Infected or not ?

[Priapos]

Yesterday while my computer was in iddle state, a message appeared in my screen : The NTVDM CPU has encountered an illegal instruction...

followed by 8 or 10 messages like :

cexrnowams.exe is not a valid win32 application

nemwoxsrca.exe is not a valid win32 application

emxrnocasw.exe is not a valid win32 application

and other similar messages.

I scanned my system with malwarebytes, and i found one infected registry value that i deleted.

As i have no viruses problems for many years, i am a bit preoccupied. I want to know if i must do further actions or if my pc is virus free for the moment.

I attach the malwarebytes log file and a current (after the deletion of the infected registry value) hijackthis log file.

Please tell me if everything seems ok, as i use my computer for online purchases using my credit card and i want to be safe.

Thank you !

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:19:46, on 01-Sep-10

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system\HsMgr.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Xpadder_v5.6\Xpadder.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\explorer.exe

F:\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [Cmaudio8788GX] C:\Windows\system\HsMgr.exe Envoke

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O17 - HKLM\System\CCS\Services\Tcpip\..\{8522762C-764D-4457-A295-71A171F5AD50}: NameServer = 208.67.222.222,208.67.220.220

O17 - HKLM\System\CS1\Services\Tcpip\..\{8522762C-764D-4457-A295-71A171F5AD50}: NameServer = 208.67.222.222,208.67.220.220

O17 - HKLM\System\CS2\Services\Tcpip\..\{8522762C-764D-4457-A295-71A171F5AD50}: NameServer = 208.67.222.222,208.67.220.220

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

--

End of file - 3003 bytes

mbam_log_2010_08_31__23_40_45_.txt

[Maniac]

Hello Priapos! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

Please follow these instructions and post all logs if you can:

http://forums.malwarebytes.org/index.php?showtopic=9573

[Priapos]

Hello Borislav!

Thank you very much for your reply and for your help.

I followed the instructions on the link that you gave me, and here is what you need i hope.

DDS (Ver_10-03-17.01) - NTFSx86

Run by Kukuruku at 22:24:18.81 on 02-Sep-10

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_17

Microsoft Windows 7 Ultimate 6.1.7600.0.1253.30.1033.18.2048.1447 [GMT 3:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Windows\system32\lxbkcoms.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Windows\system32\sppsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\system\HsMgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\explorer.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Users\Kukuruku\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [Cmaudio8788GX] c:\windows\system\HsMgr.exe Envoke

uPolicies-explorer: DisallowCpl = 1 (0x1)

uPolicies-explorer: StartMenuLogOff = 1 (0x1)

uPolicies-explorer: HideSCAPower = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

TCP: {8522762C-764D-4457-A295-71A171F5AD50} = 208.67.222.222,208.67.220.220

================= FIREFOX ===================

FF - ProfilePath - c:\users\kukuruku\appdata\roaming\mozilla\firefox\profiles\jiuy7l78.default\

FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

============= SERVICES / DRIVERS ===============

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-7-31 267432]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-1-11 60936]

R2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe -service --> c:\windows\system32\lxbkcoms.exe -service [?]

R3 cmudaxp;ASUS Xonar D1 Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2009-9-23 1498112]

S3 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-7-31 135336]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\drivers\ivusb.sys [2009-7-24 25112]

=============== Created Last 30 ================

2010-09-02 19:20:24 0 ----a-w- c:\users\kukuruku\defogger_reenable

2010-08-31 19:34:42 0 d-----w- c:\users\kukuruku\appdata\roaming\Malwarebytes

2010-08-31 19:34:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-31 19:34:29 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-31 19:34:29 0 d-----w- c:\programdata\Malwarebytes

2010-08-31 19:34:29 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-31 13:58:04 175474725 ----a-w- c:\windows\MEMORY.DMP

2010-08-27 14:50:07 978432 ----a-w- c:\windows\system32\wininet.dll

2010-08-27 14:50:07 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-08-27 14:47:17 87552 ----a-w- c:\windows\system32\wudriver.dll

2010-08-27 14:47:09 33792 ----a-w- c:\windows\system32\wuapp.exe

2010-08-27 14:47:09 171608 ----a-w- c:\windows\system32\wuwebv.dll

2010-08-27 14:46:58 2421760 ----a-w- c:\windows\system32\wucltux.dll

2010-08-25 15:04:06 1286960 ----a-w- c:\windows\system32\ntdll.dll

2010-08-25 14:55:47 571904 ----a-w- c:\windows\system32\oleaut32.dll

2010-08-25 14:48:37 82944 ----a-w- c:\windows\system32\iccvid.dll

2010-08-25 14:48:37 197632 ----a-w- c:\windows\system32\ir32_32.dll

2010-08-25 14:48:23 37376 ----a-w- c:\windows\system32\rtutils.dll

2010-08-12 14:02:57 2326016 ----a-w- c:\windows\system32\win32k.sys

2010-08-12 14:02:15 1233920 ----a-w- c:\windows\system32\msxml3.dll

2010-08-12 14:00:42 242176 ----a-w- c:\windows\system32\tapisrv.dll

2010-08-12 14:00:05 310784 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-12 14:00:05 307200 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-08-12 14:00:05 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2010-08-12 13:59:27 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-08-12 13:59:26 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-08-12 13:58:53 224256 ----a-w- c:\windows\system32\schannel.dll

2010-08-12 13:57:54 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys

==================== Find3M ====================

2010-07-09 22:37:00 9818728 ----a-w- c:\windows\system32\nvd3dum.dll

2010-07-09 22:37:00 56936 ----a-w- c:\windows\system32\OpenCL.dll

2010-07-09 22:37:00 4553832 ----a-w- c:\windows\system32\nvcuda.dll

2010-07-09 22:37:00 2892904 ----a-w- c:\windows\system32\nvcuvid.dll

2010-07-09 22:37:00 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll

2010-07-09 22:37:00 236136 ----a-w- c:\windows\system32\nvcod1922.dll

2010-07-09 22:37:00 236136 ----a-w- c:\windows\system32\nvcod.dll

2010-07-09 22:37:00 1625192 ----a-w- c:\windows\system32\nvapi.dll

2010-07-09 22:37:00 14092904 ----a-w- c:\windows\system32\nvoglv32.dll

2010-07-09 22:37:00 11008040 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2010-07-09 22:37:00 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd

2010-07-09 22:37:00 10267240 ----a-w- c:\windows\system32\nvcompiler.dll

2010-07-09 13:37:10 66664 ----a-w- c:\windows\system32\nvshext.dll

2010-07-09 13:37:10 1469544 ----a-w- c:\windows\system32\nvsvc.dll

2010-07-09 13:37:10 13939816 ----a-w- c:\windows\system32\nvcpl.dll

2010-07-09 13:37:10 129640 ----a-w- c:\windows\system32\nvvsvc.exe

2010-07-09 13:37:10 110696 ----a-w- c:\windows\system32\nvmctray.dll

2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat

2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat

2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat

2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat

2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini

2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat

2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat

2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat

2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat

2009-10-14 09:58:17 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 22:25:20.99 ===============

Attach.zip

ark.zip

mbam_log_2010_09_02__22_47_56_.txt

[Maniac]

Step 1

I suggest you to uninstall CCleaner. Something for CCleaner and registry cleaners at all:

http://miekiemoes.blogspot.com/2008/02/reg...weaking_13.html

Step 2

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Windows\Sun
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

Step 3

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Open Tools -> Options -> Main tab
     
   • Set to Always ask me where to Save the files.
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

In your next reply, please include these log(s):

1. JavaRa log
   
2. ComboFix log
   

[Priapos]

Here is everything you asked for.

I really appreciate your help.

-----------------------------------------------------------------------

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Sep 05 17:16:38 2010

Found and removed: Software\Classes\JavaPlugin.160_17

------------------------------------

Finished reporting.

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Sep 05 17:17:10 2010

------------------------------------

Finished reporting.

-------------------------------------------------

I am pasting even the Combo-Fix.txt cause i 'm not sure if it's the same with the log i attached.

----------------------------------------

ComboFix 10-09-04.06 - Kukuruku 05-Sep-10 17:34:33.1.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1253.30.1033.18.2048.1447 [GMT 3:00]

Running from: c:\users\Kukuruku\Desktop\Combo-Fix.exe

.

((((((((((((((((((((((((( Files Created from 2010-08-05 to 2010-09-05 )))))))))))))))))))))))))))))))

.

2010-09-05 14:42 . 2010-09-05 14:42 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-09-02 19:11 . 2010-09-02 19:11 -------- d-----w- c:\program files\Microsoft SDKs

2010-08-31 19:34 . 2010-08-31 19:34 -------- d-----w- c:\users\Kukuruku\AppData\Roaming\Malwarebytes

2010-08-31 19:34 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-31 19:34 . 2010-08-31 19:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-31 19:34 . 2010-08-31 19:34 -------- d-----w- c:\programdata\Malwarebytes

2010-08-31 19:34 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-27 14:50 . 2010-08-27 14:50 978432 ----a-w- c:\windows\system32\wininet.dll

2010-08-27 14:47 . 2010-08-27 14:47 87552 ----a-w- c:\windows\system32\wudriver.dll

2010-08-27 14:47 . 2010-08-27 14:47 575704 ----a-w- c:\windows\system32\wuapi.dll

2010-08-27 14:47 . 2010-08-27 14:47 35552 ----a-w- c:\windows\system32\wups.dll

2010-08-27 14:47 . 2010-08-27 14:47 33792 ----a-w- c:\windows\system32\wuapp.exe

2010-08-27 14:47 . 2010-08-27 14:47 171608 ----a-w- c:\windows\system32\wuwebv.dll

2010-08-27 14:46 . 2010-08-27 14:46 53472 ----a-w- c:\windows\system32\wuauclt.exe

2010-08-27 14:46 . 2010-08-27 14:46 44768 ----a-w- c:\windows\system32\wups2.dll

2010-08-27 14:46 . 2010-08-27 14:46 2421760 ----a-w- c:\windows\system32\wucltux.dll

2010-08-27 14:46 . 2010-08-27 14:46 1929952 ----a-w- c:\windows\system32\wuaueng.dll

2010-08-25 15:04 . 2010-06-30 06:27 1286960 ----a-w- c:\windows\system32\ntdll.dll

2010-08-25 14:55 . 2010-04-07 07:10 571904 ----a-w- c:\windows\system32\oleaut32.dll

2010-08-25 14:48 . 2010-07-29 06:30 197632 ----a-w- c:\windows\system32\ir32_32.dll

2010-08-25 14:48 . 2010-07-29 06:30 82944 ----a-w- c:\windows\system32\iccvid.dll

2010-08-25 14:48 . 2010-06-19 06:23 37376 ----a-w- c:\windows\system32\rtutils.dll

2010-08-12 14:02 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys

2010-08-12 14:02 . 2010-06-08 06:02 1233920 ----a-w- c:\windows\system32\msxml3.dll

2010-08-12 14:00 . 2010-07-16 09:36 242176 ----a-w- c:\windows\system32\tapisrv.dll

2010-08-12 14:00 . 2010-06-22 02:47 310784 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-12 14:00 . 2010-06-22 02:47 307200 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-08-12 14:00 . 2010-06-22 02:47 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2010-08-12 13:59 . 2010-06-19 06:33 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-08-12 13:59 . 2010-06-19 06:33 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-08-12 13:58 . 2010-06-16 05:48 224256 ----a-w- c:\windows\system32\schannel.dll

2010-08-12 13:57 . 2010-06-14 06:12 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-05 14:26 . 2010-01-10 22:11 -------- d-----w- c:\users\Kukuruku\AppData\Roaming\uTorrent

2010-09-05 14:23 . 2010-01-10 22:09 -------- d-----w- c:\program files\Everything

2010-09-02 19:11 . 2010-01-14 13:54 -------- d-----w- c:\programdata\Microsoft Help

2010-08-31 14:34 . 2010-01-10 21:40 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2010-08-07 19:36 . 2010-01-10 19:31 1930 ----a-w- c:\users\Kukuruku\AppData\Roaming\ASUS\Xonar D2 Audio Center\AsusAudioCenter.dll

2010-08-01 14:31 . 2010-01-10 19:35 -------- d-----w- c:\programdata\NVIDIA

2010-08-01 14:29 . 2010-08-01 14:28 -------- d-----w- c:\program files\NVIDIA Corporation

2010-08-01 14:28 . 2010-08-01 14:28 -------- d-----w- c:\programdata\NVIDIA Corporation

2010-07-31 20:57 . 2010-07-31 20:57 -------- d-----w- c:\users\Kukuruku\AppData\Roaming\Avira

2010-07-31 13:53 . 2010-07-31 13:53 -------- d-----w- c:\programdata\Avira

2010-07-31 13:53 . 2010-07-31 13:53 -------- d-----w- c:\program files\Avira

2010-07-09 22:37 . 2010-08-01 14:25 56936 ----a-w- c:\windows\system32\OpenCL.dll

2010-07-09 22:37 . 2010-08-01 14:25 11008040 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2010-07-09 22:37 . 2010-08-01 14:25 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd

2010-07-09 22:37 . 2010-08-01 14:25 4553832 ----a-w- c:\windows\system32\nvcuda.dll

2010-07-09 22:37 . 2010-08-01 14:25 2892904 ----a-w- c:\windows\system32\nvcuvid.dll

2010-07-09 22:37 . 2010-08-01 14:25 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll

2010-07-09 22:37 . 2010-08-01 14:25 14092904 ----a-w- c:\windows\system32\nvoglv32.dll

2010-07-09 22:37 . 2010-08-01 14:25 236136 ----a-w- c:\windows\system32\nvcod1922.dll

2010-07-09 22:37 . 2010-08-01 14:25 236136 ----a-w- c:\windows\system32\nvcod.dll

2010-07-09 22:37 . 2010-08-01 14:25 1625192 ----a-w- c:\windows\system32\nvapi.dll

2010-07-09 22:37 . 2010-08-01 14:25 10267240 ----a-w- c:\windows\system32\nvcompiler.dll

2010-07-09 22:37 . 2009-06-10 21:19 9818728 ----a-w- c:\windows\system32\nvd3dum.dll

2010-07-09 13:37 . 2010-07-09 13:37 66664 ----a-w- c:\windows\system32\nvshext.dll

2010-07-09 13:37 . 2010-07-09 13:37 1469544 ----a-w- c:\windows\system32\nvsvc.dll

2010-07-09 13:37 . 2010-07-09 13:37 13939816 ----a-w- c:\windows\system32\nvcpl.dll

2010-07-09 13:37 . 2010-07-09 13:37 129640 ----a-w- c:\windows\system32\nvvsvc.exe

2010-07-09 13:37 . 2010-07-09 13:37 110696 ----a-w- c:\windows\system32\nvmctray.dll

2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat

2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

"Cmaudio8788GX"="c:\windows\system\HsMgr.exe" [2010-01-10 200704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"DisallowCpl"= 1 (0x1)

"HideSCAPower"= 1 (0x1)

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]

R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2009-07-24 25112]

S2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe [2008-02-19 537256]

S3 cmudaxp;ASUS Xonar D1 Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2010-01-10 1498112]

.

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {8522762C-764D-4457-A295-71A171F5AD50} = 208.67.222.222,208.67.220.220

FF - ProfilePath - c:\users\Kukuruku\AppData\Roaming\Mozilla\Firefox\Profiles\jiuy7l78.default\

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2010-09-05 17:45:53

ComboFix-quarantined-files.txt 2010-09-05 14:45

Pre-Run: 37,605,040,128 bytes free

Post-Run: 37,538,988,032 bytes free

- - End Of File - - 14F320EE211B1C824D3F81E669DF7BEF

log.txt

[Maniac]

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go here then click on:
  
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Now click on Advanced Settings and select the following:
  

• • Remove found threats
    
  • Scan archives
    
  • Scan for potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth Technology
    

[*]Now click on:

[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

[*]When completed the Online Scan will begin automatically.

[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

[*]Now click on:

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

[Priapos]

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=3dc12e35de266f4ebdfc28ea3714522a

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-09-06 07:20:56

# local_time=2010-09-06 10:20:56 (+0200, GTB Daylight Time)

# country="United States"

# lang=1033

# osver=6.1.7600 NT

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1797 16775165 100 94 98755 42894346 112586 0

# compatibility_mode=5893 16776574 100 94 23461929 36250244 0 0

# compatibility_mode=8192 67108863 100 0 261 261 0 0

# scanned=94367

# found=0

# cleaned=0

# scan_time=3225

[Maniac]

It seems your system is clean. Do you still have problem?

[Priapos]

Actually i still have some issues, but i was waiting to finish the procedure with you in order to continue troubleshooting, cause you said me to not install any software/hardware till we finish our scans.

The issue i have are some spikes of 10-15% of cpu usage while in iddle. I can't see the process that causes this cpu usage with task manager, but using process explorer i found out that the two processes that use my cpu every one minute are hardware interrupts and DPCs. After a lot of googling i believe that this is caused by a driver that needs to be updated, but the strange thing is that my system is very old and everything is up to date+this problem came out in the last 10days. Exactly the same period with the issue i described in my first post and the conseguent cleaning i did with malwarebytes.

I will troubleshoot with the procedure described in that link, hoping to identify the problem.

I have some clues as i found my pc with a bsod caused by ataport.sys the other day.

Can you please tell me if it's normal to have two explorer.exe processes, as reported by hijackthis log that i pasted in my first post ?

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:19:46, on 01-Sep-10

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system\HsMgr.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Xpadder_v5.6\Xpadder.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\explorer.exe

F:\Downloads\HijackThis.exe

In all cases the important thing was to be sure that im' not infected, and i want to thank you again for helping find out that im' not.

I hope to solve my problems and post back with the solution if you believe that is necessary, cause i don' think that we have a virus case here.

[Maniac]

Your system is clean for sure. I'm not so sure.

How old is your hardware configuration? Are you sure that Windows 7 is for your hardware configuration? Do you have license for Windows 7?

[Priapos]

Your system is clean for sure. I'm not so sure.

That was quite confusing. Are you sure or not?

How old is your hardware configuration? Are you sure that Windows 7 is for your hardware configuration? Do you have license for Windows 7?

mobo : sis648fx-a

cpu : P4 2,8ghz Northwood

vga : Nvidia 6200 agp

ram : 2gb DRR 400

hdd : 2XSeagate Barracuda 80gb (IDE)

psu : Corsair 400W

sound card : Xonar D1

The system can handle more than better windows 7 for the things that i want it for. Net browsing and listening to music. I had no issues from January that i installed windows 7 (licensed and fully updated).

I discovered that my hardware interrupts and DPCs are caused by NDIS.sys. That's why i uninstalled my lan drivers but windows update did not found an adeguate driver for my lan. The strange thing is that back in January, windows update did the same job for me without any problems. As a next step i decided to disable lan from bios, and connect my modem with usb. Unfortunately the hardware interrupts and DPCs are again present and causing spikes of cpu usage. This time was dxdiagkernl thats i why i updated (the up to date btw) directx with no luck again. I disabled almost everything (one by one) from the device manager with no succes. I installed every small hotfix i found from Microsoft (ex. usb related). I disabled aero. I made experiments by disabling and re-enabling various services. Nothing helped.

I will troubleshoot a bit further if my imagination helps me, and then i will go with the format option and if the problem persists i guess i have to do a small upgrade.

[Maniac]

That was quite confusing. Are you sure or not?

I mean about your problem with CPU. I'm sure.

Maybe you should contact Microsoft Support to help you about that, because your system is clean, that's my job.

http://support.microsoft.com/?ln=en

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!