What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] BDS/Poison.auwd / CPU usage constantly at 100%

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
fingerz,

🖼Click to load external image (Posted Image) Download TDSSKiller and save it to your Desktop.
  • Extract the file and run it.
  • Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
  • Please post the content of that log TDSSKiller
🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • TDSSKiller log
  • Kaspersky log
  • Fresh DDS log
  • Let me know how your computer is running
Post #17
Hi,

The Kaspersky website ( http://www.kaspersky.co.uk/virusscanner ) says this:

The current Kaspersky Online Scanner is unavailable - we apologize for the inconvenience. While you are waiting for the improved Online Scanner, why not try a free trial of Kaspersky Internet Security 2010, which has everything you need to keep your computer safe.


So I couldn't do the online scan but if you want I could do a scan with Avira and post a log from that (does Avira do logging? I might need to change the settings perhaps).

The TDSSKiller log and fresh DDS log are below:

TDSSKiller Log:

12:10:16:625 3600 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25
12:10:16:625 3600 ================================================================================
12:10:16:625 3600 SystemInfo:

12:10:16:625 3600 OS Version: 5.1.2600 ServicePack: 2.0
12:10:16:625 3600 Product type: Workstation
12:10:16:625 3600 ComputerName: JAMEYS-PC
12:10:16:625 3600 UserName: Jamey
12:10:16:625 3600 Windows directory: C:\WINDOWS
12:10:16:625 3600 Processor architecture: Intel x86
12:10:16:625 3600 Number of processors: 1
12:10:16:625 3600 Page size: 0x1000
12:10:16:625 3600 Boot type: Normal boot
12:10:16:625 3600 ================================================================================
12:10:16:656 3600 UnloadDriverW: NtUnloadDriver error 2
12:10:16:656 3600 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
12:10:16:703 3600 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
12:10:16:734 3600 UtilityInit: KLMD drop and load success
12:10:16:734 3600 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)
12:10:16:734 3600 UtilityInit: KLMD open success
12:10:16:734 3600 UtilityInit: Initialize success
12:10:16:734 3600
12:10:16:734 3600 Scanning Services …
12:10:16:734 3600 CreateRegParser: Registry parser init started
12:10:16:734 3600 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127
12:10:16:734 3600 CreateRegParser: DisableWow64Redirection error
12:10:16:734 3600 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
12:10:16:734 3600 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043
12:10:16:734 3600 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
12:10:16:734 3600 wfopen_ex: Trying to KLMD file open
12:10:16:734 3600 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system
12:10:16:734 3600 wfopen_ex: File opened ok (Flags 2)
12:10:16:734 3600 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 3E4A10
12:10:16:734 3600 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
12:10:16:734 3600 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043
12:10:16:734 3600 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
12:10:16:734 3600 wfopen_ex: Trying to KLMD file open
12:10:16:734 3600 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software
12:10:16:734 3600 wfopen_ex: File opened ok (Flags 2)
12:10:16:734 3600 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 3E4AB8
12:10:16:734 3600 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127
12:10:16:734 3600 CreateRegParser: EnableWow64Redirection error
12:10:16:734 3600 CreateRegParser: RegParser init completed
12:10:16:859 3600 GetAdvancedServicesInfo: Raw services enum returned 366 services
12:10:16:859 3600 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
12:10:16:859 3600 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
12:10:16:859 3600
12:10:16:859 3600 Scanning Kernel memory …
12:10:16:859 3600 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
12:10:16:859 3600 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 8B004940
12:10:16:859 3600 DetectCureTDL3: KLMD_GetDeviceObjectList returned 4 DevObjects
12:10:16:859 3600
12:10:16:859 3600 DetectCureTDL3: DEVICE_OBJECT: 8B00EC68
12:10:16:859 3600 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B00EC68
12:10:16:859 3600 KLMD_ReadMem: Trying to ReadMemory 0x8B00EC68[0x38]
12:10:16:859 3600 DetectCureTDL3: DRIVER_OBJECT: 8B004940
12:10:16:859 3600 KLMD_ReadMem: Trying to ReadMemory 0x8B004940[0xA8]
12:10:16:859 3600 KLMD_ReadMem: Trying to ReadMemory 0xE10141B8[0x18]
12:10:16:859 3600 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
12:10:16:859 3600 DetectCureTDL3: IrpHandler (0) addr: BA10EC30
12:10:16:859 3600 DetectCureTDL3: IrpHandler (1) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (2) addr: BA10EC30
12:10:16:859 3600 DetectCureTDL3: IrpHandler (3) addr: BA108D9B
12:10:16:859 3600 DetectCureTDL3: IrpHandler (4) addr: BA108D9B
12:10:16:859 3600 DetectCureTDL3: IrpHandler (5) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (6) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (7) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (8) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (9) addr: BA109366
12:10:16:859 3600 DetectCureTDL3: IrpHandler (10) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (11) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (12) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (13) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (14) addr: BA10944D
12:10:16:859 3600 DetectCureTDL3: IrpHandler (15) addr: BA10CFC3
12:10:16:859 3600 DetectCureTDL3: IrpHandler (16) addr: BA109366
12:10:16:859 3600 DetectCureTDL3: IrpHandler (17) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (18) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (19) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (20) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (21) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (22) addr: BA10AEF3
12:10:16:859 3600 DetectCureTDL3: IrpHandler (23) addr: BA10FA24
12:10:16:859 3600 DetectCureTDL3: IrpHandler (24) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (25) addr: 804F320E
12:10:16:859 3600 DetectCureTDL3: IrpHandler (26) addr: 804F320E
12:10:16:859 3600 TDL3_FileDetect: Processing driver: Disk
12:10:16:859 3600 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
12:10:16:859 3600 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
12:10:16:859 3600 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
12:10:16:859 3600
12:10:16:859 3600 DetectCureTDL3: DEVICE_OBJECT: 8B02F9F0
12:10:16:859 3600 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B02F9F0
12:10:16:859 3600 KLMD_ReadMem: Trying to ReadMemory 0x8B02F9F0[0x38]
12:10:16:875 3600 DetectCureTDL3: DRIVER_OBJECT: 8B004940
12:10:16:875 3600 KLMD_ReadMem: Trying to ReadMemory 0x8B004940[0xA8]
12:10:16:875 3600 KLMD_ReadMem: Trying to ReadMemory 0xE10141B8[0x18]
12:10:16:875 3600 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
12:10:16:875 3600 DetectCureTDL3: IrpHandler (0) addr: BA10EC30
12:10:16:875 3600 DetectCureTDL3: IrpHandler (1) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (2) addr: BA10EC30
12:10:16:875 3600 DetectCureTDL3: IrpHandler (3) addr: BA108D9B
12:10:16:875 3600 DetectCureTDL3: IrpHandler (4) addr: BA108D9B
12:10:16:875 3600 DetectCureTDL3: IrpHandler (5) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (6) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (7) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (8) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (9) addr: BA109366
12:10:16:875 3600 DetectCureTDL3: IrpHandler (10) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (11) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (12) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (13) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (14) addr: BA10944D
12:10:16:875 3600 DetectCureTDL3: IrpHandler (15) addr: BA10CFC3
12:10:16:875 3600 DetectCureTDL3: IrpHandler (16) addr: BA109366
12:10:16:875 3600 DetectCureTDL3: IrpHandler (17) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (18) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (19) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (20) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (21) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (22) addr: BA10AEF3
12:10:16:875 3600 DetectCureTDL3: IrpHandler (23) addr: BA10FA24
12:10:16:875 3600 DetectCureTDL3: IrpHandler (24) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (25) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (26) addr: 804F320E
12:10:16:875 3600 TDL3_FileDetect: Processing driver: Disk
12:10:16:875 3600 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
12:10:16:875 3600 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
12:10:16:875 3600 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
12:10:16:875 3600
12:10:16:875 3600 DetectCureTDL3: DEVICE_OBJECT: 8B031AB8
12:10:16:875 3600 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B031AB8
12:10:16:875 3600 DetectCureTDL3: DEVICE_OBJECT: 8B004A38
12:10:16:875 3600 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B004A38
12:10:16:875 3600 KLMD_ReadMem: Trying to ReadMemory 0x8B004A38[0x38]
12:10:16:875 3600 DetectCureTDL3: DRIVER_OBJECT: 8B032A08
12:10:16:875 3600 KLMD_ReadMem: Trying to ReadMemory 0x8B032A08[0xA8]
12:10:16:875 3600 KLMD_ReadMem: Trying to ReadMemory 0xE197C4B0[0x20]
12:10:16:875 3600 DetectCureTDL3: DRIVER_OBJECT name: \Driver\viasraid, Driver Name: viasraid
12:10:16:875 3600 DetectCureTDL3: IrpHandler (0) addr: B9EE044C
12:10:16:875 3600 DetectCureTDL3: IrpHandler (1) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (2) addr: B9EE044C
12:10:16:875 3600 DetectCureTDL3: IrpHandler (3) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (4) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (5) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (6) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (7) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (8) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (9) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (10) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (11) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (12) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (13) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (14) addr: B9EE044C
12:10:16:875 3600 DetectCureTDL3: IrpHandler (15) addr: B9EE044C
12:10:16:875 3600 DetectCureTDL3: IrpHandler (16) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (17) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (18) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (19) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (20) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (21) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (22) addr: B9EE044C
12:10:16:875 3600 DetectCureTDL3: IrpHandler (23) addr: B9EE044C
12:10:16:875 3600 DetectCureTDL3: IrpHandler (24) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (25) addr: 804F320E
12:10:16:875 3600 DetectCureTDL3: IrpHandler (26) addr: 804F320E
12:10:16:875 3600 KLMD_ReadMem: Trying to ReadMemory 0xB9EE340E[0x400]
12:10:16:875 3600 TDL3_StartIoHookDetect: CheckParameters: 1, B9EE717C, 0
12:10:16:875 3600 TDL3_FileDetect: Processing driver: viasraid
12:10:16:875 3600 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\viasraid.sys
12:10:16:875 3600 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\viasraid.sys
12:10:16:890 3600 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\viasraid.sys - Verdict: Clean
12:10:16:890 3600
12:10:16:890 3600 DetectCureTDL3: DEVICE_OBJECT: 8B010AB8
12:10:16:890 3600 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B010AB8
12:10:16:890 3600 DetectCureTDL3: DEVICE_OBJECT: 8AFD19E8
12:10:16:890 3600 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8AFD19E8
12:10:16:890 3600 DetectCureTDL3: DEVICE_OBJECT: 8B041940
12:10:16:890 3600 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B041940
12:10:16:890 3600 KLMD_ReadMem: Trying to ReadMemory 0x8B041940[0x38]
12:10:16:890 3600 DetectCureTDL3: DRIVER_OBJECT: 8AFF5030
12:10:16:890 3600 KLMD_ReadMem: Trying to ReadMemory 0x8AFF5030[0xA8]
12:10:16:890 3600 KLMD_ReadMem: Trying to ReadMemory 0xE1016FE0[0x1A]
12:10:16:890 3600 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
12:10:16:890 3600 DetectCureTDL3: IrpHandler (0) addr: B9F15572
12:10:16:890 3600 DetectCureTDL3: IrpHandler (1) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (2) addr: B9F15572
12:10:16:890 3600 DetectCureTDL3: IrpHandler (3) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (4) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (5) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (6) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (7) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (8) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (9) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (10) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (11) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (12) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (13) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (14) addr: B9F15592
12:10:16:890 3600 DetectCureTDL3: IrpHandler (15) addr: B9F117B4
12:10:16:890 3600 DetectCureTDL3: IrpHandler (16) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (17) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (18) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (19) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (20) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (21) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (22) addr: B9F155BC
12:10:16:890 3600 DetectCureTDL3: IrpHandler (23) addr: B9F1C164
12:10:16:890 3600 DetectCureTDL3: IrpHandler (24) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (25) addr: 804F320E
12:10:16:890 3600 DetectCureTDL3: IrpHandler (26) addr: 804F320E
12:10:16:890 3600 KLMD_ReadMem: Trying to ReadMemory 0xB9F127C6[0x400]
12:10:16:890 3600 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
12:10:16:890 3600 TDL3_FileDetect: Processing driver: atapi
12:10:16:890 3600 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
12:10:16:890 3600 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys
12:10:16:906 3600 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean
12:10:16:906 3600
12:10:16:906 3600 Completed
12:10:16:906 3600
12:10:16:906 3600 Results:
12:10:16:906 3600 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
12:10:16:906 3600 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
12:10:16:906 3600 File objects infected / cured / cured on reboot: 0 / 0 / 0
12:10:16:906 3600
12:10:16:906 3600 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
12:10:16:906 3600 UtilityDeinit: KLMD(ARK) unloaded successfully


DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 12:29:20.10 on 30/01/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2562 [GMT 0:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Outpost Firewall *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\02\dds.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [OutpostMonitor] c:\progra~1\agnitum\outpos~1\op_mon.exe /tray /noservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-27 11608]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [2009-12-27 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\agnitum\outpos~1\acs.exe [2009-12-27 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-27 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-27 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2009-12-27 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2009-12-27 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-27 22:22 –d—– C:\Rooter$
2010-01-26 23:16 261,632 a——- c:\windows\PEV.exe
2010-01-26 23:16 161,792 a——- c:\windows\SWREG.exe
2010-01-26 23:16 98,816 a——- c:\windows\sed.exe
2010-01-26 23:16 77,312 a——- c:\windows\MBR.exe
2010-01-26 21:28 –d—– C:\_OTM
2010-01-18 11:40 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-18 11:40 73,728 a——- c:\windows\system32\javacpl.cpl
2010-01-03 19:18 77,312 a——- c:\windows\system32\drivers\viasraid.tsk
2010-01-02 22:53 a-dshr– C:\cmdcons
2010-01-02 19:43 –d—– C:\spoolerlogs
2010-01-02 19:18 –d—– c:\docume~1\jamey\applic~1\Malwarebytes
2010-01-02 19:18 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-01 03:24 –d—– c:\program files\Trend Micro
2010-01-01 03:22 8 a——- c:\windows\crpf.bin
2010-01-01 03:22 4 a——- c:\windows\crpf_sdum.bin
2010-01-01 02:49 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 –d—– c:\program files\Lavasoft
2009-12-31 16:34 –d—– c:\program files\Spybot - Search & Destroy

==================== Find3M ====================

2010-01-30 12:21 1,817,920 a——- c:\windows\cscmondump.bin
2010-01-04 12:59 134,173 a——- c:\windows\cscmon.bin
2010-01-03 19:19 77,312 a——- c:\windows\system32\drivers\viasraid.sys
2009-12-28 13:40 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe

============= FINISH: 12:30:30.96 ===============
Post #18
fingerz,

Your logs are giving us some very unusual results. I'd like you to uninstall any Comodo programs you have running as well as any resident AV or Firewall (Avira and Outpost) via add/remove programs. I strongly recommend that you limit your online activity with this machine until we have your security programs reinstalled.

Next, delete your current copy of CombFix and reinstall it using these instructions:

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
  • How is your computer running?
Post #19
Hello,

I removed Avira, Outpost and Comodo System Cleaner from the Add/Remove programs window.

When I ran ComboFix it still told me that it thought Comodo realtime AV was running though. As I've said before there must be some remnant of it in the system but if it's not a running process then I have no idea why ComboFix is picking it up.

Anyway here is the log:

ComboFix 10-01-29.09 - Jamey 30/01/2010 19:18:31.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2590 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-30 )))))))))))))))))))))))))))))))
.

2010-01-26 21:28 . 2010-01-26 21:28 ——– d—–w- C:\_OTM
2010-01-24 00:24 . 2010-01-24 00:24 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-sse.dll
2010-01-24 00:24 . 2010-01-24 00:24 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcp71.dll
2010-01-24 00:24 . 2010-01-24 00:24 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\jmc.dll
2010-01-24 00:24 . 2010-01-24 00:24 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcr71.dll
2010-01-24 00:24 . 2010-01-24 00:24 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-d3d.dll
2010-01-21 18:27 . 2010-01-21 18:27 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Temp
2010-01-13 22:04 . 2010-01-13 22:04 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-02 19:43 . 2010-01-02 19:43 ——– d—–w- C:\spoolerlogs
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 . 2010-01-13 22:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:15 . 2010-01-02 19:16 ——– d—–w- c:\program files\ERUNT
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:49 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 . 2009-12-07 14:10 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2010-01-01 02:24 . 2010-01-01 02:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-01 02:24 . 2010-01-01 02:24 ——– d—–w- c:\program files\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-30 19:13 . 2009-12-18 13:10 1885484 —-a-w- c:\windows\cscmondump.bin
2010-01-30 19:10 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2010-01-21 18:42 . 2007-05-26 21:49 ——– d—–w- c:\program files\Browzar
2010-01-18 11:40 . 2010-01-18 11:40 ——– d—–w- c:\program files\Common Files\Java
2010-01-18 11:40 . 2010-01-18 11:40 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-sse.dll
2010-01-18 11:40 . 2010-01-18 11:40 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcp71.dll
2010-01-18 11:40 . 2010-01-18 11:40 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\jmc.dll
2010-01-18 11:40 . 2010-01-18 11:40 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcr71.dll
2010-01-18 11:40 . 2010-01-18 11:40 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-d3d.dll
2010-01-18 11:40 . 2010-01-18 11:40 315392 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_awt.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-5d8d696e-n\gluegen-rt.dll
2010-01-18 11:40 . 2010-01-18 11:40 114688 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_cg.dll
2010-01-18 11:39 . 2010-01-18 11:40 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-18 11:39 . 2007-06-11 18:55 ——– d—–w- c:\program files\Java
2010-01-04 14:37 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-04 12:59 . 2009-12-18 12:59 134173 —-a-w- c:\windows\cscmon.bin
2010-01-03 19:19 . 2007-05-26 00:08 77312 —-a-w- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 . 2010-01-03 19:18 77312 —-a-w- c:\windows\system32\drivers\viasraid.tsk
2009-12-31 17:05 . 2007-09-16 17:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-31 16:35 . 2009-12-31 16:34 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-28 13:40 . 2009-12-27 11:06 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 15:32 . 2009-06-22 20:54 ——– d—–w- c:\program files\COMODO
2009-12-24 13:53 . 2009-06-22 20:56 1474832 —-a-w- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 . 2009-05-23 12:35 1984 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\program files\eMusic Download Manager
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\documents and settings\Jamey\Application Data\eMusic
2009-12-12 19:43 . 2009-12-12 19:43 ——– d—–w- c:\program files\Synchronization Technologies Inc
2009-12-09 23:05 . 2009-12-09 22:52 ——– d—–w- c:\program files\Google
2009-12-08 23:20 . 2009-12-08 23:16 ——– d—–w- c:\documents and settings\Jamey\Application Data\SyncMyCal
2009-12-03 19:10 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\Jamey\Application Data\Tyre
2009-12-02 13:19 . 2010-01-01 02:25 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-01-26_23.25.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-30 19:14 . 2010-01-30 19:14 16384 c:\windows\temp\Perflib_Perfdata_23c.dat
- 2010-01-26 21:29 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-01-28 22:07 . 2010-01-30 19:14 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-30 19:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-30 19:14 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 15:21 246504 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Game.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Launcher.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-OutpostFeedBack - c:\program files\Agnitum\Outpost Firewall\feedback.exe
MSConfigStartUp-OutpostMonitor - c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-30 19:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-01-30 19:29:17
ComboFix-quarantined-files.txt 2010-01-30 19:29
ComboFix2.txt 2010-01-27 22:19
ComboFix3.txt 2010-01-26 23:27
ComboFix4.txt 2010-01-03 14:01

Pre-Run: 45,849,432,064 bytes free
Post-Run: 45,813,006,336 bytes free

- - End Of File - - B4FF4ECD88CC190DDADBF5532D8BED0F
Post #20
fingerz,

Please try using removing Comodo following the instructions found HERE.

Once you finish up with those instructions, please run DDS again and let me have the log.
Post #21
Hi,

I think that removed Comodo successfully… In fact I think it worked a bit too well because I thought the best way to test would be to launch ComboFix and see if it gave me the warning about Comodo but I didn't realise that without the Comodo warning there are no dialogue boxes to click so I had to let ComboFix run all the way through, sorry.

I hope I haven't done anything too bad by allowing that to happen. I'll post both logs (DDS & ComboFix even though I wasn't supposed to run it properly) below:

DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 0:32:50.59 on 31/01/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2589 [GMT 0:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\02\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-31 00:28 –d—– c:\windows\system32\wbem\Repository
2010-01-27 22:22 –d—– C:\Rooter$
2010-01-26 23:16 261,632 a——- c:\windows\PEV.exe
2010-01-26 23:16 161,792 a——- c:\windows\SWREG.exe
2010-01-26 23:16 98,816 a——- c:\windows\sed.exe
2010-01-26 23:16 77,312 a——- c:\windows\MBR.exe
2010-01-26 21:28 –d—– C:\_OTM
2010-01-18 11:40 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-18 11:40 73,728 a——- c:\windows\system32\javacpl.cpl
2010-01-03 19:18 77,312 a——- c:\windows\system32\drivers\viasraid.tsk
2010-01-02 22:53 a-dshr– C:\cmdcons
2010-01-02 19:43 –d—– C:\spoolerlogs
2010-01-02 19:18 –d—– c:\docume~1\jamey\applic~1\Malwarebytes
2010-01-02 19:18 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-01 03:24 –d—– c:\program files\Trend Micro
2010-01-01 03:22 8 a——- c:\windows\crpf.bin
2010-01-01 03:22 4 a——- c:\windows\crpf_sdum.bin
2010-01-01 02:49 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 –d—– c:\program files\Lavasoft

==================== Find3M ====================

2010-01-30 19:13 1,885,484 a——- c:\windows\cscmondump.bin
2010-01-04 12:59 134,173 a——- c:\windows\cscmon.bin
2010-01-03 19:19 77,312 a——- c:\windows\system32\drivers\viasraid.sys
2009-12-28 13:40 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe

============= FINISH: 0:32:56.38 ===============


ComboFix Log:

ComboFix 10-01-29.09 - Jamey 31/01/2010 0:29.6.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2506 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-31 )))))))))))))))))))))))))))))))
.

2010-01-26 21:28 . 2010-01-26 21:28 ——– d—–w- C:\_OTM
2010-01-24 00:24 . 2010-01-24 00:24 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-sse.dll
2010-01-24 00:24 . 2010-01-24 00:24 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcp71.dll
2010-01-24 00:24 . 2010-01-24 00:24 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\jmc.dll
2010-01-24 00:24 . 2010-01-24 00:24 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcr71.dll
2010-01-24 00:24 . 2010-01-24 00:24 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-d3d.dll
2010-01-21 18:27 . 2010-01-21 18:27 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Temp
2010-01-13 22:04 . 2010-01-13 22:04 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-02 19:43 . 2010-01-02 19:43 ——– d—–w- C:\spoolerlogs
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 . 2010-01-13 22:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:15 . 2010-01-02 19:16 ——– d—–w- c:\program files\ERUNT
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:49 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 . 2009-12-07 14:10 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2010-01-01 02:24 . 2010-01-01 02:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-01 02:24 . 2010-01-01 02:24 ——– d—–w- c:\program files\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-30 19:13 . 2009-12-18 13:10 1885484 —-a-w- c:\windows\cscmondump.bin
2010-01-30 19:10 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2010-01-21 18:42 . 2007-05-26 21:49 ——– d—–w- c:\program files\Browzar
2010-01-18 11:40 . 2010-01-18 11:40 ——– d—–w- c:\program files\Common Files\Java
2010-01-18 11:40 . 2010-01-18 11:40 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-sse.dll
2010-01-18 11:40 . 2010-01-18 11:40 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcp71.dll
2010-01-18 11:40 . 2010-01-18 11:40 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\jmc.dll
2010-01-18 11:40 . 2010-01-18 11:40 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcr71.dll
2010-01-18 11:40 . 2010-01-18 11:40 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-d3d.dll
2010-01-18 11:40 . 2010-01-18 11:40 315392 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_awt.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-5d8d696e-n\gluegen-rt.dll
2010-01-18 11:40 . 2010-01-18 11:40 114688 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_cg.dll
2010-01-18 11:39 . 2010-01-18 11:40 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-18 11:39 . 2007-06-11 18:55 ——– d—–w- c:\program files\Java
2010-01-04 14:37 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-04 12:59 . 2009-12-18 12:59 134173 —-a-w- c:\windows\cscmon.bin
2010-01-03 19:19 . 2007-05-26 00:08 77312 —-a-w- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 . 2010-01-03 19:18 77312 —-a-w- c:\windows\system32\drivers\viasraid.tsk
2009-12-31 17:05 . 2007-09-16 17:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-31 16:35 . 2009-12-31 16:34 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-28 13:40 . 2009-12-27 11:06 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 15:32 . 2009-06-22 20:54 ——– d—–w- c:\program files\COMODO
2009-12-24 13:53 . 2009-06-22 20:56 1474832 —-a-w- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 . 2009-05-23 12:35 1984 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\program files\eMusic Download Manager
2009-12-13 00:59 . 2009-12-12 23:47 ——– d—–w- c:\documents and settings\Jamey\Application Data\eMusic
2009-12-12 19:43 . 2009-12-12 19:43 ——– d—–w- c:\program files\Synchronization Technologies Inc
2009-12-09 23:05 . 2009-12-09 22:52 ——– d—–w- c:\program files\Google
2009-12-08 23:20 . 2009-12-08 23:16 ——– d—–w- c:\documents and settings\Jamey\Application Data\SyncMyCal
2009-12-03 19:10 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\Jamey\Application Data\Tyre
2009-12-02 13:19 . 2010-01-01 02:25 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-01-26_23.25.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-30 19:14 . 2010-01-30 19:14 16384 c:\windows\temp\Perflib_Perfdata_23c.dat
- 2010-01-26 21:29 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-01-28 22:07 . 2010-01-30 19:14 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-30 19:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-30 19:14 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2002-08-29 03:40 . 2004-08-03 23:56 638464 c:\windows\system32\msqjgu32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 15:21 246504 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Game.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Launcher.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-31 00:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-01-31 00:32:24
ComboFix-quarantined-files.txt 2010-01-31 00:32
ComboFix2.txt 2010-01-30 19:29
ComboFix3.txt 2010-01-27 22:19
ComboFix4.txt 2010-01-26 23:27
ComboFix5.txt 2010-01-31 00:28

Pre-Run: 45,810,040,832 bytes free
Post-Run: 45,794,988,032 bytes free

- - End Of File - - 7D700A793EDCF37B8CCC3F37CCF929E1
Post #22
fingerz,

Good! Now lets see if we can get rid of the malware:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Registry::

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\\windows\\system32\\userinit.exe,"

File::
c:\windows\system32\msqjgu32.exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:
  • ComboFix log
  • How is your computer running?
Post #23
Hey,

That's all done, log below. Can't really say how the PC is running because the thing using all the CPU was op_mon.exe which was the firewall process and I've uninstalled my firewall.

ComboFix 10-01-29.09 - Jamey 31/01/2010 12:28:27.7.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2690 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jamey\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\msqjgu32.exe"
.

((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-31 )))))))))))))))))))))))))))))))
.

2010-01-31 00:28 . 2010-01-31 00:28 ——– d—–w- c:\windows\system32\wbem\Repository
2010-01-27 22:22 . 2010-01-27 22:23 ——– d—–w- C:\Rooter$
2010-01-26 21:28 . 2010-01-26 21:28 ——– d—–w- C:\_OTM
2010-01-24 00:24 . 2010-01-24 00:24 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-sse.dll
2010-01-24 00:24 . 2010-01-24 00:24 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcp71.dll
2010-01-24 00:24 . 2010-01-24 00:24 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\jmc.dll
2010-01-24 00:24 . 2010-01-24 00:24 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcr71.dll
2010-01-24 00:24 . 2010-01-24 00:24 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-d3d.dll
2010-01-21 18:27 . 2010-01-21 18:27 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Temp
2010-01-13 22:04 . 2010-01-13 22:04 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-02 19:43 . 2010-01-02 19:43 ——– d—–w- C:\spoolerlogs
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 . 2010-01-13 22:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:15 . 2010-01-02 19:16 ——– d—–w- c:\program files\ERUNT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-30 19:13 . 2009-12-18 13:10 1885484 —-a-w- c:\windows\cscmondump.bin
2010-01-30 19:10 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2010-01-21 18:42 . 2007-05-26 21:49 ——– d—–w- c:\program files\Browzar
2010-01-18 11:40 . 2010-01-18 11:40 ——– d—–w- c:\program files\Common Files\Java
2010-01-18 11:40 . 2010-01-18 11:40 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-sse.dll
2010-01-18 11:40 . 2010-01-18 11:40 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcp71.dll
2010-01-18 11:40 . 2010-01-18 11:40 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\jmc.dll
2010-01-18 11:40 . 2010-01-18 11:40 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcr71.dll
2010-01-18 11:40 . 2010-01-18 11:40 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-d3d.dll
2010-01-18 11:40 . 2010-01-18 11:40 315392 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_awt.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-5d8d696e-n\gluegen-rt.dll
2010-01-18 11:40 . 2010-01-18 11:40 114688 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_cg.dll
2010-01-18 11:39 . 2010-01-18 11:40 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-18 11:39 . 2007-06-11 18:55 ——– d—–w- c:\program files\Java
2010-01-04 14:37 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-04 12:59 . 2009-12-18 12:59 134173 —-a-w- c:\windows\cscmon.bin
2010-01-03 19:19 . 2007-05-26 00:08 77312 —-a-w- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 . 2010-01-03 19:18 77312 —-a-w- c:\windows\system32\drivers\viasraid.tsk
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2009-12-03 19:10 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\Jamey\Application Data\Tyre
2009-12-02 13:19 . 2010-01-01 02:25 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-12-02 13:19 . 2010-01-01 02:49 15880 —-a-w- c:\windows\system32\lsdelete.exe
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-01-26_23.25.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-31 12:22 . 2010-01-31 12:22 16384 c:\windows\temp\Perflib_Perfdata_54c.dat
- 2010-01-26 21:29 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-01-28 22:07 . 2010-01-31 12:23 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-31 12:23 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-31 12:23 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 15:21 246504 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Game.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Launcher.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-31 12:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(520)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-01-31 12:38:41
ComboFix-quarantined-files.txt 2010-01-31 12:38
ComboFix2.txt 2010-01-31 00:32
ComboFix3.txt 2010-01-30 19:29
ComboFix4.txt 2010-01-27 22:19
ComboFix5.txt 2010-01-31 12:27

Pre-Run: 45,860,167,680 bytes free
Post-Run: 45,822,537,728 bytes free

- - End Of File - - ACDC2DCE05E2DA3CBB66FEDD6993ACB0
Post #24
fingerz,

🖼Click to load external image (Posted Image) Carefully follow these instructions:

1. Please download The Avenger2 by Swandog46 to your Desktop.
  • Right click on the Avenger.zip folder and select "Extract All…"
  • Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Registry values to replace with dummy:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon | userinit

Files to delete:
c:\windows\system32\msqjgu32.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.

🖼Click to load external image (Posted Image) Registry Fix:
  • Open Notepad.
  • Copy and paste the contents of the below codebox into Notepad.
  • Save the file to your desktop as "fix.reg" (WITH the quotation marks).
    Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\\windows\\system32\\userinit.exe,"
  • Double click the fix.reg file on your desktop and confirm the prompts that you wish to make the changes.
  • Reboot.
Please include the following in your next post:
  • A fresh DDS log
Post #25 last edited
Uh-oh,

I think we might have a problem.

I'm posting this from my girlfriend's laptop because I can't login to my PC anymore, I've even tried booting in safe mode.

I ran TheAvenger as per your instructions and it rebooted my machine straight away, then when I went to login after the reboot it just kicked me straight back to the login screen.. It does this every time. I rebooted again in safe mode and tried to login both as myself and also using the generic administrator account but both of them kick straight back to the login screen after I enter the password and hit return.

Please help. How can I get back into my machine?

Edit: I did a little Googling and it seems that other people have had the same problem when they ran Spybot or Ad-Aware and it's to do with modifying the userinit stuff. There's a solution that seems like it might work on this page, second post down, take a look:
http://www.duxcw.com/yabbse/index.php?boar…d=7407;start=15

Here's a quote of the relevant part:

This is happening because spyware eddited the register of your computer. I had the same problem.

Everytime i logged into windows xp it logged me out right away.

I got rid of the problem by :

Booting the pc with your start disks created with windows xp *1 or Booting the pc using your windows xp cd-rom *2

*1 - at the command prompt goto c:\windows\system32\
copy userinit.exe wsaupdater.exe

now reboot your pc , you should be able to log into windows

goto start , run then type regedit

find the following registerkey :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit string value should be:

C:\WINDOWS\system32\userinit.exe,

On the damaged installations it's one of these:

C:\WINDOWS\system32\wsaupdater.exe,
C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wsaupdater.exe,

In this case edit the string to :

c:\windows\system32\userinit.exe,

Everything should work fine now !
Do install some good anti spyware software and do a virus check as mine was infected with a trojan as well.

*2 Boot the pc from the windows setup disk , at the setup screen press R for recovery

at the recovery console type cd system32
type copy userinit.exe wsaupdater.exe
type exit

then follow the instructions under *1 with the regedit.

Good luck


Do you think I should do that?
Post #26
fingerz,

That is actually more or less what we have been trying to do for a while now. Please try this:

🖼Click to load external image (Posted Image) Follow these instructions to boot into the Last Known Good Configuration mode:
  • Start your computer continuously tapping f8 on your keyboard.
  • This should bring up the "Windows Advanced Options Menu"
  • When the Windows Advanced Options menu appears, use the ARROW keys to select Last Known Good Configuration (your most recent settings that worked), and then press ENTER.

🖼Click to load external image (Posted Image) If you are able to boot into windows that way follow these instructions:
  • Click Start > Run or Press the Windows key + R and copy and paste the following into the run box that opens:
    reg add "HKLM\software\microsoft\windows nt\currentversion\winlogon" /v Userinit /d "c:\windows\system32\userinit.exe,"
  • Reboot

If that goes OK please run DDS again and post the log. If you have trouble, stop and let me know.
Post #27
Hi, Tried that but booting in last known good configuration just behaves the same as the others and it kicks straight back to the login screen again.
Post #28
fingerz,

🖼Click to load external image (Posted Image) Reboot your computer, and select Microsoft Windows Recovery Console when given the option (you've only got a couple of seconds, so stay sharp!)

You will be asked to select a partition, probably 1. C:\WINDOWS. Just type 1 and hit Enter. If prompted, type your Admin password.

Once you are through with all that, you should be presented with a prompt like this:
C:\WINDOWS>

At this prompt, very carefully type the follow command exactly as shown, and press Enter:
reg add "HKLM\software\microsoft\windows nt\currentversion\winlogon" /v Userinit /d "c:\windows\system32\userinit.exe,"

If that goes OK please run DDS again and post the log. If you have trouble, stop and let me know.
Post #29
I got into Recovery Console OK (had to load my RAID driver but after that it was fine) but when I typed out that line it said "The command is not recognized. Type HELP for a list of supported commands."

Here is a screenshot:

[external image: Posted Image]

I typed HELP but I can't see "reg" in the list of commands anywhere. Tried just typing "reg" on its own and got the same message.
Post #30
fingerz,

Did you by any chance try that fix that you posted? If not, lets give it a shot:
  • Boot into the Recovery Console
  • At the command prompt go to c:\windows\system32\
  • Carefully enter the following command and press enter:
    copy userinit.exe wsaupdater.exe
  • Reboot
If that works, stop there and let me know. If it doesn't I have Plan B ready to go.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI