Can Some read this scan for me?

Viruses and worms
1

Can someone take a look at this aswMBR scan and tell me what I should do please? I have been having slow computer and login issues as well as a BSOD.
Thank you.

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-09-08 22:43:34

22:43:34.395 OS Version: Windows 6.1.7601 Service Pack 1
22:43:34.395 Number of processors: 2 586 0x1C0A
22:43:34.395 ComputerName: STEPH-PC UserName: Steph
22:43:36.596 Initialize success
22:43:38.546 AVAST engine defs: 13090801
22:43:42.383 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IAAStorageDevice-0
22:43:42.399 Disk 0 Vendor: ST916031 0001 Size: 152627MB BusType: 3
22:43:42.539 Disk 0 MBR read successfully
22:43:42.555 Disk 0 MBR scan
22:43:43.148 Disk 0 Windows 7 default MBR code
22:43:43.179 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12291 MB offset 63
22:43:43.928 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 101 MB offset 25173855
22:43:44.037 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 140232 MB offset 25382700
22:43:44.162 Disk 0 scanning sectors +312579760
22:43:44.895 Disk 0 scanning C:\Windows\system32\drivers
22:44:08.264 Service scanning
22:44:41.944 Modules scanning
22:44:56.141 Disk 0 trace - called modules:
22:44:56.188 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys
22:44:56.204 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0x85113030]
22:44:56.219 3 CLASSPNP.SYS[8760c59e] → nt!IofCallDriver → [0x84735410]
22:44:56.235 5 ACPI.sys[86e383d4] → nt!IofCallDriver → \Device\Ide\IAAStorageDevice-0[0x84729028]
22:44:57.498 AVAST engine scan C:\Windows
22:45:01.913 AVAST engine scan C:\Windows\system32
22:50:17.502 AVAST engine scan C:\Windows\system32\drivers
22:50:46.802 AVAST engine scan C:\Users\Steph
23:03:40.362 AVAST engine scan C:\ProgramData
23:05:43.713 Scan finished successfully
23:09:51.786 Disk 0 MBR has been saved successfully to “C:\Users\Steph\Desktop\MBR.dat”
23:09:51.817 The log file has been saved successfully to “C:\Users\Steph\Desktop\11aswMBR.txt”

2

hey and welcome to the avast forum. i suggest you also attach the logs from adwclener mbam and otl from this guide.

http://forum.avast.com/index.php?topic=53253.0

from there a malware expert will help you.

3

aswMBR log looks clean, but also attach…not copy and paste… the logs requested by mikaelrask

4

Thank you for the kind welcome. Here is a complete C:\ aswMBR scan attached. I am working on the OTL and mBam. I will post attachments as soon as they are complete.

5

Here is the attached OTL Quick Scan.

6

and the MBAM Quick Scan is attached here.

7

Hi you have both Avast and Kaspersky running, one will need to go. What one do you wish to keep

8

I wish to keep Avast of course. The BSOD happened when I was running a scan by Kapersky anyway. I got rid of Kapersky.

9

Uninstall Kaspersky using the removal tool here http://support.kaspersky.com/common/service.aspx?el=1464

Once done could you run a fresh OTL scan and I will remove any hangers on

10

Okie Dokie Here’s the OTL attached.

11

OK the main problems as I can see it at the moment are :

You only have 1Gb of RAM which is really borderline for windows 7
Microsoft Security Essentials is also running so you will need to disable/uninstall that

Lets empty the temp files and see if that helps a bit

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - No CLSID value found.

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

12

I sure do appreciate your help. Here is the OTL after I ran the fix, rebooted and ran quick scan. Oh and I forgat to mention that something wiped out my iTunes and erased my Adobe PDF Reader right after I got rid of the Kaspersky. I got my iTunes re-installed but, the Adobe Reader will not re-install. What should I do for a PDF Reader? I have tried several times but after I click run for the installation it just disappears exe and all!? Odd! Thank you so much.

13

Do you use Adobe to create PDF’s or just to read them ? If it is just for reading then you are better off with PDF xchange. It is smaller lighter and faster http://www.tracker-software.com/ do a custom install and do not accept the toolbar :slight_smile:

Uninstall Adobe from the control panel

Is there any improvement in the computer behaviour

14

Maybe he can also disable some Startup objects via msconfig.exe :wink:

15

My PC seems faster and smoother now. I was thinking about getting Foxit Reader or Soda 3D. I do nee the capability to create PDFs also but want a free version. Thank you.

Posted by: Steven Winderlich-
What do you mean by this?: Maybe he can also disable some Startup objects via msconfig.exe

16

Go to your start menu and type msconfig in the search bar and click enter.

Now you get a window opening, go to the third tab at the top.
Now first check the box at the bottom “Hide all microsoft services”.

There you can disable everything that you dont need.

But make sure that you will not disable Avast or other services that you will need.

17

If you are unsure what you can disable you can post a screenshot here. :wink:

18

Go Start and in the search box type msconfig
Select the file that appears at the top of the list
Select the Startup tab
Deselect the following :

Acer Assist Launcher
Acer ePower Management
APSDaemon
EgisTecLiveUpdate
mwlDaemon
TkBellExe

OK out and reboot

Also remove Open Office and WkCalRem.exe from the startup menu
Go Start > All Programs > Start-up then delete those two (they are just links and will not affect the programme

19

I didn’t see these in the msconfig:
APSDaemon
mwlDaemon
TkBellExe

20

Have you searched in the startup tab?

The second from the left. :wink: