Hi new and need advice - { Moved from Windows XP - Needs Malware Help}

[suger]

Hi all i've just brought this laptop IBMThinkpad the person reformated it in put on AVG(free version) i came home had a little play and then started getting a message saying CRITICAL SYSTEM ERROR and needing to down load winreg32 i've down loaded ADWEAR07 and SPYBOT but i really have no idea what i'm doing can anyone help

 

[devil_himself]

can you please tell us the Complete error message

 

[suger]

i've nt seen it today its something about needing to down load this or my system will be corrupt and i will lose data

 

[suger]

Has i'v not put anything on this thing yet can i just use the disk i was given and reformat

 

[devil_himself]

Start > run > eventvwr.msc > copy and paste some of the recent errors

 

[suger]

event viewer
from where
local
application
security
or system?

 

[devil_himself]

For Both .. Application and System

Double Click on the errors ..a new windows will pop up .. on the right pane .. use the "Double notepad Icon" to copy the error and then paste them here

 

[suger]

in application there are warnings and errors

 

[devil_himself]

Yes .. paste the Errors here

 

[suger]

this is app's
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 60
Date: 03/11/2007
Time: 10:43:55
User: N/A
Computer: IBM-F96DF9978CD
Description:
WMI ADAP was unable to process the performance libraries: 0x80041001

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 60
Date: 03/11/2007
Time: 00:46:11
User: N/A
Computer: IBM-F96DF9978CD
Description:
WMI ADAP was unable to process the performance libraries: 0x80041001

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3011
Date: 03/11/2007
Time: 00:42:52
User: N/A
Computer: IBM-F96DF9978CD
Description:
Unloading the performance counter strings for service ISAPISearch (ISAPISearch) failed. The Error code is the first DWORD in Data section.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: f2 03 00 00 3b 07 00 00 ò...;...
Event Type: Warning
Event Source: LoadPerf
Event Category: None
Event ID: 2004
Date: 03/11/2007
Time: 00:42:52
User: N/A
Computer: IBM-F96DF9978CD
Description:
The Performance registry value Counter 009 string is corrupted. Skip string \"卍䙃\".

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b6 01 00 00 ¶...
this is system
Event Type: Warning
Event Source: b57w2k
Event Category: None
Event ID: 4
Date: 03/11/2007
Time: 10:39:19
User: N/A
Computer: IBM-F96DF9978CD
Description:
Broadcom NetXtreme Fast Ethernet: The network link is down. Check to make sure the network cable is properly connected.
Data:
0000: 00 00 00 00 02 00 56 00 ......V.
0008: 00 00 00 00 04 00 05 80 .......€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Warning
Event Source: Win32k
Event Category: None
Event ID: 240
Date: 03/11/2007
Time: 06:40:42
User: N/A
Computer: IBM-F96DF9978CD
Description:
A request to suspend power was denied by winlogon.exe.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 4e 00 ......N.
0008: 00 00 00 00 f0 00 00 80 ....ð..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Error
Event Source: ACPIEC
Event Category: None
Event ID: 1
Date: 02/11/2007
Time: 21:50:44
User: N/A
Computer: IBM-F96DF9978CD
Description:
\Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 68 00 01 00 be 00 ..h...¾.
0008: 00 00 00 00 01 00 05 c0 .......À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 99 9e 36 00 11 20 ff ff ™ž6.. ÿÿ
0030: 71 00 03 00 11 20 0f 00 q.... ..
0038: 81 00 f3 00 a1 06 57 02 .ó.¡.W.
0040: 11 20 2e 00 a1 02 27 00 . ..¡.'.
0048: 11 22 1c 00 41 19 03 00 ."..A...
0050: 16 28 24 00 66 00 03 00 .($.f...
0058: 56 00 47 2e 76 00 03 00 V.G.v...
0060: 16 2a 0f 00 86 00 3b 01 .*..†.;.
0068: a6 09 3e 04 16 2a 24 00 ¦.>..*$.
0070: 66 00 03 00 56 00 86 14 f...V.†.
0078: 76 00 03 00 16 0a 0f 00 v.......
0080: 86 00 2a 01 a6 08 a9 03 †.*.¦.©.
0088: 16 0a 12 00 16 1a 1b 00 ........
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 02/11/2007
Time: 21:44:48
User: N/A
Computer: IBM-F96DF9978CD
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 00061BC26128. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 79 00 00 00 y...
Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 02/11/2007
Time: 21:44:15
User: N/A
Computer: IBM-F96DF9978CD
Description:
The IP address lease 86.5.1.79 for the Network Card with network address 00061BC26128 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: Win32k
Event Category: None
Event ID: 240
Date: 02/11/2007
Time: 21:03:13
User: N/A
Computer: IBM-F96DF9978CD
Description:
A request to suspend power was denied by winlogon.exe.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 4e 00 ......N.
0008: 00 00 00 00 f0 00 00 80 ....ð..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 02/11/2007
Time: 21:03:05
User: N/A
Computer: IBM-F96DF9978CD
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 00061BC26128. The following error occurred:
The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: c7 04 00 00 Ç...

is this enough

 

[chilkotardis]

Okay, i'm thinking this is spyware, can we wait until someone authorized to help comes by?

 

[devil_himself]

Not Much in the Event Viewer .. Lets wait for that error to come again .. and we wanna see the Whole error

 

[suger]

dont know where it was but something some were said window thingey had been changed i'm poo at this computer stuff

 

[suger]

Event Type: Warning
Event Source: LoadPerf
Event Category: None
Event ID: 2004
Date: 03/11/2007
Time: 00:42:52
User: N/A
Computer: IBM-F96DF9978CD
Description:
The Performance registry value Counter 009 string is corrupted. Skip string \"卍䙃\".

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b6 01 00 00 ¶...

loads of these then this
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 02/11/2007
Time: 23:58:47
User: IBM-F96DF9978CD\karla
Computer: IBM-F96DF9978CD
Description:
A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 60
Date: 02/11/2007
Time: 23:36:41
User: N/A
Computer: IBM-F96DF9978CD
Description:
WMI ADAP was unable to process the performance libraries: 0x80041001

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

[suger]

FOUND IT it was information not warning

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 31/10/2007
Time: 01:39:27
User: N/A
Computer: IBM-F96DF9978CD
Description:
Application popup: Messenger Service : Message from SYSTEM to ALERT on 10/31/2007 12:39:27 AM

STOP! IMMEDIATE ATTENTION REQUIRED

CRITICAL SYSTEM ERRORS.

Download Registry Cleaner from: wreg32.com

FAILURE TO ACT NOW MAY LEAD TO DATA LOSS AND CORRUPTION!



For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.