dds log as requested

[maxman]

I have a confession to make,
please find below a combo fix scan i did before you asked me to do 1 "Note the other deletions" section
"c:\programdata\FullRemove.exe" this did now show up on the scan you asked me to do sorry if i jumped the gun.

ComboFix 11-05-30.04 - MAXAMAN 30/05/2011 19:19:32.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.2811.1985 [GMT 1:00]
Running from: E:\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-04-28 to 2011-05-30 )))))))))))))))))))))))))))))))
.
.
2011-05-30 18:23 . 2011-05-30 18:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-30 18:05 . 2011-05-30 18:18 -------- d-----w- C:\32788R22FWJFW
2011-05-30 17:57 . 2011-05-30 17:57 -------- d-----w- c:\program files (x86)\ERUNT
2011-05-30 10:34 . 2011-05-30 10:34 -------- d-----w- c:\windows\NAPP_Dism_Log
2011-05-30 02:27 . 2011-05-30 18:10 -------- d-----w- c:\programdata\boost_interprocess
2011-05-30 02:24 . 2011-05-30 02:24 -------- d-----w- c:\program files (x86)\OEM
2011-05-30 02:24 . 2011-05-30 02:24 -------- d-----w- c:\program files\Acer Accessory Store
2011-05-30 02:23 . 2011-05-30 02:25 -------- d-----w- c:\users\MAXAMAN
2011-05-30 02:23 . 2011-05-30 02:23 -------- d-----w- C:\Recovery
2011-05-30 02:06 . 2011-05-30 02:06 -------- d-----w- c:\programdata\NTI Launcher
2011-05-30 02:05 . 2011-05-30 02:05 -------- d-----w- c:\program files (x86)\NTI
2011-05-30 02:04 . 2011-05-30 02:04 -------- d-----w- c:\programdata\FLEXnet
2011-05-30 02:04 . 2011-05-30 02:04 -------- d-----w- c:\program files (x86)\Common Files\Macrovision Shared
2011-05-30 02:03 . 2011-05-30 02:03 -------- d-----w- c:\windows\en
2011-05-30 02:02 . 2011-05-30 02:02 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2011-05-30 02:00 . 2010-05-23 08:35 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-05-30 02:00 . 2010-05-23 08:35 206848 ----a-w- c:\windows\system32\mfps.dll
2011-05-30 02:00 . 2010-05-23 10:15 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2011-05-30 02:00 . 2010-05-23 10:11 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll
2011-05-30 02:00 . 2010-05-23 08:37 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-05-30 02:00 . 2010-05-23 10:11 3181568 ----a-w- c:\windows\SysWow64\mf.dll
2011-05-30 02:00 . 2010-05-23 08:35 4068864 ----a-w- c:\windows\system32\mf.dll
2011-05-30 02:00 . 2011-05-30 02:00 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2011-05-30 01:57 . 2011-05-30 01:57 -------- d-----w- c:\program files (x86)\Common Files\CyberLink
2011-05-30 01:55 . 2011-05-30 01:57 -------- d-----w- c:\program files (x86)\CyberLink
2011-05-30 01:55 . 2011-05-30 01:55 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
2011-05-30 01:55 . 2011-05-30 01:55 505128 ----a-w- c:\windows\SysWow64\msvcp71.dll
2011-05-30 01:55 . 2011-05-30 01:55 353576 ----a-w- c:\windows\SysWow64\msvcr71.dll
2011-05-30 01:55 . 2011-05-30 02:30 -------- d-----w- c:\program files (x86)\Microsoft
2011-05-30 01:51 . 2011-05-30 01:51 -------- d-----w- c:\program files (x86)\AcerCrystalEye
2011-05-30 01:51 . 2010-07-14 12:54 191688 ----a-w- c:\windows\flicker.dll
2011-05-30 01:51 . 2010-07-14 12:53 11976 ----a-w- c:\windows\setpwlin.exe
2011-05-30 01:51 . 2010-06-09 17:54 206208 ----a-w- c:\windows\PLFSetI.exe
2011-05-30 01:51 . 2010-06-01 15:39 214400 ----a-w- c:\windows\SysWow64\snpropwp.dll
2011-05-30 01:51 . 2010-02-12 14:33 51712 ----a-w- c:\windows\AutosetFrequency.exe
2011-05-30 01:49 . 2011-05-30 01:49 -------- d-----w- c:\program files\Elantech
2011-05-30 01:46 . 2011-05-30 01:46 -------- d-----w- c:\program files (x86)\Launch Manager
2011-05-30 01:44 . 2011-05-30 01:44 -------- d---a-w- C:\book
2011-05-30 01:42 . 2011-05-30 01:42 0 ----a-w- c:\windows\ativpsrm.bin
2011-05-30 01:41 . 2011-05-30 01:41 3 ----a-w- c:\windows\system32\PLD_Framework.cmd
2011-05-30 01:40 . 2011-05-30 01:40 -------- dc----w- c:\windows\system32\DRVSTORE
2011-05-30 01:40 . 2010-04-28 21:43 38528 ----a-w- c:\windows\system32\drivers\usbfilter.sys
2011-05-30 01:39 . 2011-05-30 01:39 -------- d-----w- c:\program files\ATI
2011-05-30 01:39 . 2011-05-30 01:40 -------- d-----w- c:\program files (x86)\ATI Technologies
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 03:40 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-06-28 265984]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-28 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-10 975952]
.
c:\users\MAXAMAN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files (x86)\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-08-10 321104]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 868896]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-29 243232]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1856051602-3803119916-414088809-1000Core.job
- c:\users\MAXAMAN\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-30 02:45]
.
2011-05-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1856051602-3803119916-414088809-1000UA.job
- c:\users\MAXAMAN\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-30 02:45]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 03:42 137584 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-21 11444840]
"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 861216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://acer.msn.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://acer.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-05-30 19:25:05
ComboFix-quarantined-files.txt 2011-05-30 18:25
.
Pre-Run: 461,020,155,904 bytes free
Post-Run: 460,907,192,320 bytes free
.
- - End Of File - - CF70971402AF083639649000BAD50E0F

[Blade81]

Hi,

Nothing malicious in those logs but some outdated software is present. I recommend to install and run Secunia Personal Software Inspector (PSI) and fix its findings.

Uninstall ComboFix:

• Click START then RUN
• Now copy-paste Combofix /uninstall in the runbox and click OK

[maxman]

installed Secunia Personal Software Inspector (PSI) but when i ran it ,it seemed to stall on testing internet connection .
to yourself and spy bot for the help you have given me keep up the good work a very grateful maxan.
combo fix is run from a usb drive ,
is it ok to install my backed up programs/files now ?

[maxman]

can i uninstall erunt ?

[Blade81]

Hi,

You could open a topic for PSI issue on their forum.

combo fix is run from a usb drive

You should still run the commands I listed in previous post if not done yet. Even if ComboFix was run from a usb drive.

is it ok to install my backed up programs/files now ?

Yes and ERUNT can be uinstalled.

[maxman]

thanks for the tip on psi sorted, combofix not found when "run combofix /uninstall"???? installed all my programs everything working a ok once again maxman.

[Blade81]

Hi,

Please download & run this uninstaller.

[maxman]

installed and ran the link

[Blade81]

Good. Any issues left or shall we mark the topic as resolved?

[maxman]

just 1 more thing if its ok i,m waiting on a windows update "its a big file " 88.1mb if all goes well with that then i think that will be job done so much for bearing with me let you know how it goes .