Error Message Trying to Run gmer.exe

[blackguardrock]

Ok, I know I have a ton of malware and I have been putting my laptop back together piece by piece for 4 days now. I have an Acer Aspire One 150 Netbook with an Intel Aom Processor N270 and1GB RAM.

Recently while trying to run the gmer.exe I encountered the following error:

AppName: gmer.exe AppVer: 1.0.14.14536
ModName: ntdll.dll ModVer: 5.1.2600.5512 Offset: 00005d44

I am using ZoneAlarm firewall, AVG basic, Spybot S&D, Ad-Aware, CCleaner, F-Secure Blacklight, Malwarebyte' Anti-malware, and Advanced System Care. I have access to McAfee through Cox but I uninstalled it because I was seriously infected while it was installed and updated. I have ran every program in normal mode and safe mode, with system restore is turned off.

Current Symptoms: Can't install audio driver Realtek HD Audio Manager
Search is disabled
Fake Tray alert pop-up
Corrupt file error while running scanners
Task Manager won't start
Can't access Acer eRecovery Management

I am having these, as well as countless other problems. Can somebody help me out, please? I just got this thing for Christmas! Thank you in advance.

Here is my DDS logfile:

DDS (Ver_09-01-07.01) - NTFSx86
Run by Andrew at 9:55:32.21 on Tue 02/03/2009
Internet Explorer: 7.0.5730.13

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1208&m=aoa150
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Adobe PDF Reader Link Helper: {b782ede4-ccb3-4e3e-981f-96c68116f38c} - c:\windows\system32\AcroIEHelpe.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} -
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [Framework Windows] frmwrk32.exe
dRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2009-02-03 09:29 <DIR> --d----- c:\program files\Trend Micro
2009-02-03 02:59 1 a------- c:\windows\system32\uniq.tll
2009-02-03 02:59 43,520 a------- c:\windows\system32\frmwrk32.exe
2009-02-03 02:09 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-02-03 02:04 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-03 02:04 <DIR> --d----- c:\program files\Lavasoft
2009-02-03 02:02 <DIR> --d----- c:\program files\CCleaner
2009-02-03 01:54 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-02-03 01:49 80,160 a------- c:\windows\system32\AcroIEHelpe.dll
2009-02-03 01:30 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-03 01:30 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-03 01:30 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-03 01:24 0 a------- c:\windows\system32\58.tmp
2009-02-03 01:23 0 a------- c:\windows\system32\56.tmp
2009-02-03 01:22 0 a------- c:\windows\system32\54.tmp
2009-02-02 23:53 4 a------- c:\windows\system32\srvblck.tmp
2009-02-02 16:49 64,512 a------- c:\windows\system32\codeblocks.exe
2009-02-02 16:48 64,512 a------- c:\windows\system32\pdbcopy.exe
2009-02-02 16:47 81 a------- c:\windows\file.bat
2009-02-02 15:48 137,280 a------- c:\windows\system32\drivers\ethtgpxw.sys
2009-02-02 15:47 <DIR> --d----- c:\program files\IObit
2009-02-02 15:47 <DIR> --d----- c:\docume~1\andrew\applic~1\IObit
2009-02-02 15:17 64,512 a------- c:\windows\system32\i386kd.exe
2009-02-02 11:03 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-02-02 10:46 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-02-02 10:46 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2009-02-02 10:46 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-02-02 10:46 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-02-02 10:46 <DIR> --d----- c:\program files\AVG
2009-02-02 10:46 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-02-02 10:18 1,221,008 a------- c:\windows\system32\zpeng25.dll
2009-02-02 10:18 348,371 a------- c:\windows\system32\vsconfig.xml
2009-02-02 10:02 <DIR> --d----- c:\program files\msn gaming zone
2009-02-02 10:00 22 a------- c:\windows\system32\zlclient_2nd_2009_02_02_09_58_42_small.dmp.zip
2009-02-02 10:00 22 a------- c:\windows\system32\zlclient_2nd_2009_02_02_09_53_32_small.dmp.zip
2009-02-02 09:32 <DIR> --d----- c:\windows\system32\UAs
2009-02-02 09:32 <DIR> --d----- c:\windows\system32\dtw5d
2009-02-02 09:32 <DIR> --d----- c:\windows\system32\cks
2009-02-02 09:16 997,888 a------- c:\windows\system32\nwklr.ini
2009-02-02 09:16 989,696 a------- c:\windows\system32\korlg.ini
2009-02-02 09:16 21,504 a------- c:\windows\system32\nwpp.ini
2009-02-02 09:16 17,408 a------- c:\windows\system32\pporlg.ini
2009-02-02 09:16 850,944 a------- c:\windows\system32\nwwlnt.ini
2009-02-02 09:16 826,368 a------- c:\windows\system32\worlg.ini
2009-02-02 08:03 <DIR> --d----- c:\windows\system32\RTCOM
2009-02-02 08:02 335,872 a------- c:\windows\HideWin.exe
2009-02-01 23:30 19,968 a------- c:\windows\_MSRSTRT.EXE
2009-02-01 13:32 3,468 a------- C:\rollback.ini
2009-02-01 13:10 <DIR> --d----- c:\docume~1\andrew\applic~1\MailFrontier
2009-02-01 12:29 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-02-01 12:28 <DIR> --d----- c:\windows\system32\ZoneLabs
2009-02-01 12:28 <DIR> --d----- c:\program files\Zone Labs
2009-01-31 09:19 527 a------- c:\windows\system32\win32hlp.cnf
2009-01-31 09:18 1 a------- c:\windows\system32\test.ttt
2009-01-31 08:58 0 a------- c:\windows\mqcd.dbt
2009-01-31 08:57 32,768 a------- c:\windows\system32\rer.wa
2009-01-31 08:57 28,672 a------- c:\windows\system32\do8d.sr
2009-01-31 08:57 32,768 a------- c:\windows\system32\qzhr1.ant
2009-01-31 08:57 28,672 a------- c:\windows\system32\dedwf.lp
2009-01-31 08:57 77,312 a------- c:\windows\system32\re3d.pf
2009-01-31 08:57 <DIR> --d----- c:\windows\Internet Logs
2009-01-31 08:57 2 a------- C:\1546723872
2009-01-31 08:57 111,104 a------- c:\windows\system32\azton.mt
2009-01-31 08:57 132,608 a------- C:\bajgw.exe
2009-01-31 08:31 172,032 a------- c:\windows\system32\igfxres.dll
2009-01-30 05:57 229,376 a------- c:\windows\system32\NVUNINST.EXE
2009-01-30 05:56 <DIR> --d----- C:\swsetup
2009-01-29 21:49 <DIR> --d----- c:\windows\system32\Lang
2009-01-29 10:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-01-28 15:44 <DIR> --d----- C:\CloneDVDTemp
2009-01-28 15:42 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Elaborate Bytes
2009-01-28 14:30 4,096 a------- c:\windows\d3dx.dat
2009-01-28 08:13 42 a------- c:\windows\system32\Jiii_PNUCT.pnc
2009-01-28 07:55 30,080 a------- c:\windows\system32\drivers\RKHit.sys
2009-01-28 07:54 42 a------- c:\windows\system32\AK083E209605E394C.lie
2009-01-28 07:54 <DIR> --d----- c:\program files\Perfect Uninstaller
2009-01-27 09:47 <DIR> --d----- c:\program files\ATHR
2009-01-27 09:37 34,816 a------- c:\windows\system32\RtkCoInstXP.dll
2009-01-27 09:29 <DIR> --d----- C:\Driver Download
2009-01-27 09:19 <DIR> --d----- C:\Driver Backup 1-27-2009-91844
2009-01-27 09:02 1,686,016 a------- c:\windows\system32\clinetsuitex6.ocx
2009-01-27 09:02 427,864 a------- c:\windows\system32\XceedZip.dll
2009-01-27 09:02 662,288 a------- c:\windows\system32\MSCOMCT2.OCX
2009-01-25 15:08 268,648 a------- c:\windows\system32\mucltui.dll
2009-01-25 15:08 208,744 a------- c:\windows\system32\muweb.dll
2009-01-25 15:08 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-01-25 07:28 371,424 a------- c:\windows\system\updspapi.dll
2009-01-24 13:45 <DIR> --d----- c:\docume~1\andrew\applic~1\FMZilla
2009-01-24 08:33 168,448 a------- c:\windows\system32\unrar.dll
2009-01-24 08:33 839,680 a------- c:\windows\system32\lameACM.acm
2009-01-24 08:33 118,784 a------- c:\windows\system32\ac3acm.acm
2009-01-24 08:33 414 a------- c:\windows\system32\lame_acm.xml
2009-01-24 08:33 795,648 a------- c:\windows\system32\xvidcore.dll
2009-01-24 08:33 217,088 a------- c:\windows\system32\yv12vfw.dll
2009-01-24 08:33 130,048 a------- c:\windows\system32\xvidvfw.dll
2009-01-24 08:33 3,596,288 a------- c:\windows\system32\qt-dx331.dll
2009-01-24 08:33 684,032 a------- c:\windows\system32\divx.dll
2009-01-24 08:33 86,016 a------- c:\windows\system32\dpl100.dll
2009-01-24 08:33 57,344 a------- c:\windows\system32\ff_vfw.dll
2009-01-24 08:33 547 a------- c:\windows\system32\ff_vfw.dll.manifest
2009-01-24 08:33 <DIR> --d----- c:\program files\K-Lite Codec Pack
2009-01-24 07:13 60,273 a------- c:\windows\system32\pthreadGC2.dll
2009-01-23 09:30 <DIR> --d----- c:\program files\common files\Logitech
2009-01-23 06:25 <DIR> --d----- c:\docume~1\andrew\applic~1\DriverCure
2009-01-23 06:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DriverCure
2009-01-23 06:24 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Downloaded Installations
2009-01-23 06:12 <DIR> --d----- c:\docume~1\andrew\applic~1\ImTOO Software Studio
2009-01-23 06:11 <DIR> --d----- c:\program files\ImTOO
2009-01-23 02:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\WildTangent
2009-01-23 01:00 324,096 a------- c:\windows\IsUninst.exe
2009-01-23 00:57 <DIR> --d----- c:\docume~1\andrew\applic~1\DAEMON Tools Pro
2009-01-23 00:56 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2009-01-23 00:56 <DIR> --d----- c:\program files\DAEMON Tools Lite
2009-01-23 00:52 <DIR> --d----- c:\docume~1\andrew\applic~1\DAEMON Tools Lite
2009-01-22 10:20 <DIR> --d----- c:\program files\AOE
2009-01-22 10:08 <DIR> --d----- c:\docume~1\andrew\applic~1\Crayon Physics Deluxe
2009-01-22 06:59 <DIR> --d----- c:\program files\AviSynth 2.5
2009-01-21 18:19 172 a------- c:\windows\system32\temp_0000_85-24.aok
2009-01-21 18:18 173 a------- c:\windows\system32\test.aok
2009-01-17 11:57 4,757 a------- c:\windows\Irremote.ini
2009-01-16 04:39 <DIR> --d----- c:\docume~1\andrew\applic~1\PCF-VLC
2009-01-16 03:05 0 -------- c:\windows\WB.ini
2009-01-16 02:55 42,672 -------- c:\windows\system32\wbsys.dll
2009-01-15 16:18 69 a------- c:\windows\NeroDigital.ini
2009-01-15 12:08 <DIR> --d----- c:\docume~1\andrew\applic~1\Participatory Culture Foundation
2009-01-15 11:28 <DIR> --d----- c:\program files\WMR11
2009-01-14 10:11 <DIR> --d----- c:\windows\Downloaded Installations
2009-01-14 10:08 <DIR> --d----- c:\windows\Replay Converter 3
2009-01-14 10:07 757,760 a------- c:\windows\iun6002.exe
2009-01-13 13:13 <DIR> --d----- c:\program files\Microsoft Visual Studio 8
2009-01-13 10:56 717,296 a------- c:\windows\system32\drivers\sptd.sys
2009-01-13 10:26 <DIR> --d----- c:\program files\Jasc Software Inc
2009-01-13 10:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Configs
2009-01-13 10:00 11,114 a------- c:\docume~1\alluse~1\applic~1\MainApp.dll
2009-01-13 10:00 14 a------- c:\windows\system32\systeminfo3.dll
2009-01-13 09:58 87,608 a------- c:\docume~1\andrew\applic~1\inst.exe
2009-01-13 09:58 47,360 a------- c:\windows\system32\drivers\pcouffin.sys
2009-01-13 09:58 47,360 a------- c:\docume~1\andrew\applic~1\pcouffin.sys
2009-01-12 17:31 <DIR> --d----- c:\docume~1\andrew\applic~1\DMCache
2009-01-12 14:55 1,100 a------- c:\windows\system32\d3d8caps.dat
2009-01-12 14:55 1,324 a------- c:\windows\system32\d3d9caps.dat
2009-01-12 09:34 <DIR> --d----- c:\program files\Guild Wars
2009-01-11 12:17 225,280 a------- c:\windows\system32\rewire.dll
2009-01-11 12:17 <DIR> --d----- c:\program files\VstPlugins
2009-01-11 12:17 1,294,336 a------- c:\windows\system32\vorbis.acm
2009-01-11 12:16 <DIR> --d----- c:\program files\Outsim
2009-01-11 12:15 <DIR> --d----- c:\program files\Image-Line
2009-01-10 08:43 0 a------- C:\OrbPVR.db
2009-01-10 06:48 <DIR> --d----- c:\program files\Nero
2009-01-10 06:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Nero
2009-01-09 11:10 21,504 ac------ c:\windows\system32\dllcache\hidserv.dll
2009-01-09 11:10 21,504 a------- c:\windows\system32\hidserv.dll
2009-01-09 11:10 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2009-01-09 11:10 32,128 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-01-09 11:10 32,128 a------- c:\windows\system32\drivers\usbccgp.sys
2009-01-09 11:01 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-01-09 11:00 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-01-09 11:00 0 a---h--- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-01-09 10:59 301,656 a------- c:\windows\system32\BtCoreIf.dll
2009-01-09 10:59 170,512 a------- c:\windows\system32\kemutb.dll
2009-01-09 10:59 145,936 a------- c:\windows\system32\KemUtil.dll
2009-01-09 10:59 117,264 a------- c:\windows\system32\KemWnd.dll
2009-01-09 10:59 84,496 a------- c:\windows\system32\KemXML.dll
2009-01-09 05:41 <DIR> --d----- c:\program files\common files\McAfee
2009-01-09 04:27 <DIR> --d----- c:\docume~1\andrew\applic~1\Malwarebytes
2009-01-09 04:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-01-09 03:35 204 a------- c:\windows\XP.url
2009-01-09 03:34 3,080,968 a------- c:\windows\muvaudio2-setup.exe
2009-01-09 00:12 53 a------- c:\windows\REGKEYNT.INI
2009-01-08 22:51 4,224 ac------ c:\windows\system32\dllcache\beep.sys
2009-01-08 22:47 <DIR> --d----- c:\docume~1\andrew\applic~1\Thinstall
2009-01-07 21:43 <DIR> --d----- c:\windows\Replay Music
2009-01-07 21:25 323,584 a------- c:\windows\system32\AUDIOGENIE2.DLL
2009-01-07 21:22 <DIR> --d----- c:\windows\Replay Media Catcher
2009-01-05 14:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Napster

==================== Find3M ====================

2009-02-02 16:48 64,512 a------- c:\windows\system32\regwiz.exe
2009-02-02 12:14 850,944 a------- c:\windows\system32\wininet.dll
2009-02-02 12:14 21,504 a------- c:\windows\system32\powrprof.dll
2009-01-31 09:18 142,848 a------- c:\windows\system32\userinit.exe
2009-01-31 08:57 578,560 a------- c:\windows\system32\user32.DLL
2008-12-29 23:58 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-12-26 00:34 5,384,109 a------- c:\docume~1\andrew\applic~1\consoleclassixsetup.exe
2008-12-25 07:59 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-11 02:57 333,952 a------- c:\windows\system32\drivers\srv.sys
2008-12-04 09:31 53,248 a------- c:\windows\system32\CSVer.dll
2008-08-15 09:51 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat

============= FINISH: 9:56:03.67 ===============

[Angelfire777]

Hi, welcome to TSF!

Did you manage to get GMER to run as stated here?

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

If not, rename it to something else then run it. It should produce a log after that.

Also, please turn System Restore back on. It's better to have infected restore points than nothing at all.

[blackguardrock]

Hey, thanks for the help. Sorry it took so long to get back to you. I ended up having to do a complete system restore. I ended up fixing everything but the internet. I couldn't get my laptop to find an ip address through ipconfig and after hours on the phone with Acer/Cox I just decided to redo the whole damn thing. I am now up and running using McAfee. Do you have any suggestion for keeping the nasties out now that they are finally gone for good?

Thank you for your help.

[Angelfire777]

Read TonyKlein's How Did I Get Infected In The First Place?.

and check out miekiemoes' "How to Prevent Malware"