
2009-08-03 17:50 . 2009-08-03 17:50 13931 ----a-w- c:\windows\system32\RaCoInst.dat
2009-08-03 17:50 . 2009-02-24 11:14 221184 ----a-w- c:\windows\system32\RaCoInst.dll
2009-07-30 00:20 . 2009-07-30 00:06 141215 ----a-w- c:\windows\hpoins14.dat
2009-07-29 20:15 . 2009-07-29 20:15 0 ----a-w- c:\windows\nsreg.dat
2009-07-25 09:23 . 2009-07-30 03:42 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-22 14:24 . 2009-07-22 14:24 94208 ----a-w- c:\windows\system32\RTNUninst32.dll
2009-07-21 21:52 . 2009-07-29 21:23 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 21:23 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 21:23 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 21:23 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 13:54 . 2009-08-14 07:44 71680 ----a-w- c:\windows\system32\atl.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-18_00.19.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-03 15:48 . 2009-08-07 02:24 44768 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.4.7600.226_none_e979223d5b9c821b\wups2.dll
+ 2009-10-03 15:48 . 2009-08-07 02:24 53472 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.4.7600.226_none_e979223d5b9c821b\wuauclt.exe
+ 2009-10-03 15:47 . 2009-08-06 22:44 33792 c:\windows\winsxs\x86_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.4.7600.226_none_79951cca15140d1a\wuapp.exe
+ 2009-10-03 15:47 . 2009-08-07 02:24 35552 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.4.7600.226_none_cf8a5c896f5cdb1e\wups.dll
+ 2009-10-03 15:47 . 2009-08-07 01:44 87552 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.4.7600.226_none_cf8a5c896f5cdb1e\wudriver.dll
+ 2008-01-21 01:58 . 2009-10-12 22:38 54486 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-10-12 22:38 82972 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-22 14:24 . 2009-07-22 14:24 94208 c:\windows\System32\DriverStore\FileRepository\netrtx32.inf_1d4d5642\RTNUninst32.dll
+ 2009-03-05 10:54 . 2009-03-05 10:54 73728 c:\windows\System32\DriverStore\FileRepository\netrtx32.inf_1d4d5642\RtNicProp32.dll
+ 2009-09-18 02:32 . 2009-09-18 02:32 74328 c:\windows\System32\DriverStore\FileRepository\inspect.inf_9db18a86\inspect.sys
- 2009-07-30 10:14 . 2009-09-17 21:41 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-30 10:14 . 2009-10-13 14:20 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-30 10:14 . 2009-09-17 21:41 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-30 10:14 . 2009-10-13 14:20 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-30 10:14 . 2009-10-13 14:20 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-30 10:14 . 2009-09-17 21:41 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-08-06 23:23 . 2009-08-06 23:23 73288 c:\windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe
+ 2006-11-02 10:25 . 2009-10-07 18:06 86016 c:\windows\inf\infstor.dat
- 2006-11-02 10:25 . 2009-09-09 02:23 86016 c:\windows\inf\infstor.dat
- 2006-11-02 10:25 . 2009-09-09 02:23 51200 c:\windows\inf\infpub.dat
+ 2006-11-02 10:25 . 2009-10-07 18:06 51200 c:\windows\inf\infpub.dat
+ 2009-07-29 18:30 . 2009-10-12 22:38 7524 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1238608273-788294235-512936603-1000_UserData.bin
+ 2009-10-12 22:37 . 2009-10-12 22:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-09-17 17:37 . 2009-09-17 17:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-09-17 17:37 . 2009-09-17 17:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-10-12 22:37 . 2009-10-12 22:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-10-03 15:47 . 2009-08-06 23:23 171608 c:\windows\winsxs\x86_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.4.7600.226_none_79951cca15140d1a\wuwebv.dll
+ 2009-10-03 15:47 . 2009-08-07 02:23 575704 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.4.7600.226_none_cf8a5c896f5cdb1e\wuapi.dll
+ 2009-09-06 16:37 . 2009-10-05 19:20 133056 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2009-07-30 00:41 . 2009-10-13 14:20 286102 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2006-11-02 10:33 . 2009-09-17 17:46 595684 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-10-12 22:45 595684 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-09-17 17:46 101350 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-10-12 22:45 101350 c:\windows\System32\perfc009.dat
+ 2009-09-02 07:09 . 2009-09-02 07:09 176128 c:\windows\System32\DriverStore\FileRepository\netrtx32.inf_1d4d5642\Rtlh86.sys
+ 2009-07-29 21:29 . 2009-10-10 02:12 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-29 21:29 . 2009-09-17 17:37 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2006-11-02 10:25 . 2009-10-07 18:06 143360 c:\windows\inf\infstrng.dat
- 2006-11-02 10:25 . 2009-09-09 02:23 143360 c:\windows\inf\infstrng.dat
+ 2009-10-03 15:48 . 2009-08-07 01:45 2421760 c:\windows\winsxs\x86_microsoft-windows-windowsupdateclient-ui_31bf3856ad364e35_7.4.7600.226_none_672645e7fba0c4cc\wucltux.dll
+ 2009-10-03 15:48 . 2009-08-07 02:23 1929952 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.4.7600.226_none_e979223d5b9c821b\wuaueng.dll
+ 2009-07-29 21:16 . 2009-10-03 15:48 9671052 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin
- 2006-11-02 10:22 . 2009-09-14 01:56 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2006-11-02 10:22 . 2009-10-05 00:19 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@= "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-30 01:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Speech Recognition "= "c:\windows\Speech\Common\sapisvr.exe" [2008-01-21 49664]
"msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-12-03 3882312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Google Desktop Search "= "c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-02-24 30192]
"ePower_DMC "= "c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-11-28 417792]
"eDataSecurity Loader "= "c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-30 526896]
"LManager "= "c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-02 850440]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"ArcadeDeluxeAgent "= "c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-10-09 147456]
"PlayMovie "= "c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-10-17 167936]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"CLMLServer "= "c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-03-18 173352]
"RtHDVCpl "= "RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-20 6244896]
"Skytel "= "Skytel.exe" - c:\windows\SkyTel.exe [2007-11-21 1826816]

c:\users\STEVEN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2 "=hex(b):99,e7,ef,72,b6,11,ca,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B83E8D70-6BBF-4418-B4CB-47D329DBBB06} "= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{39816C38-43BF-4660-8270-7A25D252536E} "= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{D96B472D-A6BA-453A-B5AC-CE4F66E0BD3F} "= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{D0885C58-FA06-4715-AA63-4ADBB5F5FEAC} "= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{B6FEF2F9-FE3A-4145-8C51-FAFC73C4277A} "= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{5EB9B2FF-178B-4BE4-8D2E-B5962FCE6159} "= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{AEFD8465-7D51-4865-805B-6C0E34C15DFA} "= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie
"{7688F972-AA6C-48DD-AC9B-9185495CC54C} "= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program
"{CCD2C1FC-5443-490D-AC4A-E7C965105B0D} "= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia
"{4A837271-1FD9-4977-A184-FF2EDBFBE065} "= c:\program files\Acer\Acer VCM\VC.exe:Acer VCM
"{E39BD117-1185-4EDA-BDA9-57C1D289EACE} "= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{611B156F-B785-42CB-B5A0-E01B5139110E} "= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{44A64627-C596-4E81-8122-CBD480D4077E}c:\\program files\\sopcast\\adv\\sopadver.exe "= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{EBA827C1-36A3-4244-AECE-834EDD95191A}c:\\program files\\sopcast\\adv\\sopadver.exe "= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{F6C208B0-2C30-4C0F-959E-E155B5B0126A}c:\\program files\\sopcast\\sopcast.exe "= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{8E153E30-10D7-40E8-9187-A6A46FDC200D}c:\\program files\\sopcast\\sopcast.exe "= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"TCP Query User{68A8FBB4-31F8-4428-B7C4-731D0504E8BD}c:\\program files\\tvants\\tvants.exe "= UDP:c:\program files\tvants\tvants.exe:TVAnts
"UDP Query User{8C0D3BFB-6F8F-47B7-9307-284C05563396}c:\\program files\\tvants\\tvants.exe "= TCP:c:\program files\tvants\tvants.exe:TVAnts
"{093C710B-7757-4D73-8880-27CE935AFFB8} "= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSfsu.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\encryption.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\decryption.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSMgr.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDStbmngr.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSfsu.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\encryption.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\decryption.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSMgr.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDStbmngr.exe "= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [8/14/2009 12:11 AM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/4/2009 2:50 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/4/2009 2:49 PM 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [8/14/2009 12:11 AM 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [8/14/2009 12:11 AM 53328]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [3/26/2009 6:50 PM 69632]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2/24/2009 9:18 AM 24576]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [9/23/2008 6:11 PM 144632]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [3/26/2009 6:51 PM 233472]
R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [7/9/2009 12:45 PM 116064]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\System32\drivers\netr28.sys [8/3/2009 1:54 PM 569856]
S2 gupdate1ca108c8b90e090;Google Update Service (gupdate1ca108c8b90e090);c:\program files\Google\Update\GoogleUpdate.exe [7/29/2009 4:38 PM 133104]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2/24/2009 9:20 AM 30192]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [9/23/2008 6:11 PM 50424]
S3 Partner Service;Partner Service;c:\programdata\Partner\partner.exe [7/29/2009 2:21 PM 110576]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/4/2009 2:50 PM 7408]
S3 WSVD;WSVD;c:\windows\System32\drivers\WSVD.sys [7/30/2009 8:52 PM 81704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-10-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-29 20:38]

2009-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 20:38]

2009-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 20:38]

2009-10-13 c:\windows\Tasks\User_Feed_Synchronization-{D03C9802-AED3-4DED-97A8-06756EDCDDFE}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=0309&m=aspire_4730z
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\STEVEN\AppData\Roaming\Mozilla\Firefox\Profiles\2kx89zjo.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/?_bc=1
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-13 10:46
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(1744)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
.
Completion time: 2009-10-13 10:47
ComboFix-quarantined-files.txt 2009-10-13 14:47
ComboFix2.txt 2009-09-18 01:24
ComboFix3.txt 2009-09-18 00:20

Pre-Run: 101,128,699,904 bytes free
Post-Run: 101,121,667,072 bytes free

285 --- E O F --- 2009-10-12 20:41

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:16 AM, on 10/13/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Users\STEVEN\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=0309&m=aspire_4730z
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe "
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe "
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: SBE Reminder.lnk = C:\Program Files\Quicken Legal Products\Small Business Expert\Reminder.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1ca108c8b90e090) (gupdate1ca108c8b90e090) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: Partner Service - Unknown owner - C:\ProgramData\Partner\partner.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe

--
End of file - 8087 bytes

 

I highlighted (checked or filled in circle) for showing hidden files. In Crogram data there is a partner file but I can not find a partner.exe. Please advise.

 

Also I am no sure how to upload the file we need to virus total. I opened the virus total site but need some help knowing how to upload to them.

There is a partner file within the partner folder (says it is an application) but I do not see anything that looks like a .exe.

 

I think I figured it out. Will post results when ready.

 

File partner.exe received on 2009.10.13 17:41:15 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 2/41 (4.88%)
Loading server information...
Your file is queued in position: 1.
Estimated start time is between 40 and 57 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.5.0.41 2009.10.13 -
AhnLab-V3 5.0.0.2 2009.10.13 -
AntiVir 7.9.1.35 2009.10.13 TR/Trash.Gen
Antiy-AVL 2.0.3.7 2009.10.13 -
Authentium 5.1.2.4 2009.10.13 -
Avast 4.8.1351.0 2009.10.13 -
AVG 8.5.0.420 2009.10.13 -
BitDefender 7.2 2009.10.13 -
CAT-QuickHeal 10.00 2009.10.13 -
ClamAV 0.94.1 2009.10.13 -
Comodo 2596 2009.10.13 -
DrWeb 5.0.0.12182 2009.10.13 -
eSafe 7.0.17.0 2009.10.13 -
eTrust-Vet 35.1.7065 2009.10.13 -
F-Prot 4.5.1.85 2009.10.13 -
F-Secure 8.0.14470.0 2009.10.13 -
Fortinet 3.120.0.0 2009.10.13 -
GData 19 2009.10.13 -
Ikarus T3.1.1.72.0 2009.10.13 -
Jiangmin 11.0.800 2009.10.08 -
K7AntiVirus 7.10.869 2009.10.13 -
Kaspersky 7.0.0.125 2009.10.13 -
McAfee 5769 2009.10.12 -
McAfee+Artemis 5769 2009.10.12 -
McAfee-GW-Edition 6.8.5 2009.10.13 Trojan.Trash.Gen
Microsoft 1.5101 2009.10.13 -
NOD32 4504 2009.10.13 -
Norman 6.01.09 2009.10.12 -
nProtect 2009.1.8.0 2009.10.13 -
Panda 10.0.2.2 2009.10.12 -
PCTools 4.4.2.0 2009.10.13 -
Prevx 3.0 2009.10.13 -
Rising 21.51.14.00 2009.10.13 -
Sophos 4.46.0 2009.10.13 -
Sunbelt 3.2.1858.2 2009.10.13 -
Symantec 1.4.4.12 2009.10.13 -
TheHacker 6.5.0.2.040 2009.10.13 -
TrendMicro 8.950.0.1094 2009.10.13 -
VBA32 3.12.10.11 2009.10.13 -
ViRobot 2009.10.13.1982 2009.10.13 -
VirusBuster 4.6.5.0 2009.10.13 -
Additional information
File size: 110576 bytes
MD5...: bb1bdf031f67dcfe613bffe9987a355a
SHA1..: a4aab8338c2e48357df63a72ab2ec7e78fa42e30
SHA256: b25997b7b9da28180c717579f063fccb45e2f7b9ef850fc7b13a716650c3e254
ssdeep: 1536:7Mmfa/U8vjp3gE32sjvDtzf7o5/PdF48KouCWiXEq0nToIfRU/pGuTlEKh1
:7Mmfz87dtr5f8PdV0CPXEPTBfRqGIlEm
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Autodesk FLIC Image File (extensions: flc, fli, cel) (100.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

 

Need help with spacing or something. Keep getting access denied in cmd.exe

 

At the command prompt I used the following;
sc(space)stop(space) "Partner(space)Service "

Sorry for being such a idiot(LOL)

Thanks

 

Also unsure of the quote in your last post.

 

Ok here we go. I have a command prompt window open. The prompt is as follows C:\Windows\system32(arrow). I the typed in the sc stop "Partner Sevice"

Reply is [SC] ControlService FAILED 1062:
The service has not been started.

Hope this makes more sense.

 

Yes. I the get a command prompt for windows\system32