Trojan.Vundo.EWZ and HijackThis help please

Viz_2

Hello, I'm having trouble with my processor running at a high percentage, if not 100%.
I have run various scans and none other than the online scan of BitDefender reveal Trojan.Vundo.EWZ. BitDefender doesn't seem able to remove it.

I have run HijackThis and the log is below, please could somebody help me remove any problems. (I don't have any idea what any of this means by the way !).

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:03:45, on 20/09/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Katrina\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ktarecruitment.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - !!06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - !!761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - !!7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - !!9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - !!08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - !!08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: (no name) - !!85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - !!85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - !!92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: !!5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: !!5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9541 bytes

Reluctant_spender

Malware Bytes

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

PedroH

Just to add - some viruses cannot be removed because they are programs that are running. Start in Safe Mode F6 and try again.

Viz_2

Thanks for your help. I performed a full scan last night with no items found. However I did a quick scan and again no item were found.

I have just seen your post Pedro, I will try that in a while, BitDefender is still scanning.

Below is the log......

Malwarebytes' Anti-Malware 1.28
Database version: 1182
Windows 6.0.6001 Service Pack 1

20/09/2008 18:48:38
mbam-log-2008-09-20 (18-48-38).txt

Scan type: Quick Scan
Objects scanned: 45095
Time elapsed: 9 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Viz_2

OK, I completed a safe mode scan with Malwarebytes, there were still no items detected.

What should I do next ?

Browntoa

run combifix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and post that log

you can ignore the XP bit as

Windows Vista users can use their Windows CD to boot up into the Vista Recovery Environment.

so just download and run the software

Viz_2

Sorry to be a pain, but you are saying to literatly download the software and run it ? I am using Windows Vista Business. And I don't need my Vista disc just yet ?

Browntoa

no , it's only if you have problems (which I have not had yet)

just download and run as per the instructions

Viz_2

OK, here is the Combofix log.........


ComboFix 08-09-20.02 - Katrina 2008-09-20 20:45:57.1 - NTFSx86
Microsoft® Windows Vista™ Business 6.0.6001.1.1252.1.1033.18.1120 [GMT 1:00]
Running from: C:\Users\Katrina\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-08-20 to 2008-09-20 )))))))))))))))))))))))))))))))
.

2008-09-20 01:52 . 2008-09-20 01:55 <DIR> d

---

C:\Program Files\SpywareBlaster
2008-09-19 19:15 . 2008-09-20 14:06 <DIR> d-a

---

C:\Users\All Users\TEMP
2008-09-19 19:15 . 2008-09-20 14:06 <DIR> d-a

---

C:\ProgramData\TEMP
2008-09-19 19:14 . 2008-09-20 14:48 <DIR> d

---

C:\Program Files\Trojan Remover
2008-09-19 01:15 . 2008-09-19 01:15 <DIR> d

---

C:\Program Files\Microsoft Silverlight
2008-09-19 01:13 . 2008-04-26 09:25 3,600,952 --a

---

C:\Windows\System32\ntkrnlpa.exe
2008-09-19 01:13 . 2008-04-26 09:25 3,549,240 --a

---

C:\Windows\System32\ntoskrnl.exe
2008-09-19 01:13 . 2008-04-26 09:26 891,448 --a

---

C:\Windows\System32\drivers\tcpip.sys
2008-09-19 01:13 . 2008-04-12 04:32 784,896 --a

---

C:\Windows\System32\rpcrt4.dll
2008-09-19 01:13 . 2008-04-05 02:21 72,192 --a

---

C:\Windows\System32\drivers\pacer.sys
2008-09-19 01:13 . 2008-04-05 04:34 15,360 --a

---

C:\Windows\System32\pacerprf.dll
2008-09-18 21:06 . 2008-02-28 13:26 1,414,440 --a

---

C:\Windows\System32\ShellManager310E2D762.dll
2008-09-18 21:06 . 2008-02-28 13:01 774,144 --a

---

C:\Windows\System32\NEROINSTAEC43759.DB
2008-09-18 21:00 . 2008-09-18 21:00 0 --a

---

C:\Windows\Irremote.ini
2008-09-18 20:18 . 2008-07-19 06:09 1,811,656 --a

---

C:\Windows\System32\wuaueng.dll
2008-09-18 20:18 . 2008-07-19 04:44 1,524,736 --a

---

C:\Windows\System32\wucltux.dll
2008-09-18 20:18 . 2008-07-19 06:10 53,448 --a

---

C:\Windows\System32\wuauclt.exe
2008-09-18 20:18 . 2008-07-19 06:10 45,768 --a

---

C:\Windows\System32\wups2.dll
2008-09-18 20:15 . 2008-07-19 06:09 563,912 --a

---

C:\Windows\System32\wuapi.dll
2008-09-18 20:15 . 2008-07-19 04:44 83,456 --a

---

C:\Windows\System32\wudriver.dll
2008-09-18 20:15 . 2008-07-19 06:10 36,552 --a

---

C:\Windows\System32\wups.dll
2008-09-18 20:14 . 2008-07-18 22:08 163,904 --a

---

C:\Windows\System32\wuwebv.dll
2008-09-18 20:14 . 2008-07-18 20:44 31,232 --a

---

C:\Windows\System32\wuapp.exe
2008-09-17 13:57 . 2008-09-17 13:59 <DIR> d

---

C:\Program Files\TalkTalk
2008-09-15 13:53 . 2008-09-19 15:30 <DIR> d

---

C:\Program Files\Windows Live
2008-09-15 13:53 . 2008-09-19 15:30 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-09-15 13:52 . 2008-09-19 15:25 <DIR> d

---

C:\Users\All Users\WLInstaller
2008-09-15 13:52 . 2008-09-19 15:25 <DIR> d

---

C:\ProgramData\WLInstaller
2008-09-15 13:00 . 2008-09-15 13:00 <DIR> d

---

C:\Program Files\Common Files\Aladdin Shared
2008-09-15 12:59 . 2008-09-18 19:58 <DIR> d

---

C:\Program Files\vPresenter
2008-09-15 12:58 . 2008-09-15 12:58 <DIR> d

---

C:\Program Files\IsdnAdapterFiles
2008-09-14 09:11 . 2008-09-14 09:11 <DIR> d

---

C:\Program Files\JustCamIt
2008-09-11 20:54 . 2008-09-11 20:54 0 --ah

---

C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-09-11 20:07 . 2008-09-11 20:07 <DIR> d

---

C:\PerfLogs
2008-09-11 18:11 . 2008-01-19 08:33 2,623,488 --a

---

C:\Windows\System32\SLsvc.exe
2008-09-11 18:11 . 2008-01-19 08:36 1,541,120 --a

---

C:\Windows\System32\onex.dll
2008-09-11 18:10 . 2008-01-19 08:42 51,768 --a

---

C:\Windows\System32\PSHED.DLL
2008-09-11 18:08 . 2008-01-19 06:54 1,675,370 --a

---

C:\Windows\System32\wlan.tmf
2008-09-11 18:06 . 2008-01-19 08:36 2,867,712 --a

---

C:\Windows\System32\mf.dll
2008-09-11 18:05 . 2008-01-19 08:33 2,927,104 --a

---

C:\Windows\explorer.exe
2008-09-11 18:04 . 2008-01-19 04:12 3,662,296 --a

---

C:\Windows\System32\locale.nls
2008-09-11 18:02 . 2008-01-19 08:34 1,855,488 --a

---

C:\Windows\System32\dbgeng.dll
2008-09-11 18:01 . 2008-01-19 08:38 4,595,712 --a

---

C:\Windows\System32\AuthFWSnapin.dll
2008-09-11 18:00 . 2008-01-19 08:37 2,537,472 --a

---

C:\Windows\System32\wpdshext.dll
2008-09-11 17:59 . 2008-01-19 08:33 8,139,264 --a

---

C:\Windows\System32\ssBranded.scr
2008-09-11 17:58 . 2008-01-19 08:33 2,515,968 --a

---

C:\Windows\System32\accessibilitycpl.dll
2008-09-11 17:57 . 2008-01-19 08:35 3,072,000 --a

---

C:\Windows\System32\networkmap.dll
2008-09-11 17:56 . 2008-01-19 08:32 1,370,624 --a

---

C:\Windows\System32\Aurora.scr
2008-09-11 17:55 . 2008-01-19 08:32 5,714,432 --a

---

C:\Windows\System32\logon.scr
2008-09-11 17:54 . 2008-01-19 07:06 8,147,456 --a

---

C:\Windows\System32\wmploc.DLL
2008-09-11 17:53 . 2008-01-19 08:33 599,552 --a

---

C:\Windows\System32\vsp1cln.exe
2008-09-11 17:53 . 2008-01-05 12:31 145,455 --a

---

C:\Windows\System32\perfmon.msc
2008-09-11 17:53 . 2008-01-05 12:22 144,909 --a

---

C:\Windows\System32\fsmgmt.msc
2008-09-11 17:53 . 2008-01-05 12:32 120,458 --a

---

C:\Windows\System32\secpol.msc
2008-09-11 17:53 . 2008-01-05 12:34 15,181 --a

---

C:\Windows\System32\gatherWirelessInfo.vbs
2008-09-11 17:53 . 2008-01-05 12:39 150 --a

---

C:\Windows\System32\RacUREx.xml
2008-09-11 17:53 . 2008-01-05 12:31 3 --a

---

C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
2008-09-11 17:51 . 2008-01-19 08:36 704,512 --a

---

C:\Windows\System32\SmiEngine.dll
2008-09-11 17:51 . 2008-01-19 08:36 357,888 --a

---

C:\Windows\System32\wbemcomn.dll
2008-09-11 17:51 . 2008-01-19 08:36 218,624 --a

---

C:\Windows\System32\wdscore.dll
2008-09-11 17:51 . 2008-01-19 08:36 139,264 --a

---

C:\Windows\System32\SmiInstaller.dll
2008-09-11 17:51 . 2008-01-19 08:33 130,560 --a

---

C:\Windows\System32\PkgMgr.exe
2008-09-11 17:50 . 2008-01-19 08:34 305,152 --a

---

C:\Windows\System32\msdelta.dll
2008-09-11 17:50 . 2008-01-19 08:34 258,560 --a

---

C:\Windows\System32\dpx.dll
2008-09-11 17:50 . 2008-01-19 08:34 246,784 --a

---

C:\Windows\System32\drvstore.dll
2008-09-11 17:50 . 2008-01-19 08:35 35,328 --a

---

C:\Windows\System32\mspatcha.dll
2008-09-11 13:02 . 2008-07-31 02:13 4,240,384 --a

---

C:\Windows\System32\GameUXLegacyGDFs.dll
2008-09-11 13:02 . 2008-07-31 04:32 28,160 --a

---

C:\Windows\System32\Apphlpdm.dll
2008-09-11 13:01 . 2008-06-26 04:29 303,616 --a

---

C:\Windows\System32\wmpeffects.dll
2008-09-05 18:33 . 2008-09-05 18:33 <DIR> d

---

C:\Program Files\SystemRequirementsLab
2008-08-31 18:32 . 2008-08-31 18:32 <DIR> d

---

C:\Users\Katrina\The Verve
2008-08-29 18:44 . 2008-08-29 18:44 <DIR> d

---

C:\Users\Katrina\AppData\Roaming\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-20 20:00

---

d

---

w C:\ProgramData\Kontiki
2008-09-18 20:29

---

d

---

w C:\Program Files\DivX
2008-09-18 20:12

---

d

---

w C:\ProgramData\Nero
2008-09-18 20:12

---

d

---

w C:\Program Files\Common Files\Nero
2008-09-18 20:06

---

d

---

w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-18 18:55

---

d

---

w C:\Users\Katrina\AppData\Roaming\Azureus
2008-09-18 18:55

---

d

---

w C:\Program Files\Sports Interactive
2008-09-18 18:55

---

d

---

w C:\Program Files\CCleaner
2008-09-18 14:51

---

d

---

w C:\Program Files\Java
2008-09-17 12:59

---

d

---

w C:\ProgramData\SupportSoft
2008-09-12 06:48 130,721 ----a-w C:\Users\Katrina\AppData\Roaming\nvModes.dat
2008-09-11 19:45

---

d

---

w C:\ProgramData\NVIDIA
2008-09-11 19:37 174 --sha-w C:\Program Files\desktop.ini
2008-09-11 19:10

---

d

---

w C:\Program Files\Windows Sidebar
2008-09-11 19:10

---

d

---

w C:\Program Files\Windows Photo Gallery
2008-09-11 19:10

---

d

---

w C:\Program Files\Windows Mail
2008-09-11 19:10

---

d

---

w C:\Program Files\Windows Journal
2008-09-11 19:10

---

d

---

w C:\Program Files\Windows Defender
2008-09-11 19:10

---

d

---

w C:\Program Files\Windows Collaboration
2008-09-11 19:10

---

d

---

w C:\Program Files\Windows Calendar
2008-09-11 18:11 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-09-11 18:10 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-09-11 14:31

---

d

---

w C:\ProgramData\Microsoft Help
2008-09-11 14:21

---

d

---

w C:\Program Files\Microsoft Works
2008-09-09 23:04 38,528 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-09-09 23:03 17,200 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-08-27 17:00

---

d

---

w C:\Program Files\Common Files\PX Storage Engine
2008-08-05 21:58 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-08-02 01:01 625,152 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-08-01 16:46

---

d

---

w C:\Program Files\SopCast
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-16 01:32 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-06-27 04:15 827,392 ----a-w C:\Windows\System32\wininet.dll
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 03:29 565,248 ----a-w C:\Windows\System32\emdmgmt.dll
2008-06-26 03:29 45,056 ----a-w C:\Windows\System32\dataclen.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-19 10:56 61,224 ----a-w C:\Users\Katrina\GoToAssistDownloadHelper.exe
2008-05-01 11:35 286 ----a-w C:\Users\Katrina\AppData\Roaming\wklnhst.dat
2007-10-30 14:33 76 --sh--r C:\Windows\CT4CET.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2008-02-27 1032376]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [2007-05-09 159744]
"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-08-29 36864]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-10-30 77824]
"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-04-16 184320]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
"Malwarebytes Anti-Malware Reboot"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-09-10 1253040]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-06-27 405504]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 81920]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-10-04 86016]
"Malwarebytes Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-09-10 1253040]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 703280]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-10-30 50688]
QuickSet.lnk - C:\Windows\Installer\!!7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-10-30 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AC617988-1876-4F08-BAF9-45A777CF271B}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"!!6877ECDD-AAD1-4AA8-BD4F-265E029E3296}"= C:\Program Files\Dell\MediaDirect\PowerCinema.exe:CyberLink PowerCinema
"!!13D29543-A243-4B2A-B5A7-EC97A09ADDD4}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"!!807D0DF1-9836-48DF-80AD-0179DA99A13C}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"!!65AE74D2-C1C6-41E3-B29E-71FFF708FA9D}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"!!3085E883-BD69-40B5-B803-AD231EA8C1FB}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{A3C3FBE4-3F4E-4391-8755-B466768F2E98}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{013ED201-C9ED-4E91-ABA7-F946B9009038}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{AF31A673-B619-48D7-AA57-9A600460AFBB}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{22E1AEBA-E51E-4A9F-AD3C-7CBAA86F6724}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"TCP Query User{D24403A4-A6F6-4154-A546-5E6E195B4165}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{BCE48789-E4CE-4AAD-9611-75BD168EFBC5}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"{BD0E3206-8E6D-4F77-BAEA-817FEC450707}"= UDP:C:\Program Files\Kontiki\KService.exe:Delivery Manager Service
"!!1BEDC9D5-020D-41D6-8F4B-F9D5E4FB4D55}"= TCP:C:\Program Files\Kontiki\KService.exe:Delivery Manager Service
"TCP Query User{951C3F3E-3837-47EA-A800-48E22B0B3C52}C:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{81D6B1D0-BF33-44FE-B85B-8F6798E6FC61}C:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{9D3CCF74-B44D-458B-A9E8-BA44B40B9D20}C:\\program files\\sopcast\\sopcast.exe"= UDP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{2E0678DE-C74A-473C-8110-BEEFF734796E}C:\\program files\\sopcast\\sopcast.exe"= TCP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"!!427D46DF-7DFE-46CE-BDE4-637164E72C91}"= UDP:C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
"{BE057EF3-D412-4274-B761-788ADB11D0CF}"= TCP:C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
"TCP Query User{FD00EA54-3658-40A3-BB1F-1BFD5E85DD0F}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{73537DA6-A920-47D4-8CEB-880754DA75B7}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{288F23D9-2285-4F68-84FE-63499C5E48AA}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B00AA92F-49B2-4D3F-A343-098BFAD4E441}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{7B2D147C-26E0-4594-A128-966161E1E5FF}C:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{8D37B828-B43F-4AC1-9391-0ED22D81F45A}C:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"!!81C0D391-1D25-46D1-BC82-E36C99528168}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
R3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2006-11-07 78128]
R3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2006-11-07 80176]
R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-07 16560]
R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-08-29 7424]
S3 GoToAssist;GoToAssist;C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe Start=service [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\!!588d856e-4262-11dd-9be5-001dd9e5c404}]
\shell\AutoRun\command - F:\autorun.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe


.

---

Supplementary Scan

---

.
FireFox -: Profile - C:\Users\Katrina\AppData\Roaming\Mozilla\Firefox\Profiles\1ggzg76e.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - https://www.bbc.co.uk
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava11.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava12.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava13.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava14.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava32.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npoji610.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-20 20:59:30
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-20 21:06:58
ComboFix-quarantined-files.txt 2008-09-20 20:06:01

Pre-Run: 61,183,283,200 bytes free
Post-Run: 60,827,992,064 bytes free

240 --- E O F --- 2008-09-19 00:23:01

aliEnRIK

Do you not have an anti virus on your computer?

Browntoa

is it still getting high processor usage ??