What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HELP! CPU USEAGE 100% ON BOTH MY COMPUTORS

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
ok i got mouse that works on screen key board. here is malware scan log Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.08.01 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Administrator :: SOUTHERN-T3F8GF [administrator] 1/7/2012 9:03:42 PM mbam-log-2012-01-07 (21-03-42).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 353803 Time elapsed: 2 hour(s), 8 minute(s), 4 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 29 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\57\50223bb9-760e955a (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\30\e650de-29efee35 (Trojan.Zbot.CBCGen) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP384\A0091609.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP384\A0091610.dll (Trojan.Wimpixo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP385\A0091618.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP385\A0094510.com (Trojan.Email) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP385\A0094511.com (Trojan.Email) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP385\A0094512.com (Trojan.Email) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP390\A0095890.com (Trojan.Email) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP391\A0100020.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP391\A0100021.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP391\A0100022.com (Trojan.Email) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP391\A0100024.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100029.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100030.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100058.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100059.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100060.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100073.com (Trojan.Email) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101102.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101103.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101104.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101105.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101106.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101107.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101108.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101117.com (Trojan.Email) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101118.dll (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101119.dll (Trojan.Dropper) -> Quarantined and deleted successfully. (end)
Post #17
SystemLook 30.07.11 by jpshortstuff Log created at 17:47 on 10/01/2012 by Administrator Administrator - Elevation successful ========== filefind ========== Searching for " i8042prt.sys" No files found. -= EOF =-
Post #20
Drag Combofix to the trash and download a new copy and run it again and lets see if it finds more bad stuff

NEW COMBO FIX–MY KEY BOARD IS WORKING… YEAYYYY!!


ComboFix 12-01-10.02 - Administrator 01/10/2012 18:09:57.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.673 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-11 to 2012-01-11 )))))))))))))))))))))))))))))))
.
.
2012-01-02 17:50 . 2012-01-02 17:50 ——– d—–w- c:\program files\ESET
2012-01-02 15:14 . 2012-01-02 15:14 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-01-02 15:14 . 2011-12-10 21:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-18 19:27 . 2011-12-18 19:27 ——– d—–w- c:\documents and settings\Guest
2011-12-16 14:35 . 2011-12-16 14:35 ——– d-sh–w- c:\documents and settings\NetworkService\PrivacIE
2011-12-16 14:35 . 2011-12-16 14:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Yahoo
2011-12-16 14:13 . 2011-12-18 14:34 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\AskToolbar
2011-12-16 08:46 . 2011-12-16 08:46 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2011-12-15 09:02 . 2011-04-26 11:07 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-15 09:02 . 2011-12-15 09:02 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-12-14 21:46 . 2011-12-14 21:46 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 15:57 . 2003-07-16 16:35 17920 —ha-w- c:\windows\system32\ping.exe
2011-11-23 13:25 . 2009-03-11 08:01 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2004-08-24 01:32 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2003-07-16 16:26 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2003-07-16 16:24 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2011-10-25 13:33 . 2003-07-16 16:33 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2002-08-29 01:04 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-24 20:29 . 2011-10-24 20:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 20:29 . 2011-10-24 20:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-08-06 00:53 . 2011-08-06 00:53 34779895 —-a-w- c:\program files\Inkscape-0.48.1-2.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-07_17.17.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-11 00:07 . 2012-01-11 00:07 16384 c:\windows\Temp\Perflib_Perfdata_2e0.dat
+ 2012-01-11 00:07 . 2012-01-11 00:07 16384 c:\windows\Temp\Perflib_Perfdata_264.dat
+ 2003-07-16 16:24 . 2008-04-13 20:18 52480 c:\windows\system32\drivers\i8042prt.sys
- 2003-07-16 16:24 . 2008-04-13 19:18 52480 c:\windows\system32\drivers\i8042prt.sys
+ 2003-07-16 16:24 . 2008-04-13 20:18 52480 c:\windows\system32\dllcache\i8042prt.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-07-10 14:23 97064 —-a-w- c:\program files\Nero\Nero8\InCD\NBHShx.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="c:\program files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe" [2004-07-18 368640]
"H/PC Connection Agent"="c:\progra~1\MICROS~2\wcescomm.exe" [2005-11-16 1200128]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-10-05 98304]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"Akamai NetSession Interface"="c:\documents and settings\Administrator\Local Settings\Application Data\Akamai\netsession_win.exe" [2011-12-13 3305760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-10-19 126976]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 851968]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-07-09 570664]
"SecurDisc"="c:\program files\Nero\Nero8\InCD\NBHGui.exe" [2008-07-10 2049320]
"InCD"="c:\program files\Nero\Nero8\InCD\InCD.exe" [2008-07-10 1083176]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"PeachtreePrefetcher.exe"="c:\progra~1\SAGESO~1\PEACHT~1\PeachtreePrefetcher.exe" [2008-10-02 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-10 421736]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-02-28 519584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-14 78848]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Service Manager.lnk - c:\mssql7\Binn\sqlmangr.exe [2004-6-4 110592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Pervasive Software\\PSQL\\bin\\w3dbsmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\a la mode\\Sched\\eSched.exe"=
"c:\\WINDOWS\\system32\\VaultFilesDownloader.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"1583:TCP"= 1583:TCP:Pervasive DBEngine
"3351:TCP"= 3351:TCP:Pervasive DBEngine
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1414:TCP"= 1414:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
.
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [7/16/2003 10:41 AM 14336]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2/28/2010 1:33 AM 821664]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [7/10/2008 8:23 AM 53032]
R2 psqlWGE;Pervasive PSQL Workgroup Engine;c:\program files\Pervasive Software\PSQL\bin\w3dbsmgr.exe [9/5/2007 11:25 AM 455968]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [12/2/2009 9:23 PM 483688]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [12/2/2009 9:23 PM 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [12/2/2009 9:23 PM 211304]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [12/2/2009 9:23 PM 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [12/2/2009 9:23 PM 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [12/2/2009 9:23 PM 209768]
S2 XMLProvS;Network ProService;c:\windows\System32\svchost.exe -k xmlpros [7/16/2003 10:41 AM 14336]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 8:37 PM 4640000]
S3 ssmirrdr;ssmirrdr;c:\windows\system32\drivers\ssmirrdr.sys [9/22/2010 6:52 AM 10112]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
xmlpros REG_MULTI_SZ XMLProvS
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 22:57]
.
2010-10-23 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2010-10-23 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant =
Trusted Zone: apple.com\www
Trusted Zone: bleepingcomputer.com\download
Trusted Zone: k12.la.us\pc.rapides
Trusted Zone: landata.com\www.benton.ar.us
Trusted Zone: whatthetech.com\forums
TCP: DhcpNameServer = 192.168.2.1
DPF: {5E38AFD9-589F-45DF-8EB4-E6948B017C95} - hxxp://vault.alamode.com/cab/vaultinstall.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-10 18:32
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c2,be,85,c2,60,5e,47,9f,f4,87,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c2,be,85,c2,60,5e,47,9f,f4,87,\
.
[HKEY_USERS\S-1-5-21-57989841-1454471165-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a3,b4,bb,bf,ca,ce,11,4e,a3,8b,1a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ff,fe,f3,c0,98,b8,74,42,a4,96,63,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,07,dd,f0,09,cb,ef,a4,43,83,e7,89,\
.
[HKEY_USERS\S-1-5-21-57989841-1454471165-839522115-500\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,07,dd,f0,09,cb,ef,a4,43,83,e7,89,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,07,dd,f0,09,cb,ef,a4,43,83,e7,89,\
.
[HKEY_LOCAL_MACHINE\software\Pervasive Software\PSQL]
@Denied: ) (Everyone)
@=""
.
Completion time: 2012-01-10 18:40:25
ComboFix-quarantined-files.txt 2012-01-11 00:40
ComboFix2.txt 2012-01-07 22:46
ComboFix3.txt 2012-01-07 17:31
.
Pre-Run: 22,675,673,088 bytes free
Post-Run: 22,681,751,552 bytes free
.
- - End Of File - - B377FE6699389771C55A8AF6040A81BB
Post #21
Forget about System Look, I found what I needed


Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Fcopy::


FCopy::
c:\windows\system32\dllcache\i8042prt.sys |  c:\windows\system32\drivers\i8042prt.sys

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.
Post #22
SystemLook 30.07.11 by jpshortstuff Log created at 19:16 on 10/01/2012 by Administrator Administrator - Elevation successful ========== filefind ========== Searching for "i8042prt.sys " C:\WINDOWS\$NtServicePackUninstall$\i8042prt.sys —–c- 52736 bytes [15:59 29/07/2011] [06:14 04/08/2004] 5502B58EEF7486EE6F93F3F164DCB808 C:\WINDOWS\ServicePackFiles\i386\i8042prt.sys ——- 52480 bytes [06:14 04/08/2004] [19:18 13/04/2008] 4A0B06AA8943C1E332520F7440C0AA30 C:\WINDOWS\system32\dllcache\i8042prt.sys –a–c- 52480 bytes [16:24 16/07/2003] [20:18 13/04/2008] 4A0B06AA8943C1E332520F7440C0AA30 C:\WINDOWS\system32\drivers\i8042prt.sys –a—- 52480 bytes [16:24 16/07/2003] [20:18 13/04/2008] 4A0B06AA8943C1E332520F7440C0AA30 -= EOF =-
Post #25
ComboFix 12-01-10.02 - Administrator 01/10/2012 19:39:57.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.672 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
————— FCopy —————
.
c:\windows\system32\dllcache\i8042prt.sys –> c:\windows\system32\drivers\i8042prt.sys
.
((((((((((((((((((((((((( Files Created from 2011-12-11 to 2012-01-11 )))))))))))))))))))))))))))))))
.
.
2012-01-02 17:50 . 2012-01-02 17:50 ——– d—–w- c:\program files\ESET
2012-01-02 15:14 . 2012-01-02 15:14 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-01-02 15:14 . 2011-12-10 21:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-18 19:27 . 2011-12-18 19:27 ——– d—–w- c:\documents and settings\Guest
2011-12-16 14:35 . 2011-12-16 14:35 ——– d-sh–w- c:\documents and settings\NetworkService\PrivacIE
2011-12-16 14:35 . 2011-12-16 14:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Yahoo
2011-12-16 14:13 . 2011-12-18 14:34 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\AskToolbar
2011-12-16 08:46 . 2011-12-16 08:46 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2011-12-15 09:02 . 2011-04-26 11:07 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-15 09:02 . 2011-12-15 09:02 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-12-14 21:46 . 2011-12-14 21:46 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 15:57 . 2003-07-16 16:35 17920 —ha-w- c:\windows\system32\ping.exe
2011-11-23 13:25 . 2009-03-11 08:01 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2004-08-24 01:32 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2003-07-16 16:26 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2003-07-16 16:24 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2011-10-25 13:33 . 2003-07-16 16:33 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2002-08-29 01:04 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-24 20:29 . 2011-10-24 20:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 20:29 . 2011-10-24 20:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-08-06 00:53 . 2011-08-06 00:53 34779895 —-a-w- c:\program files\Inkscape-0.48.1-2.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-07_17.17.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-11 01:37 . 2012-01-11 01:37 16384 c:\windows\Temp\Perflib_Perfdata_4d4.dat
+ 2012-01-11 01:37 . 2012-01-11 01:37 16384 c:\windows\Temp\Perflib_Perfdata_260.dat
+ 2003-07-16 16:24 . 2008-04-13 20:18 52480 c:\windows\system32\dllcache\i8042prt.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-07-10 14:23 97064 —-a-w- c:\program files\Nero\Nero8\InCD\NBHShx.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="c:\program files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe" [2004-07-18 368640]
"H/PC Connection Agent"="c:\progra~1\MICROS~2\wcescomm.exe" [2005-11-16 1200128]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-10-05 98304]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"Akamai NetSession Interface"="c:\documents and settings\Administrator\Local Settings\Application Data\Akamai\netsession_win.exe" [2011-12-13 3305760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-10-19 126976]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 851968]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-07-09 570664]
"SecurDisc"="c:\program files\Nero\Nero8\InCD\NBHGui.exe" [2008-07-10 2049320]
"InCD"="c:\program files\Nero\Nero8\InCD\InCD.exe" [2008-07-10 1083176]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"PeachtreePrefetcher.exe"="c:\progra~1\SAGESO~1\PEACHT~1\PeachtreePrefetcher.exe" [2008-10-02 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-10 421736]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-02-28 519584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-14 78848]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Service Manager.lnk - c:\mssql7\Binn\sqlmangr.exe [2004-6-4 110592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Pervasive Software\\PSQL\\bin\\w3dbsmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\a la mode\\Sched\\eSched.exe"=
"c:\\WINDOWS\\system32\\VaultFilesDownloader.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"1583:TCP"= 1583:TCP:Pervasive DBEngine
"3351:TCP"= 3351:TCP:Pervasive DBEngine
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1414:TCP"= 1414:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
.
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [7/16/2003 10:41 AM 14336]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2/28/2010 1:33 AM 821664]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [7/10/2008 8:23 AM 53032]
R2 psqlWGE;Pervasive PSQL Workgroup Engine;c:\program files\Pervasive Software\PSQL\bin\w3dbsmgr.exe [9/5/2007 11:25 AM 455968]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [12/2/2009 9:23 PM 483688]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [12/2/2009 9:23 PM 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [12/2/2009 9:23 PM 211304]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [12/2/2009 9:23 PM 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [12/2/2009 9:23 PM 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [12/2/2009 9:23 PM 209768]
S2 XMLProvS;Network ProService;c:\windows\System32\svchost.exe -k xmlpros [7/16/2003 10:41 AM 14336]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 8:37 PM 4640000]
S3 ssmirrdr;ssmirrdr;c:\windows\system32\drivers\ssmirrdr.sys [9/22/2010 6:52 AM 10112]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
xmlpros REG_MULTI_SZ XMLProvS
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 22:57]
.
2010-10-23 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2010-10-23 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant =
Trusted Zone: apple.com\www
Trusted Zone: bleepingcomputer.com\download
Trusted Zone: k12.la.us\pc.rapides
Trusted Zone: landata.com\www.benton.ar.us
Trusted Zone: whatthetech.com\forums
TCP: DhcpNameServer = 192.168.2.1
DPF: {5E38AFD9-589F-45DF-8EB4-E6948B017C95} - hxxp://vault.alamode.com/cab/vaultinstall.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-10 20:02
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c2,be,85,c2,60,5e,47,9f,f4,87,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c2,be,85,c2,60,5e,47,9f,f4,87,\
.
[HKEY_USERS\S-1-5-21-57989841-1454471165-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a3,b4,bb,bf,ca,ce,11,4e,a3,8b,1a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ff,fe,f3,c0,98,b8,74,42,a4,96,63,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,07,dd,f0,09,cb,ef,a4,43,83,e7,89,\
.
[HKEY_USERS\S-1-5-21-57989841-1454471165-839522115-500\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,07,dd,f0,09,cb,ef,a4,43,83,e7,89,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,07,dd,f0,09,cb,ef,a4,43,83,e7,89,\
.
[HKEY_LOCAL_MACHINE\software\Pervasive Software\PSQL]
@Denied: ) (Everyone)
@=""
.
Completion time: 2012-01-10 20:08:40
ComboFix-quarantined-files.txt 2012-01-11 02:08
ComboFix2.txt 2012-01-11 00:40
ComboFix3.txt 2012-01-07 22:46
ComboFix4.txt 2012-01-07 17:31
.
Pre-Run: 22,674,960,384 bytes free
Post-Run: 22,675,140,608 bytes free
.
- - End Of File - - 86923933F63CD4D6693265411B3D463D
Post #26
I need to look over your log real close but wont be back online until tomorrow morning, how are things running now, does your mouse and keyboard work ?
Post #27
Hi, yes sir that sounds fine. My mouse & key board are all good now. I won't be able to be at my desktop till after 7pm cst today. But if u post something I can get it down as soon as I get in front of it. Thank you for all your help. ;)
Post #28
ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.
Post #29
ESET SCAN C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\41\18ce6069-5bb080a3 Java/TrojanDownloader.OpenConnection.AR trojan C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\10\7bec11ca-6028778f Java/Exploit.CVE-2011-3544.F trojan C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\24\762072d8-56e82e0d Java/Exploit.CVE-2011-3544.F trojan C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\35\1ae8aca3-5db8cb45 Java/Agent.DY trojan C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\57\7220dc79-6e2f18f3 Java/Exploit.CVE-2011-3544.D trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP384\A0091498.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP385\A0094498.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP387\A0095377.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP387\A0095403.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP389\A0095430.dll a variant of Win32/Toolbar.MyWebSearch.A application C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP389\A0095435.dll probably a variant of Win32/Toolbar.MyWebSearch.F application C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP389\A0095436.dll probably a variant of Win32/Toolbar.MyWebSearch.B application C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP389\A0095443.dll a variant of Win32/Toolbar.MyWebSearch application C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP389\A0095448.dll a variant of Win32/Toolbar.MyWebSearch.P application C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP390\A0095892.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP390\A0095941.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP390\A0095991.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100032.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100045.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100062.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0100075.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0101075.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP392\A0101083.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP393\A0101115.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP394\A0101138.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP395\A0105038.sys a variant of Win32/Rootkit.Kryptik.GG trojan C:\System Volume Information\_restore{0FEDF9FE-783B-464F-B8B1-670E22E3F906}\RP398\A0105093.sys a variant of Win32/Rootkit.Kryptik.GG trojan
Post #30
Good Morning,

Some of those bad files are in your System Restore Program, lets flush it all out so as not to re infect yourself.

System Restore is a component of Microsoft's Windows Me, Windows XP, Windows Vista and Windows 7 operating systems that allows for the rolling back of system files, registry keys, installed programs, etc., to a previous state in the event of malfunctioning or failure. Old restore points can be a source of re-infection.

Please follow the steps below to create a clean restore point:
  • Click Start > Run > copy and paste the following into the run box:

    %SystemRoot%\System32\restore\rstrui.exe

  • Press OK. Choose Create a Restore Point then click Next.
  • Name it (something you'll remember) and click Create.
  • When the confirmation screen shows the restore point has been created click Close.

Then remove all previous Restore Points
  • Click Start > Run > copy and paste the following into the run box:

    cleanmgr

  • Choose to scan drive C:\ (if C:\ is your main drive).
  • At the top, click on More Options tab. Click the Clean up… button in the System Restore box.
  • Click on the Yes button.
  • When finished, click on Cancel button to exit.




The rest are in your Java Cache, run this cleaner and it will flush that out as well


Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean


How is this computer behaving now ??

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI