What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] BDS/Poison.auwd / CPU usage constantly at 100%

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Yesterday my system seemed slower than normal and when I investigated I noticed that the CPU usage was constantly stuck at 100%, even when the system was idle. About 80% of the usage was from a process called op_mon.exe which is my firewall (Agnitum Outpost) and the remaining 20% was from a process called csrss.exe.

I think the reason my firewall is so busy is because it's constantly having to block something that I've denied access to in the past which may or may not be hiding inside csrss.exe but that's what I'd like some help with if possible.

I've run virus scans and MBAM and they both find things but they keep coming back (more on that in a moment). Avira finds BDS/Poison.auwd and MBAM finds backdoor bot evidence and both of them say they have removed the files after running. Then, when I reboot my system everything is fine for about twenty seconds before my machine restarts itself automatically, which I think is the virus detecting that it's not running and rebooting in order to re-initialise itself or whatever.

Suffice to say that after the second (automatic) reboot my machine once again shows the same signs. CPU usage is back at 100% and Avira & MBAM both find the same problems once again.

I realise backdoor stuff means changing passwords from a non-infected machine etc, and I know my best option might be a reformat but if anyone can help I'd like to try this route first, thank you.

Here are my logs:

MBAM Log:

Malwarebytes' Anti-Malware 1.44
Database version: 3634
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

25/01/2010 13:47:59
mbam-log-2010-01-25 (13-47-59).txt

Scan type: Quick Scan
Objects scanned: 122570
Time elapsed: 4 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


DDS Log:

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 13:57:40.56 on 25/01/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2641 [GMT 0:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wdfmgr.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\01\dds.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\documents and settings\bex\application data\msyqeu32.exe,c:\windows\system32\msqjgu32.exe,c:\windows\system32\msddky32.exe,c:\documents and

settings\bex\application

data\msqmvu32.exe,c:\windows\system32\msuwhl32.exe,c:\windows\system32\msuslo32.exe,c:\windows\system32\msgike32.exe,c:\windows\system32\msyjqc32.exe,c:\windows\system32\mspavm32.exe,c:\windows\system32\mspa

ez32.exe,c:\documents and settings\bex\application

data\mspljj32.exe,c:\windows\system32\msxbqg32.exe,c:\windows\system32\msvxlf32.exe,c:\windows\system32\msztca32.exe,c:\windows\system32\msgeor32.exe,c:\windows\system32\mszjlv32.exe,c:\windows\system32\mslq

ql32.exe,c:\windows\system32\msbnib32.exe,c:\windows\system32\msmbef32.exe,c:\documents and settings\bex\application

data\mskdij32.exe,c:\windows\system32\msjdwi32.exe,c:\windows\system32\msbuzu32.exe,c:\documents and settings\bex\application data\mscuyt32.exe,c:\documents and settings\bex\application

data\msmtrl32.exe,c:\windows\system32\msosll32.exe,c:\windows\system32\mssrwh32.exe,c:\windows\system32\mstjqg32.exe,c:\windows\system32\msnktt32.exe,c:\windows\system32\msqxjd32.exe,c:\windows\system32\msew

rz32.exe,c:\windows\system32\mspbqp32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [OutpostMonitor] c:\progra~1\agnitum\outpos~1\op_mon.exe /tray /noservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-27 11608]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [2009-12-27 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\agnitum\outpos~1\acs.exe [2009-12-27 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-27 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-27 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2009-12-27 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2009-12-27 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S1 kbd;kbd;\??\c:\windows\system32\drivers\kbd.sys –> c:\windows\system32\drivers\kbd.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-18 11:40 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-18 11:40 73,728 a——- c:\windows\system32\javacpl.cpl
2010-01-03 19:18 77,312 a——- c:\windows\system32\drivers\viasraid.tsk
2010-01-03 19:18 16,904 a——- c:\windows\system32\drivers\KLMD.sys
2010-01-02 22:53 a-dshr– C:\cmdcons
2010-01-02 19:43 –d—– C:\spoolerlogs
2010-01-02 19:18 –d—– c:\docume~1\jamey\applic~1\Malwarebytes
2010-01-02 19:18 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-01 03:24 –d—– c:\program files\Trend Micro
2010-01-01 03:22 8 a——- c:\windows\crpf.bin
2010-01-01 03:22 4 a——- c:\windows\crpf_sdum.bin
2010-01-01 02:49 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 –d—– c:\program files\Lavasoft
2009-12-31 16:34 –d—– c:\program files\Spybot - Search & Destroy
2009-12-27 15:03 0 a——- c:\windows\%IniPath%
2009-12-27 11:06 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-27 11:06 –d—– c:\program files\Avira
2009-12-27 11:06 –d—– c:\docume~1\alluse~1\applic~1\Avira
2009-12-27 10:58 704,384 a——- c:\windows\system32\drivers\SandBox.sys
2009-12-27 10:58 257,432 a——- c:\windows\system32\drivers\afwcore.sys
2009-12-27 10:56 49 a——- c:\windows\transp.gif
2009-12-27 10:56 31,128 a——- c:\windows\system32\drivers\afw.sys
2009-12-27 10:56 –d—– c:\program files\Agnitum
2009-12-27 10:56 –d—– c:\docume~1\alluse~1\applic~1\Agnitum

==================== Find3M ====================

2010-01-25 13:52 1,740,360 a——- c:\windows\cscmondump.bin
2010-01-04 12:59 134,173 a——- c:\windows\cscmon.bin
2010-01-03 19:19 77,312 a——- c:\windows\system32\drivers\viasraid.sys
2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe

============= FINISH: 13:58:34.92 ===============

GMER Log:

  • Please note: GMER was unable to complete a full scan as it gets part-way through and then my system performs a hard restart (straight to POST with no shutdown first). I have tried a GMER scan performed with "Files" unticked but the same thing still happens, sorry.

Post #2
Hello fingerz and welcome to WhatTheTech! I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instruction I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.
Post #4
fingerz,

🖼Click to load external image (Posted Image) You have multiple AntiVirus (AV) and Firewall (FW) programs installed. Your log shows Comodo AV & FW as well as Avira AV and Outpost FW. Please choose only one of each to keep and uninstall the others via add/remove programs. Running multiple AV & FW programs causes conflicts and slowdowns in your system.

🖼Click to load external image (Posted Image) Please download OTM by OldTimer.
  • Save it to your desktop.
  • Please click OTM and then click >> run.
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Userinit"="c:\\windows\\system32\\userinit.exe,"

:Files
c:\documents and settings\bex\application data\msyqeu32.exe
c:\windows\system32\msqjgu32.exe
c:\windows\system32\msddky32.exe
c:\documents and settings\bex\application data\msqmvu32.exe
c:\windows\system32\msuwhl32.exe
c:\windows\system32\msuslo32.exe
c:\windows\system32\msgike32.exe
c:\windows\system32\msyjqc32.exe
c:\windows\system32\mspavm32.exe
c:\windows\system32\mspaez32.exe
c:\documents and settings\bex\application data\mspljj32.exe
c:\windows\system32\msxbqg32.exe
c:\windows\system32\msvxlf32.exe
c:\windows\system32\msztca32.exe
c:\windows\system32\msgeor32.exe
c:\windows\system32\mszjlv32.exe
c:\windows\system32\mslqql32.exe
c:\windows\system32\msbnib32.exe
c:\windows\system32\msmbef32.exe
c:\documents and settings\bex\application data\mskdij32.exe
c:\windows\system32\msjdwi32.exe
c:\windows\system32\msbuzu32.exe
c:\documents and settings\bex\application data\mscuyt32.exe
c:\documents and settings\bex\application data\msmtrl32.exe
c:\windows\system32\msosll32.exe
c:\windows\system32\mssrwh32.exe
c:\windows\system32\mstjqg32.exe
c:\windows\system32\msnktt32.exe
c:\windows\system32\msqxjd32.exe
c:\windows\system32\msew
c:\documents and settings\bex

:Commands
[purity]
[emptytemp]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


🖼Click to load external image (Posted Image) Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.
Post the contents of GMER.txt in your next reply.

Please include the following in your next post:
  • OTM log
  • Fresh DDS log
  • Attach.txt from DDS
  • GMER log
  • Is your computer running better?
Post #5 last edited
I'm afraid I still can't run a GMER scan properly because it still reboots part-way through but the other logs you requested are below. As for the Comodo AV & FW issue, it's really annoying. I uninstalled Comodo AV ages ago, when I switched to Avira and Outpost, but it still shows up in some things and I don't know why. I do have Comodo System Cleaner installed but that's not an AV product, just a reg/temp files cleaner.

The system is still the same, I'm afraid. Still high CPU usage.

Anyway, here are the logs (The Attach.txt is attached as a file):

OTM Log:

All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\"Userinit"|"c:\\windows\\system32\\userinit.exe," /E : value set successfully!
========== FILES ==========
File/Folder c:\documents and settings\bex\application data\msyqeu32.exe not found.
File/Folder c:\windows\system32\msqjgu32.exe not found.
c:\windows\system32\msddky32.exe moved successfully.
File/Folder c:\documents and settings\bex\application data\msqmvu32.exe not found.
c:\windows\system32\msuwhl32.exe moved successfully.
c:\windows\system32\msuslo32.exe moved successfully.
c:\windows\system32\msgike32.exe moved successfully.
c:\windows\system32\msyjqc32.exe moved successfully.
c:\windows\system32\mspavm32.exe moved successfully.
c:\windows\system32\mspaez32.exe moved successfully.
File/Folder c:\documents and settings\bex\application data\mspljj32.exe not found.
c:\windows\system32\msxbqg32.exe moved successfully.
c:\windows\system32\msvxlf32.exe moved successfully.
c:\windows\system32\msztca32.exe moved successfully.
c:\windows\system32\msgeor32.exe moved successfully.
c:\windows\system32\mszjlv32.exe moved successfully.
c:\windows\system32\mslqql32.exe moved successfully.
c:\windows\system32\msbnib32.exe moved successfully.
c:\windows\system32\msmbef32.exe moved successfully.
File/Folder c:\documents and settings\bex\application data\mskdij32.exe not found.
c:\windows\system32\msjdwi32.exe moved successfully.
c:\windows\system32\msbuzu32.exe moved successfully.
File/Folder c:\documents and settings\bex\application data\mscuyt32.exe not found.
File/Folder c:\documents and settings\bex\application data\msmtrl32.exe not found.
c:\windows\system32\msosll32.exe moved successfully.
c:\windows\system32\mssrwh32.exe moved successfully.
c:\windows\system32\mstjqg32.exe moved successfully.
c:\windows\system32\msnktt32.exe moved successfully.
c:\windows\system32\msqxjd32.exe moved successfully.
File/Folder c:\windows\system32\msew not found.
File/Folder c:\documents and settings\bex not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: Administrator.JAMEYS-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Jamey
->Temp folder emptied: 11381578 bytes
->Temporary Internet Files folder emptied: 15254472 bytes
->Java cache emptied: 22364561 bytes
->FireFox cache emptied: 46872466 bytes
->Google Chrome cache emptied: 856432 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1119318 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 98304 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 94.00 mb


OTM by OldTimer - Version 3.1.6.0 log created on 01262010_212815

Files moved on Reboot…

Registry entries deleted on Reboot…



DDS Log:

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 21:46:20.25 on 26/01/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2579 [GMT 0:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\01\dds.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\documents and settings\bex\application data\msyqeu32.exe,c:\windows\system32\msqjgu32.exe,c:\windows\system32\msddky32.exe,c:\documents and settings\bex\application data\msqmvu32.exe,c:\windows\system32\msuwhl32.exe,c:\windows\system32\msuslo32.exe,c:\windows\system32\msgike32.exe,c:\windows\system32\msyjqc32.exe,c:\windows\system32\mspavm32.exe,c:\windows\system32\mspaez32.exe,c:\documents and settings\bex\application data\mspljj32.exe,c:\windows\system32\msxbqg32.exe,c:\windows\system32\msvxlf32.exe,c:\windows\system32\msztca32.exe,c:\windows\system32\msgeor32.exe,c:\windows\system32\mszjlv32.exe,c:\windows\system32\mslqql32.exe,c:\windows\system32\msbnib32.exe,c:\windows\system32\msmbef32.exe,c:\documents and settings\bex\application data\mskdij32.exe,c:\windows\system32\msjdwi32.exe,c:\windows\system32\msbuzu32.exe,c:\documents and settings\bex\application data\mscuyt32.exe,c:\documents and settings\bex\application data\msmtrl32.exe,c:\windows\system32\msosll32.exe,c:\windows\system32\mssrwh32.exe,c:\windows\system32\mstjqg32.exe,c:\windows\system32\msnktt32.exe,c:\windows\system32\msqxjd32.exe,c:\windows\system32\msewrz32.exe,c:\windows\system32\mspbqp32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [OutpostMonitor] c:\progra~1\agnitum\outpos~1\op_mon.exe /tray /noservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Userinit] c:\windows\system32\userinit.exe,
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-27 11608]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [2009-12-27 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\agnitum\outpos~1\acs.exe [2009-12-27 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-27 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-27 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2009-12-27 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2009-12-27 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S1 kbd;kbd;\??\c:\windows\system32\drivers\kbd.sys –> c:\windows\system32\drivers\kbd.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-26 21:28 –d—– C:\_OTM
2010-01-18 11:40 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-18 11:40 73,728 a——- c:\windows\system32\javacpl.cpl
2010-01-03 19:18 77,312 a——- c:\windows\system32\drivers\viasraid.tsk
2010-01-03 19:18 16,904 a——- c:\windows\system32\drivers\KLMD.sys
2010-01-02 22:53 a-dshr– C:\cmdcons
2010-01-02 19:43 –d—– C:\spoolerlogs
2010-01-02 19:18 –d—– c:\docume~1\jamey\applic~1\Malwarebytes
2010-01-02 19:18 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-01 03:24 –d—– c:\program files\Trend Micro
2010-01-01 03:22 8 a——- c:\windows\crpf.bin
2010-01-01 03:22 4 a——- c:\windows\crpf_sdum.bin
2010-01-01 02:49 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 –d—– c:\program files\Lavasoft
2009-12-31 16:34 –d—– c:\program files\Spybot - Search & Destroy

