Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Topic posted for EffingCow

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Topic posted for EffingCow

Unread postby effingcow » November 8th, 2008, 4:16 am

There were a bunch of them 2 days ago, but I deleted them, then I scanned again yesterday, and I got 2 more mbfbokgu.dll.vir and owqtbw.dll.vir
effingcow
Regular Member
 
Posts: 31
Joined: August 29th, 2008, 11:57 am
Location: Aruba
Advertisement
Register to Remove

Re: Topic posted for EffingCow

Unread postby ndmmxiaomayi » November 8th, 2008, 5:09 am

Oh...

They are quarantined by Combofix already. Not an issue. They can be left alone. We will remove them later.

Any other issues?
ndmmxiaomayi
MRU Emeritus
MRU Emeritus
 
Posts: 9708
Joined: July 17th, 2006, 9:22 am

Re: Topic posted for EffingCow

Unread postby effingcow » November 8th, 2008, 2:16 pm

Just a really slow computer, that freezes a lot. Does this mean I can go on my bank website now safely? you didn't give me any homework, what should I do now?
effingcow
Regular Member
 
Posts: 31
Joined: August 29th, 2008, 11:57 am
Location: Aruba

Re: Topic posted for EffingCow

Unread postby ndmmxiaomayi » November 9th, 2008, 6:25 am

For safety reasons, I suggest that you use another computer to access your bank accounts.

As for a slow computer, there's a number of items that I can disable for you to see if it helps improve your computer's performance. :)

O4 - HKLM\..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe /r

Do you use IBM's Presentation Director? A description is here - http://www.systemlookup.com/Startup/132 ... P_exe.html

If no, it can be disabled.

O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor

This is Thinkpad's Power Manager. Do you use any custom power settings? Based on some users' feedback, this could cause computers to slow down. If you are using custom settings, you may want to re-install Power Manager.

http://forum.thinkpads.com/viewtopic.php?t=52450

O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL,StartBattLog

This measures your battery changes, like how much more is needed get the battery full charged, how much is being used, etc. If your laptop is always connected to your power adapter, this could be disabled since you would have no need to view how much battery power is left.

However, if you are always on the go, and need to find out how much battery power is left, leaving this alone would be the best.

http://www.systemlookup.com/Startup/173 ... ttLog.html

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

This is your touchpad tray icon (near the clock). If you use the advanced features of your touchpad, this would need to be enabled. Otherwise, it can be disabled safely.

http://www.systemlookup.com/Startup/122 ... h_exe.html

O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe

Depending on the model of your Thinkpad, pressing one key will let you change the volume or opens the help file. If you don't think you need to change the volume or read the help file, it can be disabled safely.

http://www.systemlookup.com/Startup/132 ... R_EXE.html

O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

Not needed since you can access it via Start Menu, but if you prefer convenience, we can leave this alone.

http://www.systemlookup.com/Startup/353 ... p_exe.html

O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

Required for the various sound settings, such as the sound effects. If you don't use them, it can be disabled safely.

http://www.systemlookup.com/Startup/114 ... P_exe.html

O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE

Part of Thinkpad Productivity Centre. Helps you to enhance your Thinkpad. If you don't use this feature, we can disable it.

http://www.systemlookup.com/Startup/119 ... h_EXE.html

O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe

Related to Thinkpad Productivity Centre. Not really needed unless you use IBM Productivity Centre.

http://www.systemlookup.com/Startup/5608-LPMGR_exe.html

O4 - HKLM\..\Run: [CameraApplicationLauncher] C:\Program Files\Lenovo\Camera Center\bin\CameraApplicationLaunchpadLauncher.exe

This is related to your Thinkpad's camera. Unless you use it, it can be safely disabled.

O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe

It's not needed as it tells your connection status.

http://www.systemlookup.com/Startup/394-ACTray_exe.html

O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe

Related to Thinkpad Connectivity Solutions. If you use them, it would be best to leave them enabled.

http://www.pc.ibm.com/us/think/thinkvan ... tions.html

O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe

Not really needed as it can be accessed via Control Panel. But if you prefer convenience, we can leave it alone.

http://www.systemlookup.com/Startup/455 ... y_exe.html

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

If your Thinkpad provides you with a hot key (some sort of shortcut key) to access Intel Graphics settings, this would be needed. If unsure, best to leave it enabled.

http://www.systemlookup.com/Startup/4221-hkcmd_exe.html

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

Doesn't appear that this is needed based on the description in the below given link. I think this can be safely disabled.

http://www.systemlookup.com/Startup/935 ... s_exe.html

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

This is to remind you to update HP software. Not needed. You can find it in your Start Menu.

http://www.systemlookup.com/Startup/426 ... 2_exe.html

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

This program can be hard to disable, but it's doable.

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

Unless you use an iPhone or iPod Touch, this program is again not needed for startup, but as per many Apple products, Apple makes it hard to disable it, but still doable.

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

Not needed to run on startup as well, can be hard to disable, but doable.

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

If you don't use Windows gadgets, it can be safely disabled. They can usually found on the right hand side. A sample:

Image

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

Not needed on startup. You can manually run MSN Messenger (now known as Windows Live Messenger) via the Start Menu. However, if you prefer convenience, we can leave this running on startup.




Please let me know which programs you would like to disable at startup.
ndmmxiaomayi
MRU Emeritus
MRU Emeritus
 
Posts: 9708
Joined: July 17th, 2006, 9:22 am

Re: Topic posted for EffingCow

Unread postby effingcow » November 12th, 2008, 8:26 am

Hi!!

I'd like to disable the following:

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe &
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

If you can help me do that, I'd appreciate it!

thanks!
effingcow
Regular Member
 
Posts: 31
Joined: August 29th, 2008, 11:57 am
Location: Aruba

Re: Topic posted for EffingCow

Unread postby ndmmxiaomayi » November 14th, 2008, 10:38 am

Hi Amanda,

Please download Winpatrol from here - http://www.winpatrol.com/wpsetup.exe

Right click on wpsetup.exe and select Run As Administrator to install it.

When done, open the program by double clicking on the dog icon near the clock.

Select the Startup Programs tab.

Select SynTPEnh and click on Disable.

Repeat for all these that you want to disable:

  • EZEJMNAP
  • AwaySch
  • LPManager
  • ACWLIcon
  • IgfxTray
  • HotKeysCmds
  • Persistence
  • HP Software Update
  • AppleSyncNotifier
  • iTunesHelper
  • msnmsgr

Click Close when done.

When disabling some programs, Winpatrol may prompt you. Click Yes at the prompt.

After that, restart your computer. Please let me know if your computer is behaving better.
ndmmxiaomayi
MRU Emeritus
MRU Emeritus
 
Posts: 9708
Joined: July 17th, 2006, 9:22 am

Re: Topic posted for EffingCow

Unread postby ndmmxiaomayi » November 19th, 2008, 11:10 am

Hi Amanda,

How are things going?
ndmmxiaomayi
MRU Emeritus
MRU Emeritus
 
Posts: 9708
Joined: July 17th, 2006, 9:22 am

Re: Topic posted for EffingCow

Unread postby Gary R » November 23rd, 2008, 5:06 am

Due to lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
Gary R
Administrator
Administrator
 
Posts: 21872
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 68 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware