High CPU usage. Don't know why

Semyazinovich1 · November 26, 2011

Hello there!

I am experiencing high CPU usage and I don't know why. Nothing that I can't recognise is popping up in taskmanager and I have no idea what is causing this. Thought that it might be malware.

I have a dds log and a quickscan log from mbam.

Thank you for your help.

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29

Run by Petter at 14:16:00 on 2011-11-26

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.46.1053.18.3326.1021 [GMT 1:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\nvvsvc.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\Logitech\G35\G35.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Users\Petter\AppData\Local\Apps\2.0\79MHH11W.Q48\GCGHBG4D.GEX\curs..tion_eee711038731a406_0004.0000_0d453ed5fea2fe48\CurseClient.exe

C:\Windows\system32\PnkBstrA.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Program Files\World of Warcraft\WoW.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTor.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTor.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTor.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [Google Update] "c:\users\petter\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [steam] "c:\program files\steam\Steam.exe" -silent

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [Logitech G35] c:\program files\logitech\g35\G35.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\users\petter\appdata\roaming\microsoft\windows\start menu\programs\startup\CurseClientStartup.ccip

StartupFolder: c:\users\petter\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 195.84.98.161 192.168.0.1

TCP: Interfaces\{9B933A29-E418-46D3-8FBC-1DA5D55C2734} : DhcpNameServer = 195.84.98.161 192.168.0.1

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\petter\appdata\roaming\mozilla\firefox\profiles\zetlobsf.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine -

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll

FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll

FF - plugin: c:\users\petter\appdata\local\google\update\1.3.21.79\npGoogleUpdate3.dll

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-8 442200]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-4-8 320856]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-4-8 20568]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-4-8 54616]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-4-8 44768]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-9-18 2253120]

R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-4-8 1153368]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2011-10-14 381248]

R3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\drivers\ladfDHP2i386.sys [2010-9-29 53976]

R3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\drivers\ladfSBVMi386.sys [2010-9-29 335064]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Tjänsten Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-8 136176]

S3 gupdatem;Tjänsten Google Update (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-4-8 136176]

S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-12-1 34384]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-11-25 14:14:18 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{b80852c7-16fd-4b2d-898b-49fe580399b7}\offreg.dll

2011-11-25 14:14:17 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{b80852c7-16fd-4b2d-898b-49fe580399b7}\mpengine.dll

2011-11-12 13:51:40 -------- d-----w- c:\users\petter\appdata\local\Skyrim

2011-11-11 17:50:12 -------- d-----w- c:\program files\Steam

2011-11-11 14:30:32 -------- d-----w- c:\windows\system32\Adobe

2011-11-11 13:57:57 -------- d-----w- c:\program files\uTorrentBar

2011-11-09 19:02:34 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat

2011-11-09 19:02:31 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-09 19:02:29 707584 ----a-w- c:\program files\common files\system\wab32.dll

2011-11-05 22:44:23 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL

2011-11-05 22:44:23 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX

2011-11-05 22:44:22 -------- d-----w- c:\program files\SpywareBlaster

2011-10-30 17:28:02 -------- d-----w- c:\windows\system32\xlive

2011-10-30 17:28:01 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE

2011-10-30 17:26:01 453456 ----a-w- c:\windows\system32\d3dx10_41.dll

2011-10-30 17:26:01 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll

2011-10-28 19:45:47 876032 ----a-w- c:\windows\system32\XpsPrint.dll

2011-10-28 17:08:42 280904 ----a-w- c:\windows\system32\PnkBstrB.xtr

2011-10-28 17:08:37 -------- d-----w- c:\users\petter\appdata\local\PunkBuster

2011-10-28 17:05:14 -------- d-----w- c:\programdata\EA Core

2011-10-28 16:47:17 -------- d--h--w- c:\program files\common files\EAInstaller

2011-10-28 16:47:02 140072 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2011-10-28 16:47:02 138056 ----a-w- c:\users\petter\appdata\roaming\PnkBstrK.sys

2011-10-28 16:46:43 280904 ----a-w- c:\windows\system32\PnkBstrB.exe

2011-10-28 16:46:43 280904 ----a-w- c:\windows\system32\PnkBstrB.ex0

2011-10-28 16:46:37 75136 ----a-w- c:\windows\system32\PnkBstrA.exe

2011-10-28 14:40:07 -------- d-----w- c:\program files\Windows Portable Devices

2011-10-28 14:36:31 92672 ----a-w- c:\windows\system32\UIAnimation.dll

2011-10-28 14:36:31 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll

2011-10-28 14:36:30 3023360 ----a-w- c:\windows\system32\UIRibbon.dll

2011-10-28 14:33:30 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-10-28 14:32:55 98816 ----a-w- c:\windows\system32\mfps.dll

2011-10-28 14:12:06 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax

2011-10-28 14:12:06 57856 ----a-w- c:\windows\system32\MSDvbNP.ax

2011-10-28 14:12:06 293376 ----a-w- c:\windows\system32\psisdecd.dll

2011-10-28 14:12:06 217088 ----a-w- c:\windows\system32\psisrndr.ax

2011-10-28 14:12:05 375808 ----a-w- c:\windows\system32\winsrv.dll

2011-10-28 14:10:54 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-28 14:10:54 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2011-10-28 14:10:54 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2011-10-28 14:10:54 238080 ----a-w- c:\windows\system32\oleacc.dll

2011-10-28 14:10:40 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-10-28 14:10:39 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-28 14:07:47 231424 ----a-w- c:\windows\system32\msshsq.dll

2011-10-28 13:13:10 -------- d-----w- c:\windows\system32\vi-VN

2011-10-28 13:13:10 -------- d-----w- c:\windows\system32\eu-ES

2011-10-28 13:13:10 -------- d-----w- c:\windows\system32\ca-ES

2011-10-28 13:00:44 -------- d-----w- c:\windows\system32\EventProviders

.

==================== Find3M ====================

.

2011-10-28 14:32:55 979456 ----a-w- c:\windows\system32\MFH264Dec.dll

2011-10-27 20:40:45 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-14 22:54:52 321856 ----a-w- c:\windows\system32\nvStreaming.exe

2011-10-03 03:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-06 20:45:29 41184 ----a-w- c:\windows\avastSS.scr

2011-09-06 20:38:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-09-06 20:36:26 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-09-06 13:30:12 2043392 ----a-w- c:\windows\system32\win32k.sys

2011-08-31 15:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

.

============= FINISH: 14:17:11,79 ===============

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8246

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

2011-11-26 14:28:06

mbam-log-2011-11-26 (14-28-06).txt

Scan type: Quick scan

Objects scanned: 167301

Time elapsed: 3 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

LDTate · December 1, 2011

:welcome:

What is this?

C:\Users\Petter\AppData\Local\Apps\2.0\79MHH11W.Q48\GCGHBG4D.GEX\curs..tion_eee711038731a406_0004.0000_0d453ed5fea2fe48\CurseClient.exe

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

Semyazinovich1 · December 2, 2011

Hello

The Curse Client is a tool that makes it easier for people to update/download different addons for certain games. It is widely used and there is nothing dangerous about it. It's downloaded from www.curse.com

Here is a link if you want to read more about the Curse Client: http://www.curse.com/client

2011-10-15 08:53 . 2011-09-18 10:07 877376 ----a-w- c:\windows\system32\nvgenco32.dll

2011-10-15 08:53 . 2011-04-07 18:39 3840320 ----a-w- c:\windows\system32\nvsvc.dll

2011-10-15 08:53 . 2011-04-07 18:39 1136448 ----a-w- c:\windows\system32\nvvsvc.exe

2011-10-15 08:53 . 2011-04-07 18:39 6350144 ----a-w- c:\windows\system32\nvcpl.dll

2011-10-15 08:53 . 2011-04-07 18:39 2458432 ----a-w- c:\windows\system32\nvapi.dll

2011-10-15 08:53 . 2011-04-07 18:39 203072 ----a-w- c:\windows\system32\nvmctray.dll

2011-10-15 08:53 . 2011-02-23 06:27 13205312 ----a-w- c:\windows\system32\nvd3dum.dll

2011-10-14 22:54 . 2011-10-14 22:54 321856 ----a-w- c:\windows\system32\nvStreaming.exe

2011-10-03 03:06 . 2011-05-10 07:43 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-06 13:30 . 2011-10-28 14:11 2043392 ----a-w- c:\windows\system32\win32k.sys

2011-11-10 13:40 . 2011-04-08 09:16 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

*Not* tomma poster & legitima standardposter visas inte.

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

2011-05-09 09:49 176936 ----a-w- c:\program files\uTorrentBar\prxtbuTor.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTor.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-04-08 39408]

"Steam"="c:\program files\Steam\Steam.exe" [2011-11-11 1242448]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]

"Logitech G35"="c:\program files\Logitech\G35\G35.exe" [2010-10-05 1811800]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

c:\users\Petter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2011-4-27 0]

OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Tjänsten Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 136176]

R3 gupdatem;Tjänsten Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 136176]

R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-12-01 34384]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-28 55128]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]

S3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\DRIVERS\ladfDHP2i386.sys [2010-09-29 53976]

S3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\DRIVERS\ladfSBVMi386.sys [2010-09-29 335064]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Innehåll i mappen 'Schemalagda aktiviteter':

.

2011-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 09:12]

.

2011-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 09:12]

.

2011-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1204039485-1667662688-3031602587-1000Core.job

- c:\users\Petter\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-20 15:29]

.

2011-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1204039485-1667662688-3031602587-1000UA.job

- c:\users\Petter\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-20 15:29]

.

------- Extra genomsökning -------

.

TCP: DhcpNameServer = 195.84.98.161 192.168.0.1

FF - ProfilePath - c:\users\Petter\AppData\Roaming\Mozilla\Firefox\Profiles\zetlobsf.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine -

.

- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

.

AddRemove-PunkBusterSvc - c:\program files\Origin Games\Battlefield 3\pbsvc.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-12-02 16:08

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LÅSTA REGISTERNYCKLAR ---------------------

.

[HKEY_USERS\S-1-5-21-1204039485-1667662688-3031602587-1000\Software\SecuROM\License information*]

"datasecu"=hex:a8,ea,a2,a1,06,09,b1,fe,8d,cb,d1,99,e5,ba,4a,b6,50,3f,e6,26,99,

3d,df,72,c6,93,2d,ab,5e,1c,0c,2f,86,6c,16,c0,b5,54,7d,01,12,19,40,ae,09,68,\

"rkeysecu"=hex:84,55,7b,2c,e0,db,4f,b7,68,0c,ab,1a,13,cb,71,05

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Sluttid: 2011-12-02 16:10:08

ComboFix-quarantined-files.txt 2011-12-02 15:10

ComboFix2.txt 2011-10-18 21:51

.

Före genomsökningen: 249 627 426 816 byte ledigt

Efter genomsökningen: 249 669 611 520 byte ledigt

.

- - End Of File - - 1388E44602E211A0B1971CE49D715F26

I am still getting random CPU spikes for some reason.

LDTate · December 2, 2011

Try posting combofix.txt again as the top part of it isn't showing

Semyazinovich1 · December 2, 2011

Oh, I apologize for that

ComboFix 11-12-02.01 - Petter 2011-12-02 16:00:55.2.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.46.1053.18.3326.2384 [GMT 1:00]

Körs från: c:\users\Petter\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((( Filer skapade från 2011-11-02 till 2011-12-02 ))))))))))))))))))))))))))))))

.

2011-12-02 14:03 . 2011-12-02 14:55 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9FF8F10A-4E15-4C54-88F0-D26EF971EEB1}\offreg.dll

2011-12-02 14:03 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9FF8F10A-4E15-4C54-88F0-D26EF971EEB1}\mpengine.dll

2011-11-12 13:51 . 2011-11-12 13:51 -------- d-----w- c:\users\Petter\AppData\Local\Skyrim

2011-11-11 17:50 . 2011-12-02 14:55 -------- d-----w- c:\program files\Steam

2011-11-11 17:24 . 2011-11-11 17:24 -------- d-----w- c:\program files\Microsoft Silverlight

2011-11-11 14:30 . 2011-11-11 14:30 -------- d-----w- c:\windows\system32\Adobe

2011-11-11 13:57 . 2011-11-11 13:57 -------- d-----w- c:\program files\uTorrentBar

2011-11-09 19:02 . 2011-10-17 11:41 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-11-09 19:02 . 2011-09-20 21:02 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-09 19:02 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-11-05 22:44 . 2010-01-10 18:40 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL

2011-11-05 22:44 . 2010-01-10 18:40 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX

2011-11-05 22:44 . 2011-11-26 13:36 -------- d-----w- c:\program files\SpywareBlaster

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-01 11:05 . 2011-05-14 08:47 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-28 18:01 . 2011-04-08 09:56 41184 ----a-w- c:\windows\avastSS.scr

2011-11-28 18:01 . 2011-04-08 09:56 199816 ----a-w- c:\windows\system32\aswBoot.exe

2011-11-28 17:53 . 2011-04-08 09:57 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-11-28 17:53 . 2011-04-08 09:57 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-11-28 17:52 . 2011-04-08 09:57 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-11-28 17:52 . 2011-04-08 09:57 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-11-28 17:52 . 2011-04-08 09:57 55128 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-11-28 17:51 . 2011-04-08 09:57 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-10-31 13:08 . 2011-10-28 16:47 140072 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2011-10-31 13:08 . 2011-10-28 17:08 280904 ----a-w- c:\windows\system32\PnkBstrB.xtr

2011-10-31 13:08 . 2011-10-28 16:46 280904 ----a-w- c:\windows\system32\PnkBstrB.exe

2011-10-30 12:33 . 2011-10-28 16:46 280904 ----a-w- c:\windows\system32\PnkBstrB.ex0

2011-10-28 16:54 . 2011-10-28 16:47 138056 ----a-w- c:\users\Petter\AppData\Roaming\PnkBstrK.sys

2011-10-28 16:53 . 2011-10-28 16:46 75136 ----a-w- c:\windows\system32\PnkBstrA.exe

2011-10-28 14:33 . 2011-10-28 14:33 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-10-28 14:33 . 2011-10-28 14:33 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-10-28 14:33 . 2011-10-28 14:33 161792 ----a-w- c:\windows\system32\msls31.dll

2011-10-28 14:33 . 2011-10-28 14:33 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-10-28 14:33 . 2011-10-28 14:33 86528 ----a-w- c:\windows\system32\iesysprep.dll

2011-10-28 14:33 . 2011-10-28 14:33 74752 ----a-w- c:\windows\system32\iesetup.dll

2011-10-28 14:33 . 2011-10-28 14:33 63488 ----a-w- c:\windows\system32\tdc.ocx

2011-10-28 14:33 . 2011-10-28 14:33 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-10-28 14:33 . 2011-10-28 14:33 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-10-28 14:33 . 2011-10-28 14:33 367104 ----a-w- c:\windows\system32\html.iec

2011-10-28 14:33 . 2011-10-28 14:33 35840 ----a-w- c:\windows\system32\imgutil.dll

2011-10-28 14:33 . 2011-10-28 14:33 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-10-28 14:33 . 2011-10-28 14:33 23552 ----a-w- c:\windows\system32\licmgr10.dll

2011-10-28 14:33 . 2011-10-28 14:33 1798144 ----a-w- c:\windows\system32\jscript9.dll

2011-10-28 14:33 . 2011-10-28 14:33 152064 ----a-w- c:\windows\system32\wextract.exe

2011-10-28 14:33 . 2011-10-28 14:33 150528 ----a-w- c:\windows\system32\iexpress.exe

2011-10-28 14:33 . 2011-10-28 14:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2011-10-28 14:33 . 2011-10-28 14:33 1427456 ----a-w- c:\windows\system32\inetcpl.cpl

2011-10-28 14:33 . 2011-10-28 14:33 11776 ----a-w- c:\windows\system32\mshta.exe

2011-10-28 14:33 . 2011-10-28 14:33 101888 ----a-w- c:\windows\system32\admparse.dll

2011-10-28 14:33 . 2011-10-28 14:33 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-10-28 14:32 . 2011-10-28 14:32 98816 ----a-w- c:\windows\system32\mfps.dll

2011-10-28 14:32 . 2011-10-28 14:32 979456 ----a-w- c:\windows\system32\MFH264Dec.dll

2011-10-28 14:32 . 2011-10-28 14:32 586240 ----a-w- c:\windows\system32\stobject.dll

2011-10-28 14:32 . 2011-10-28 14:32 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll

2011-10-28 14:32 . 2011-10-28 14:32 302592 ----a-w- c:\windows\system32\mfmp4src.dll

2011-10-28 14:32 . 2011-10-28 14:32 2873344 ----a-w- c:\windows\system32\mf.dll

2011-10-28 14:32 . 2011-10-28 14:32 261632 ----a-w- c:\windows\system32\mfreadwrite.dll

2011-10-28 14:32 . 2011-10-28 14:32 209920 ----a-w- c:\windows\system32\mfplat.dll

2011-10-28 14:32 . 2011-10-28 14:32 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe

2011-10-28 14:32 . 2011-10-28 14:32 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2011-10-28 14:32 . 2011-10-28 14:32 478720 ----a-w- c:\windows\system32\dxgi.dll

2011-10-28 14:32 . 2011-10-28 14:32 37376 ----a-w- c:\windows\system32\cdd.dll

2011-10-28 14:32 . 2011-10-28 14:32 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll

2011-10-28 14:32 . 2011-10-28 14:32 258048 ----a-w- c:\windows\system32\winspool.drv

2011-10-28 14:32 . 2011-10-28 14:32 135680 ----a-w- c:\windows\system32\XpsRasterService.dll

2011-10-28 14:32 . 2011-10-28 14:32 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll

2011-10-28 14:32 . 2011-10-28 14:32 519680 ----a-w- c:\windows\system32\d3d11.dll

2011-10-28 14:32 . 2011-10-28 14:32 4096 ----a-w- c:\windows\system32\drivers\sv-SE\dxgkrnl.sys.mui

2011-10-28 14:32 . 2011-10-28 14:32 369664 ----a-w- c:\windows\system32\WMPhoto.dll

2011-10-28 14:32 . 2011-10-28 14:32 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll

2011-10-28 14:32 . 2011-10-28 14:32 252928 ----a-w- c:\windows\system32\dxdiag.exe

2011-10-28 14:32 . 2011-10-28 14:32 195584 ----a-w- c:\windows\system32\dxdiagn.dll

2011-10-28 14:32 . 2011-10-28 14:32 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll

2011-10-15 08:53 . 2011-10-25 14:39 3074368 ----a-w- c:\windows\system32\nvsvcr.dll

2011-10-15 08:53 . 2011-10-25 14:37 7041856 ----a-w- c:\windows\system32\nvwgf2um.dll

2011-10-15 08:53 . 2011-10-25 14:37 61248 ----a-w- c:\windows\system32\OpenCL.dll

2011-10-15 08:53 . 2011-10-25 14:37 5578560 ----a-w- c:\windows\system32\nvcuda.dll

2011-10-15 08:53 . 2011-10-25 14:37 2401088 ----a-w- c:\windows\system32\nvcuvid.dll

2011-10-15 08:53 . 2011-10-25 14:37 2099520 ----a-w- c:\windows\system32\nvcuvenc.dll

2011-10-15 08:53 . 2011-10-25 14:37 18871616 ----a-w- c:\windows\system32\nvoglv32.dll

2011-10-15 08:53 . 2011-10-25 14:37 17248576 ----a-w- c:\windows\system32\nvcompiler.dll

2011-10-15 08:53 . 2011-10-25 14:37 10327360 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2011-10-15 08:53 . 2011-09-18 10:12 123712 ----a-w- c:\windows\system32\nvshext.dll

2011-10-15 08:53 . 2011-09-18 10:12 602432 ----a-w- c:\windows\system32\easyupdatusapiu.dll

2011-10-15 08:53 . 2011-09-18 10:07 919872 ----a-w- c:\windows\system32\nvdispco32.dll