==================== Find3M ====================

2010-01-26 21:40 1,655,378 a——- c:\windows\cscmondump.bin
2010-01-04 12:59 134,173 a——- c:\windows\cscmon.bin
2010-01-03 19:19 77,312 a——- c:\windows\system32\drivers\viasraid.sys
2009-12-28 13:40 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe

============= FINISH: 21:47:55.42 ===============

Attachments:

Post #6
fingerz,

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
  • Let me know how your computer is running
Post #7
Hey,

Machine still the same, I'm afraid.

Here's the Combofix log:

ComboFix 10-01-26.02 - Jamey 26/01/2010 23:17:56.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2509 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\Forums - Whatthetech\02\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.

((((((((((((((((((((((((( Files Created from 2009-12-26 to 2010-01-26 )))))))))))))))))))))))))))))))
.

2010-01-26 21:28 . 2010-01-26 21:28 ——– d—–w- C:\_OTM
2010-01-24 00:24 . 2010-01-24 00:24 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-sse.dll
2010-01-24 00:24 . 2010-01-24 00:24 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcp71.dll
2010-01-24 00:24 . 2010-01-24 00:24 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\jmc.dll
2010-01-24 00:24 . 2010-01-24 00:24 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcr71.dll
2010-01-24 00:24 . 2010-01-24 00:24 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-d3d.dll
2010-01-21 18:27 . 2010-01-21 18:27 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Temp
2010-01-13 22:04 . 2010-01-13 22:04 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-03 19:18 . 2010-01-03 19:18 16904 —-a-w- c:\windows\system32\drivers\KLMD.sys
2010-01-02 19:43 . 2010-01-02 19:43 ——– d—–w- C:\spoolerlogs
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 . 2010-01-13 22:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:15 . 2010-01-02 19:16 ——– d—–w- c:\program files\ERUNT
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:49 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 . 2009-12-07 14:10 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2010-01-01 02:24 . 2010-01-01 02:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-01 02:24 . 2010-01-01 02:24 ——– d—–w- c:\program files\Lavasoft
2009-12-31 16:34 . 2009-12-31 16:35 ——– d—–w- c:\program files\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 21:40 . 2009-12-18 13:10 1655378 —-a-w- c:\windows\cscmondump.bin
2010-01-25 10:46 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2010-01-21 18:42 . 2007-05-26 21:49 ——– d—–w- c:\program files\Browzar
2010-01-18 11:40 . 2010-01-18 11:40 ——– d—–w- c:\program files\Common Files\Java
2010-01-18 11:40 . 2010-01-18 11:40 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-sse.dll
2010-01-18 11:40 . 2010-01-18 11:40 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcp71.dll
2010-01-18 11:40 . 2010-01-18 11:40 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\jmc.dll
2010-01-18 11:40 . 2010-01-18 11:40 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcr71.dll
2010-01-18 11:40 . 2010-01-18 11:40 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-d3d.dll
2010-01-18 11:40 . 2010-01-18 11:40 315392 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_awt.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-5d8d696e-n\gluegen-rt.dll
2010-01-18 11:40 . 2010-01-18 11:40 114688 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_cg.dll
2010-01-18 11:39 . 2010-01-18 11:40 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-18 11:39 . 2007-06-11 18:55 ——– d—–w- c:\program files\Java
2010-01-04 14:37 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-04 12:59 . 2009-12-18 12:59 134173 —-a-w- c:\windows\cscmon.bin
2010-01-03 19:19 . 2007-05-26 00:08 77312 —-a-w- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 . 2010-01-03 19:18 77312 —-a-w- c:\windows\system32\drivers\viasraid.tsk
2009-12-31 17:05 . 2007-09-16 17:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-28 13:40 . 2009-12-27 11:06 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\program files\Avira
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\program files\Agnitum
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Agnitum
2009-12-24 15:32 . 2009-06-22 20:54 ——– d—–w- c:\program files\COMODO
2009-12-24 13:53 . 2009-06-22 20:56 1474832 —-a-w- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 . 2009-05-23 12:35 1984 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\program files\eMusic Download Manager
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\documents and settings\Jamey\Application Data\eMusic
2009-12-12 19:43 . 2009-12-12 19:43 ——– d—–w- c:\program files\Synchronization Technologies Inc
2009-12-09 23:05 . 2009-12-09 22:52 ——– d—–w- c:\program files\Google
2009-12-08 23:20 . 2009-12-08 23:16 ——– d—–w- c:\documents and settings\Jamey\Application Data\SyncMyCal
2009-12-03 19:10 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\Jamey\Application Data\Tyre
2009-12-02 13:19 . 2010-01-01 02:25 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-30 18:49 . 2009-11-30 18:49 ——– d—–w- c:\program files\AGEIA Technologies
2009-11-30 18:47 . 2007-05-26 00:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Userinit"="c:\windows\system32\userinit.exe" [2004-08-03 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
2009-04-28 10:04 428032 —-a-w- c:\program files\Agnitum\Outpost Firewall\feedback.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostMonitor]
2009-04-28 11:33 2374464 —-a-w- c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 15:21 246504 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Game.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Launcher.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [18/12/2009 12:58 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [27/12/2009 10:58 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [27/12/2009 10:56 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [27/12/2009 11:06 108289]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [27/12/2009 10:56 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [27/12/2009 10:58 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S1 kbd;kbd;\??\c:\windows\system32\drivers\kbd.sys –> c:\windows\system32\drivers\kbd.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
Contents of the 'Scheduled Tasks' folder

2010-01-25 c:\windows\Tasks\COMODO System Cleaner Update.job
- c:\program files\COMODO\COMODO System-Cleaner\UpdateApplications.exe [2009-10-27 18:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 23:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1092)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-01-26 23:27:42
ComboFix-quarantined-files.txt 2010-01-26 23:27
ComboFix2.txt 2010-01-03 14:01

Pre-Run: 49,342,853,120 bytes free
Post-Run: 49,307,807,744 bytes free

- - End Of File - - 3B5E4CBE92F1ACAB7135C8DFA7A30A61
Post #8
fingerz,

First, move CombFix to your desktop then:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above KillAll::

KillAll::

Driver::
kbd

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Userinit"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,"

File::
c:\windows\system32\drivers\kbd.sys 
c:\windows\system32\msqjgu32.exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Download Rooter.exe to your desktop
  • Then doubleclick it to start the tool
  • A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here
Please include the following in your next post:
  • ComboFix log
  • Rooter log
  • Let me know how your computer is running
Post #9
Hi,

Computer is still running the same I'm afraid, still got the high CPU uasage although I did notice something… If I kill the Firewall (Like before I ran ComboFix) then obviously the CPU usage drops back down to zero, as we'd expect. But when I re-enable the firewall again it still stays at zero, it doesn't go back up to 100%. I don't know if this is because the malware made it's connection and doesn't need to keep trying or what but worth mentioning maybe.

Here are the logs:

ComboFix Log:

ComboFix 10-01-27.03 - Jamey 27/01/2010 22:04:53.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2551 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\Forums - Whatthetech\02\ComboFix.exe
Command switches used :: c:\documents and settings\Jamey\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

FILE ::
"c:\windows\system32\drivers\kbd.sys"
"c:\windows\system32\msqjgu32.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_kbd


((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.

2010-01-26 21:28 . 2010-01-26 21:28 ——– d—–w- C:\_OTM
2010-01-21 18:27 . 2010-01-21 18:27 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Temp
2010-01-18 11:40 . 2010-01-18 11:40 ——– d—–w- c:\program files\Common Files\Java
2010-01-18 11:40 . 2010-01-18 11:39 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-03 19:18 . 2010-01-03 19:18 16904 —-a-w- c:\windows\system32\drivers\KLMD.sys
2010-01-02 19:43 . 2010-01-02 19:43 ——– d—–w- C:\spoolerlogs
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 . 2010-01-13 22:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:15 . 2010-01-02 19:16 ——– d—–w- c:\program files\ERUNT
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:49 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 . 2010-01-01 02:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-01 02:24 . 2010-01-01 02:24 ——– d—–w- c:\program files\Lavasoft
2009-12-31 16:34 . 2009-12-31 16:35 ——– d—–w- c:\program files\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-27 22:13 . 2009-12-18 13:10 1733534 —-a-w- c:\windows\cscmondump.bin
2010-01-25 10:46 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2010-01-24 00:24 . 2010-01-24 00:24 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-sse.dll
2010-01-24 00:24 . 2010-01-24 00:24 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcp71.dll
2010-01-24 00:24 . 2010-01-24 00:24 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\jmc.dll
2010-01-24 00:24 . 2010-01-24 00:24 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcr71.dll
2010-01-24 00:24 . 2010-01-24 00:24 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-d3d.dll
2010-01-21 18:42 . 2007-05-26 21:49 ——– d—–w- c:\program files\Browzar
2010-01-18 11:40 . 2010-01-18 11:40 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-sse.dll
2010-01-18 11:40 . 2010-01-18 11:40 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcp71.dll
2010-01-18 11:40 . 2010-01-18 11:40 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\jmc.dll
2010-01-18 11:40 . 2010-01-18 11:40 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcr71.dll
2010-01-18 11:40 . 2010-01-18 11:40 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-d3d.dll
2010-01-18 11:40 . 2010-01-18 11:40 315392 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_awt.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-5d8d696e-n\gluegen-rt.dll
2010-01-18 11:40 . 2010-01-18 11:40 114688 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_cg.dll
2010-01-18 11:39 . 2007-06-11 18:55 ——– d—–w- c:\program files\Java
2010-01-13 22:04 . 2010-01-13 22:04 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-04 14:37 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-04 12:59 . 2009-12-18 12:59 134173 —-a-w- c:\windows\cscmon.bin
2010-01-03 19:19 . 2007-05-26 00:08 77312 —-a-w- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 . 2010-01-03 19:18 77312 —-a-w- c:\windows\system32\drivers\viasraid.tsk
2009-12-31 17:05 . 2007-09-16 17:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-28 13:40 . 2009-12-27 11:06 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\program files\Avira
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\program files\Agnitum
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Agnitum
2009-12-24 15:32 . 2009-06-22 20:54 ——– d—–w- c:\program files\COMODO
2009-12-24 13:53 . 2009-06-22 20:56 1474832 —-a-w- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 . 2009-05-23 12:35 1984 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\program files\eMusic Download Manager
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\documents and settings\Jamey\Application Data\eMusic
2009-12-12 19:43 . 2009-12-12 19:43 ——– d—–w- c:\program files\Synchronization Technologies Inc
2009-12-09 23:05 . 2009-12-09 22:52 ——– d—–w- c:\program files\Google
2009-12-08 23:20 . 2009-12-08 23:16 ——– d—–w- c:\documents and settings\Jamey\Application Data\SyncMyCal
2009-12-07 14:10 . 2010-01-01 02:24 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2009-12-03 19:10 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\Jamey\Application Data\Tyre
2009-11-30 18:49 . 2009-11-30 18:49 ——– d—–w- c:\program files\AGEIA Technologies
2009-11-30 18:47 . 2007-05-26 00:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-01-26_23.25.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-27 22:14 . 2010-01-27 22:14 16384 c:\windows\temp\Perflib_Perfdata_1b4.dat
- 2010-01-26 21:29 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-01-26 21:29 . 2010-01-27 22:14 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-27 22:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-27 22:14 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2002-08-29 03:40 . 2004-08-03 23:56 638464 c:\windows\system32\msqjgu32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
2009-04-28 10:04 428032 —-a-w- c:\program files\Agnitum\Outpost Firewall\feedback.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostMonitor]
2009-04-28 11:33 2374464 —-a-w- c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 15:21 246504 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Game.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Launcher.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [18/12/2009 12:58 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [27/12/2009 10:58 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [27/12/2009 10:56 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [27/12/2009 11:06 108289]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [27/12/2009 10:56 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [27/12/2009 10:58 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
Contents of the 'Scheduled Tasks' folder

2010-01-25 c:\windows\Tasks\COMODO System Cleaner Update.job
- c:\program files\COMODO\COMODO System-Cleaner\UpdateApplications.exe [2009-10-27 18:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-27 22:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1040)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2260)
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
c:\program files\ATI Technologies\ATI.ACE\Core-Static\atiamenu.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\wdfmgr.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-27 22:19:47 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-27 22:19
ComboFix2.txt 2010-01-26 23:27
ComboFix3.txt 2010-01-03 14:01

Pre-Run: 49,287,606,272 bytes free
Post-Run: 49,209,110,528 bytes free

- - End Of File - - E95E54A796825886F084C5732965853E


Rooter Log:

Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully …
.
Windows XP . (5.1.2600) Service Pack 2
[32_bits] - x86 Family 15 Model 15 Stepping 0, AuthenticAMD
.
[wscsvc] (Security Center) RUNNING (state:4)
[SharedAccess] RUNNING (state:4)
Windows Firewall -> Disabled !
.
Internet Explorer 7.0.5730.13
Mozilla Firefox 3.6 (en-US)
.
A:\ [Removable]
C:\ [Fixed-NTFS] .. ( Total:298 Go - Free:45 Go )
D:\ [Fixed-NTFS] .. ( Total:76 Go - Free:20 Go )
I:\ [CD_Rom]
.
Scan : 22:22.43
Path : C:\Documents and Settings\Jamey\Desktop\Rooter.exe
User : Jamey ( Administrator -> YES )
.
———————-\\ Processes
.
Locked [System Process] (0)
______ System (4)
______ \??\C:\WINDOWS\system32\csrss.exe (988)
______ \??\C:\WINDOWS\system32\winlogon.exe (1040)
______ C:\WINDOWS\system32\services.exe (1084)
______ C:\WINDOWS\system32\lsass.exe (1096)
______ C:\WINDOWS\system32\svchost.exe (1356)
______ C:\WINDOWS\system32\svchost.exe (1456)
______ C:\WINDOWS\System32\svchost.exe (1592)
______ C:\WINDOWS\System32\svchost.exe (1652)
______ C:\WINDOWS\system32\svchost.exe (1752)
______ C:\WINDOWS\system32\spoolsv.exe (216)
______ C:\Program Files\Avira\AntiVir Desktop\sched.exe (264)
______ C:\Program Files\Avira\AntiVir Desktop\avguard.exe (260)
______ C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe (1844)
______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (1952)
______ C:\Program Files\Bonjour\mDNSResponder.exe (252)
______ C:\Program Files\Java\jre6\bin\jqs.exe (436)
______ C:\WINDOWS\System32\svchost.exe (764)
______ C:\WINDOWS\System32\wdfmgr.exe (1520)
______ C:\WINDOWS\System32\alg.exe (2080)
______ C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe (2916)
______ C:\Program Files\iTunes\iTunesHelper.exe (2936)
______ C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (2948)
______ C:\Program Files\Microsoft ActiveSync\wcescomm.exe (2960)
______ C:\PROGRA~1\MICROS~3\rapimgr.exe (3352)
______ C:\WINDOWS\System32\svchost.exe (3460)
______ C:\Program Files\iPod\bin\iPodService.exe (3868)
______ C:\WINDOWS\explorer.exe (2260)
______ C:\Documents and Settings\Jamey\Desktop\Rooter.exe (1140)
.
———————-\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:32256 | Length:81956657664)
.
———————-\\ Scheduled Tasks
.
C:\WINDOWS\Tasks\COMODO System Cleaner Update.job
C:\WINDOWS\Tasks\desktop.ini
C:\WINDOWS\Tasks\SA.DAT
.
———————-\\ Registry
.
.
———————-\\ Files & Folders
.
C:\DOCUME~1\Jamey\My Documents\install files\http_tunnel_cracked.zip
C:\DOCUME~1\Jamey\My Documents\install files\netlimiter[1].1.30.crack-rev.zip
C:\DOCUME~1\Jamey\My Documents\install files\Ableton Live keygen.exe
C:\DOCUME~1\Jamey\My Documents\install files\capture One Pro 3.7.3\keygen for capture one pro 3.7.3.exe
C:\DOCUME~1\Jamey\My Documents\install files\WebPictures_Downloader_v1.32keygenePSiLON.zip
==> Cracks & Keygens <==
.
———————-\\ Scan completed at 22:23.00
.
C:\Rooter$\Rooter_1.txt - (27/01/2010 | 22:23.00).c
Post #10
fingerz,

🖼Click to load external image (Posted Image)Your logs indicate that you are using cracks and/or keygens. We don't support software piracy on this forum so, while I’ll deal with your current problem, any further help will be based on you not being seen to involve yourself with such practices in the future. You should also be aware that the issues you have may very well have come from the various files you are handling, which are seen as an effective infection vector by the malware writers of this world.

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (uTorrent, GreedyTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.
If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

🖼Click to load external image (Posted Image) Open OTM
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\\windows\\system32\\userinit.exe,"

:Files
c:\windows\system32\msqjgu32.exe
C:\DOCUME~1\Jamey\My Documents\install files\http_tunnel_cracked.zip
C:\DOCUME~1\Jamey\My Documents\install files\netlimiter[1].1.30.crack-rev.zip
C:\DOCUME~1\Jamey\My Documents\install files\Ableton Live keygen.exe
C:\DOCUME~1\Jamey\My Documents\install files\capture One Pro 3.7.3\keygen for capture one pro 3.7.3.exe
C:\DOCUME~1\Jamey\My Documents\install files\WebPictures_Downloader_v1.32keygenePSiLON.zip

:Commands
[emptytemp]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


Please include the following in your next post:
  • OTM log
  • New DDS log
  • Let me know how your computer is running
Post #11
Hi there,

Machine still running the same I'm afraid. Here are the logs:

OTM Log:

All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\\"Userinit"|"c:\\windows\\system32\\userinit.exe," /E : value set successfully!
========== FILES ==========
File/Folder c:\windows\system32\msqjgu32.exe not found.
C:\DOCUME~1\Jamey\My Documents\install files\http_tunnel_cracked.zip moved successfully.
C:\DOCUME~1\Jamey\My Documents\install files\netlimiter[1].1.30.crack-rev.zip moved successfully.
C:\DOCUME~1\Jamey\My Documents\install files\Ableton Live keygen.exe moved successfully.
C:\DOCUME~1\Jamey\My Documents\install files\capture One Pro 3.7.3\keygen for capture one pro 3.7.3.exe moved successfully.
C:\DOCUME~1\Jamey\My Documents\install files\WebPictures_Downloader_v1.32keygenePSiLON.zip moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: Administrator.JAMEYS-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jamey
->Temp folder emptied: 313763 bytes
->Temporary Internet Files folder emptied: 883178 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 18455213 bytes
->Google Chrome cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 19.00 mb


OTM by OldTimer - Version 3.1.6.0 log created on 01282010_220634

Files moved on Reboot…
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_348.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot…


DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 22:10:53.09 on 28/01/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2586 [GMT 0:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Outpost Firewall *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\01\dds.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [OutpostMonitor] c:\progra~1\agnitum\outpos~1\op_mon.exe /tray /noservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-27 11608]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [2009-12-27 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\agnitum\outpos~1\acs.exe [2009-12-27 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-27 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-27 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2009-12-27 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2009-12-27 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-27 22:22 –d—– C:\Rooter$
2010-01-26 23:16 261,632 a——- c:\windows\PEV.exe
2010-01-26 23:16 161,792 a——- c:\windows\SWREG.exe
2010-01-26 23:16 98,816 a——- c:\windows\sed.exe
2010-01-26 23:16 77,312 a——- c:\windows\MBR.exe
2010-01-26 21:28 –d—– C:\_OTM
2010-01-18 11:40 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-18 11:40 73,728 a——- c:\windows\system32\javacpl.cpl
2010-01-03 19:18 77,312 a——- c:\windows\system32\drivers\viasraid.tsk
2010-01-03 19:18 16,904 a——- c:\windows\system32\drivers\KLMD.sys
2010-01-02 22:53 a-dshr– C:\cmdcons
2010-01-02 19:43 –d—– C:\spoolerlogs
2010-01-02 19:18 –d—– c:\docume~1\jamey\applic~1\Malwarebytes
2010-01-02 19:18 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-01 03:24 –d—– c:\program files\Trend Micro
2010-01-01 03:22 8 a——- c:\windows\crpf.bin
2010-01-01 03:22 4 a——- c:\windows\crpf_sdum.bin
2010-01-01 02:49 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 –d—– c:\program files\Lavasoft
2009-12-31 16:34 –d—– c:\program files\Spybot - Search & Destroy

==================== Find3M ====================

2010-01-28 22:06 1,725,354 a——- c:\windows\cscmondump.bin
2010-01-04 12:59 134,173 a——- c:\windows\cscmon.bin
2010-01-03 19:19 77,312 a——- c:\windows\system32\drivers\viasraid.sys
2009-12-28 13:40 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe

============= FINISH: 22:11:18.81 ===============
Post #12
🖼Click to load external image (Posted Image) Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :regfind
userinit.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #13
Hey, here is the SystemLook Log file: SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 22:58 on 29/01/2010 by Jamey (Administrator - Elevation successful) ========== regfind ========== Searching for "userinit.exe" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\MUILanguages\RCV2\userinit.exe] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Userinit] "EventMessageFile"="%SystemRoot%\System32\userinit.exe" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\userinit.exe] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Userinit] "EventMessageFile"="%SystemRoot%\System32\userinit.exe" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Userinit] "EventMessageFile"="%SystemRoot%\System32\userinit.exe" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Nls\MUILanguages\RCV2\userinit.exe] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Userinit] "EventMessageFile"="%SystemRoot%\System32\userinit.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\userinit.exe] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Userinit] "EventMessageFile"="%SystemRoot%\System32\userinit.exe" -=End Of File=-
Post #14
fingerz,

🖼Click to load external image (Posted Image) Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :reg
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon] /s
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #15
SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 01:50 on 30/01/2010 by Jamey (Administrator - Elevation successful) ========== reg ========== [HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon] "BuildNumber"= 0x0000000a28 (2600) "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;History;Temp;Local Settings\Application Data\Microsoft\Outlook" "ParseAutoexec"="1" -=End Of File=-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI