MS win. security Centre Reg Tools and Task Manager

Your log shows that AVG8 is installed but appears to have been shutdown. It that what you did?

I still see signs of Symantec in your logs. You need to run the below.

Please run the below then reboot. After reboot run it one more time.

Norton Removal Tool (SymNRT)

This is not a report of malware. It is just a report that you have change the Windows Security Center default settings associated with Registry and Task Manager changes. This is not a false positive nor is it a bug. It is just an information. Spybot is merely bringing it to your attention that someone has disable notifications in Security Center.

If you changed these yourself or another program you are running changed them, you can simply tell Spybot to exclude these from future scans. You can do this by right-clicking each in turn, then click "exclude this detection from future scans".

I recommend that you uninstall Ad-Aware 2007 now since it is out of date and also it is not that useful. You are MUCH MUCH better off just using SUPERAntiSpyware and Malwarebytes as on demand scanners.


You don't really have any malware to remove. We just have a few misc things to correct.

I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.

Uninstall the below software:
Viewpoint Media Player <-- should have been uninstalled in step 1 of the READ ME

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

After clicking Fix, exit HJT.

Delete the below folder from ComboFix

Code:

"C:\"
32788R~1       2 Feb 2009              "32788R22FWJFW"

Delete the below file from ComboFix

Code:

"C:\Windows\System32\"
cmd~1.exe      2 Feb 2009      320000  "cmd.execf"

Delete the below temp files

Code:

"C:\Users\Ian\AppData\Local\Temp\"
187.TMP        2 Feb 2009              "187.tmp"
C581.TMP       2 Feb 2009              "C581.tmp"
C755.TMP       2 Feb 2009              "C755.tmp"

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).



Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

I did not want you to run ComboFix. I simply wanted you to delete those files and folders that are left over from trying to run ComboFix. So please delete them now.

That is why your protection software has to be disabled before running the scan. AVG is having false detections and is blocking ComboFix from working.

Now continue on with the below instructions.

1. Uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)

Now delete the below files which should not be saved on your Desktop. If you want them, then move them somewhere else safe.

Code:

"C:\Users\Ian\Desktop\"
mb.exe         1 Feb 2009     2737800  "mb.exe"
norton~1.exe   3 Feb 2009     2344429  "Norton_Removal_Tool.exe"
spybot~1.exe   1 Feb 2009    16409960  "spybotsd162.exe"
supera~1.exe   1 Feb 2009     5953568  "SUPERAntiSpyware.exe"

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run Ccleaner!

Now goto this link Using MGtools and download the new version of MGtools.exe from the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.


Run MGtools.exe then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!
If you still have problems with your wallpaper, I suggest that you post about that in the Software Forum.

 

Unknown what this is. Do you mean the volume label is getting changed? Which volumes labels does it affect?


Your logs are clean. So you should continue on with the below.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
9. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!