BleepingComputer.com: winrscmde Keeps Coming Back

Need help removing this process... and yes, I know the dif between it and the legit svchost

Within Task Manager, a svchost.exe process keeps generating with a description of 'winrscmde' instead of Host Process For Windows Services. It was sucking up 600k of my RAM and my internet speed went to pot. My BullGuard firewall log shows that process is sending massive traffic out to misc sites. I've blocked it via the firewall and have tried at least a dozen times to remove it via Malwarebytes (it finds it, IDs it as a Trojan) but it comes back every time I tell it to delete it (and after the subsequent restart). I've even tried it in Safe Mode with the same results. My BullGuard AV portion doesn't even find it.

I've tried to System Restore to a prior point, but it's still there. I've also tried to physically delete the file it specifies in c:\windows. No joy - it returns after reboot.

Here is the log that a Malwarebytes quick scan produces after I tell it to remove the Trojan.
______________________________________________________________________________________________
______________________________________________________________________________________________

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7961

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10/16/2011 3:50:35 PM
mbam-log-2011-10-16 (15-50-35).txt

Scan type: Quick scan
Objects scanned: 195494
Time elapsed: 5 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

______________________________________________________________________________________________________________________
______________________________________________________________________________________________________________________

Here is the Malwarebytes log from the full scan:

______________________________________________________________________________________________________________________

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7961

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10/16/2011 6:05:37 PM
mbam-log-2011-10-16 (18-05-37).txt

Scan type: Full scan (C:\|)
Objects scanned: 453082
Time elapsed: 2 hour(s), 1 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

This post has been edited by target_dummy: 16 October 2011 - 05:08 PM

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

Hello, you may have a rootkit affecting your svchost.exe.
Lets take a quick look...
Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:

• Flush DNS
  
• Report IE Proxy Settings
  
• Reset IE Proxy Settings
  
• Report FF Proxy Settings
  
• Reset FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List Winsock Entries
  
• List last 10 Event Viewer log
  
• List Installed Programs
  
• List Users, Partitions and Memory size.
  
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.




Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (v2.6.4.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these[/color] instructions. [color=green]In some cases it may be necessary to redownload TDSSKiller and randomly rename it before downloading and saving to the computer.

Note: I removed some info such as the name of my machine, IP, and the name of my network for privacy purposes. It doesn't affect anything in this issue.

Ok,course of events:

1) Downloaded both MiniToolBox and tdsskiller to my desktop.
2) Ran MiniToolBox with the appropriate boxes checked and got the log below.
3) Ran tdsskiller and it identified rootkit.boot.pihar.b device\harddisk0\DR0
4) Selected Cure and rebooted.
5) Rebooted and saw that the Task Manager task was gone.
6) Ran MalwareBtyes Quick Sacn and it found the same windows\svchost.exe trojan.
7) Told MalwareBytes to delete the trojan and rebooted as instructed.
8) Rebooted and could not find the task in the Task Manager.
9) Ran MalwareBytes Quick Scan and no malicious items were found.
10) Rebooted again and it found nothing in Task Manager and in MalwareBytes.

I'm cautiously calling this one solved! Thanks!!!!!



MiniToolBox by Farbar
Ran by j (administrator) on 17-10-2011 at 18:01:12
Windows 7 Home Premium (X64)

***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================



========================= IP Configuration: ================================

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . :
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . :

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
Physical Address. . . . . . . . . : 68-B5-99-63-0C-1F
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . :

(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.52(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, October 17, 2011 6:00:42 PM
Lease Expires . . . . . . . . . . : Thursday, October 20, 2011 6:00:41 PM
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . :
DHCPv6 Client DUID. . . . . . . . :

0C-1F
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.earthlink.net:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . :

(Preferred)
Link-local IPv6 Address . . . . . :

(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.bsc.disney.com:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: UnKnown
Address: 192.168.0.1

Name: google.com
Addresses: 72.14.204.105
72.14.204.147
72.14.204.104
72.14.204.103
72.14.204.99


Pinging google.com [72.14.204.99] with 32 bytes of data:
Reply from 72.14.204.99: bytes=32 time=50ms TTL=49
Reply from 72.14.204.99: bytes=32 time=46ms TTL=49

Ping statistics for 72.14.204.99:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 46ms, Maximum = 50ms, Average = 48ms
Server: UnKnown
Address: 192.168.0.1

Name: yahoo.com
Addresses: 67.195.160.76
72.30.2.43
98.137.149.56
98.139.180.149
209.191.122.70


Pinging yahoo.com [98.137.149.56] with 32 bytes of data:
Reply from 98.137.149.56: bytes=32 time=96ms TTL=49
Reply from 98.137.149.56: bytes=32 time=90ms TTL=49

Ping statistics for 98.137.149.56:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 90ms, Maximum = 96ms, Average = 93ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time=2ms TTL=128
Reply from 127.0.0.1: bytes=32 time=1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 2ms, Average = 1ms
===========================================================================
Interface List
12...c0 cb 38 73 2d 95 ......Broadcom 4313 802.11b/g/n
11...68 b5 99 63 0c 1f ......Realtek PCIe FE Family Controller
1...........................Software Loopback Interface 1
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.52 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.52 276
192.168.0.52 255.255.255.255 On-link 192.168.0.52 276
192.168.0.255 255.255.255.255 On-link 192.168.0.52 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.52 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.52 276
===========================================================================
Persistent Routes:
None


Persistent Routes:
None
========================= Winsock entries

=====================================

Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [51712] (Microsoft Corporation)
Catalog5 02 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 07 C:\Windows\SysWOW64\wshbth.dll [35840] (Microsoft Corporation)
Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows

Live\WLIDNSP.DLL [134528] (Microsoft Corporation)
Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows

Live\WLIDNSP.DLL [134528] (Microsoft Corporation)
Catalog5 10 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Catalog9 01 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 02 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 03 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 04 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 05 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 06 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 07 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 08 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 09 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 10 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 11 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
Catalog9 12 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 13 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 14 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 15 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 16 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 17 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 18 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 19 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 20 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 21 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 22 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 23 C:\Windows\SysWOW64\BGLsp.dll [155992] (BullGuard Ltd.)
x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70144] (Microsoft

Corporation)
x64-Catalog5 02 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog5 03 C:\Windows\System32\winrnr.dll [28672] (Microsoft

Corporation)
x64-Catalog5 04 C:\Windows\System32\napinsp.dll [68096] (Microsoft

Corporation)
x64-Catalog5 05 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft

Corporation)
x64-Catalog5 06 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft

Corporation)
x64-Catalog5 07 C:\Windows\System32\wshbth.dll [46592] (Microsoft

Corporation)
x64-Catalog5 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live

\WLIDNSP.DLL [168304] (Microsoft Corporation)
x64-Catalog5 09 C:\Program Files\Common Files\Microsoft Shared\Windows Live

\WLIDNSP.DLL [168304] (Microsoft Corporation)
x64-Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [193824] (Apple Inc.)
x64-Catalog9 01 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 02 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 03 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 04 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 05 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 06 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 07 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 08 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 09 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 10 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 11 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)
x64-Catalog9 12 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 13 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 14 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 15 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 16 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 17 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 18 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 19 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 20 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 21 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 22 C:\Windows\System32\mswsock.dll [320000] (Microsoft

Corporation)
x64-Catalog9 23 C:\Windows\System32\BGLsp.dll [180056] (BullGuard Ltd.)

========================= Event log errors: ===============================

Application errors:
==================
Error: (10/17/2011 08:35:33 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/16/2011 00:26:59 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/16/2011 09:49:25 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: The Cryptographic Services service failed to initialize the VSS

backup "System Writer" object.

Details:
Could not query the status of the

EventSystem service.

System Error:
A system shutdown is in progress.
.

Error: (10/14/2011 02:17:59 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/14/2011 02:17:58 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/14/2011 02:17:58 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/13/2011 06:44:30 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/12/2011 09:47:22 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/11/2011 09:48:14 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.

Error: (10/11/2011 08:07:37 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error

in manifest or policy file

"WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on

line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Component identity found in manifest does not match the identity of the

component requested.
Reference is

WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition is

WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (10/17/2011 10:22:53 AM) (Source: Service Control Manager) (User: )
Description: The Adobe Acrobat Update Service service terminated

unexpectedly. It has done this 1 time(s).

Error: (10/17/2011 07:47:06 AM) (Source: EventLog) (User: )
Description: The previous system shutdown at 10:27:44 PM on ?10/?16/?2011 was

unexpected.

Error: (10/16/2011 07:23:05 PM) (Source: Service Control Manager) (User: )
Description: The Adobe Acrobat Update Service service terminated

unexpectedly. It has done this 1 time(s).

Error: (10/16/2011 07:20:54 PM) (Source: EventLog) (User: )
Description: The previous system shutdown at 6:43:01 PM on ?10/?16/?2011 was

unexpected.

Error: (10/16/2011 06:21:12 PM) (Source: EventLog) (User: )
Description: The previous system shutdown at 6:19:56 PM on ?10/?16/?2011 was

unexpected.

Error: (10/16/2011 00:51:27 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location

Awareness service which failed to start because of the following error:
%%1068

Error: (10/16/2011 00:48:47 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location

Awareness service which failed to start because of the following error:
%%1068

Error: (10/16/2011 00:48:47 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location

Awareness service which failed to start because of the following error:
%%1068

Error: (10/16/2011 00:48:47 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location

Awareness service which failed to start because of the following error:
%%1068

Error: (10/16/2011 00:48:47 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location

Awareness service which failed to start because of the following error:
%%1068


Microsoft Office Sessions:
=========================

=========================== Installed Programs ============================

Update for Microsoft Office 2007 (KB2508958)
Acrobat.com (Version: 1.6.65)
ActiveCheck component for HP Active Support Library (Version: 3.0.0.3)
Adobe AIR (Version: 2.6.0.19140)
Adobe Flash Player 10 ActiveX (Version: 10.1.102.64)
Adobe Flash Player 10 Plugin (Version: 10.3.183.7)
Adobe Reader X (10.1.1) (Version: 10.1.1)
Adobe Shockwave Player 11.5 (Version: 11.5.7.609)
Amazon Kindle
Apple Application Support (Version: 1.4.1)
Apple Mobile Device Support (Version: 3.3.0.69)
Apple Software Update (Version: 2.1.2.120)
ATI Catalyst Install Manager (Version: 3.0.778.0)
Battlefield 2™
Bonjour (Version: 2.0.4.0)
Broadcom 802.11 Wireless LAN Adapter (Version: 5.60.350.6)
BullGuard (Version: 10)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version:

2010.0621.2137.36973)
Catalyst Control Center Graphics Previews Vista (Version:

2010.0621.2137.36973)
Catalyst Control Center InstallProxy (Version: 2010.0621.2137.36973)
Catalyst Control Center Localization All (Version: 2010.0621.2137.36973)
ccc-core-static (Version: 2010.0621.2137.36973)
ccc-utility64 (Version: 2010.0621.2137.36973)
CCC Help Chinese Standard (Version: 2010.0621.2136.36973)
CCC Help Chinese Traditional (Version: 2010.0621.2136.36973)
CCC Help Czech (Version: 2010.0621.2136.36973)
CCC Help Danish (Version: 2010.0621.2136.36973)
CCC Help Dutch (Version: 2010.0621.2136.36973)
CCC Help English (Version: 2010.0621.2136.36973)
CCC Help Finnish (Version: 2010.0621.2136.36973)
CCC Help French (Version: 2010.0621.2136.36973)
CCC Help German (Version: 2010.0621.2136.36973)
CCC Help Greek (Version: 2010.0621.2136.36973)
CCC Help Hungarian (Version: 2010.0621.2136.36973)
CCC Help Italian (Version: 2010.0621.2136.36973)
CCC Help Japanese (Version: 2010.0621.2136.36973)
CCC Help Korean (Version: 2010.0621.2136.36973)
CCC Help Norwegian (Version: 2010.0621.2136.36973)
CCC Help Polish (Version: 2010.0621.2136.36973)
CCC Help Portuguese (Version: 2010.0621.2136.36973)
CCC Help Russian (Version: 2010.0621.2136.36973)
CCC Help Spanish (Version: 2010.0621.2136.36973)
CCC Help Swedish (Version: 2010.0621.2136.36973)
CCC Help Thai (Version: 2010.0621.2136.36973)
CCC Help Turkish (Version: 2010.0621.2136.36973)
CCleaner (Version: 3.09)
Citrix Presentation Server Client - Web Only (Version: 10.100.55836)
Creative Memories Memory Manager 2 (Version: 2.0)
Creative Memories Memory Manager 3 (Version: 3.0)
Creative Memories StoryBook Creator Plus (Version: 2.0)
Creative Memories StoryBook Creator Plus 3 (Version: 3.0)
CyberLink DVD Suite (Version: 7.0.3003)
CyberLink MediaShow (Version: 5.0.1616)
CyberLink PowerDVD 9 (Version: 9.0.1.4217)
CyberLink YouCam (Version: 3.0.2511)
DarkCrusade (Version: 1.20)
Dawn of War - Soulstorm (Version: 1.00.0000)
Energy Star Digital Logo (Version: 1.0.1)
ESU for Microsoft Windows 7 (Version: 1.0.0)
Google Earth (Version: 6.0.3.2197)
Google Update Helper (Version: 1.3.21.69)
Guild Wars
HP Customer Experience Enhancements (Version: 6.0.1.4)
HP Game Console
HP Games (Version: 1.0.1.3)
HP MediaSmart CinemaNow 2.0 (Version: 2.0)
HP Photo Creations (Version: 1.0.0.3611)
HP Power Manager (Version: 1.0.3)
HP Quick Launch (Version: 2.1.5)
HP Setup (Version: 8.1.4186.3400)
HP Software Framework (Version: 3.5.23.1)
HP Wireless Assistant (Version: 4.0.9.0)
HPAsset component for HP Active Support Library (Version: 3.0.0.3)
i2 ChartReader 8 (Version: 8.5.1)
Intel® Control Center (Version: 1.2.1.1007)
Intel® Management Engine Components (Version: 6.0.0.1179)
Intel® Rapid Storage Technology (Version: 9.6.2.1001)
iTunes (Version: 10.1.1.4)
Java Auto Updater (Version: 2.0.2.4)
Java™ 6 Update 20 (64-bit) (Version: 6.0.200)
Java™ 6 Update 22 (Version: 6.0.220)
Joint Operations: Typhoon Rising (Version: 1.00.0000)
Junk Mail filter update (Version: 14.0.8117.416)
LabelPrint (Version: 2.5.2907)
Logitech Harmony Remote Software 7 (Version: 7.7.0.0)
Malwarebytes' Anti-Malware version 1.51.2.1300 (Version: 1.51.2.1300)
Memory Manager 3 Service Update (Version: 1.00.0000)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft IntelliPoint 8.0 (Version: 8.0.225.0)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2010 (Version: 14.0.4763.1000)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version:

12.0.6425.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6425.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office FrontPage 2003 (Version: 11.0.8173.0)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version:

12.0.6425.1000)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6425.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version:

12.0.6425.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version:

12.0.6425.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Silverlight (Version: 4.0.60531.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version:

8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570

(Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

(Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version:

9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version:

9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version:

9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version:

9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version:

9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version:

9.0.30729.6161)
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
Mozilla Firefox 7.0 (x86 en-US) (Version: 7.0)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Penguins! (Version: 2.2.0.95)
PhotoNow! (Version: 1.1.6904)
Power2Go (Version: 6.1.4204)
PowerDirector (Version: 8.0.3003)
PX Profile Update (Version: 1.00.1.)
QuickTime (Version: 7.69.80.9)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealPlayer
Realtek Ethernet Controller Driver For Windows 7 (Version: 7.21.531.2010)
Realtek High Definition Audio Driver (Version: 6.0.1.6066)
Realtek USB 2.0 Card Reader (Version: 6.1.7600.30105)
RealUpgrade 1.1 (Version: 1.1.0)
Recovery Manager (Version: 5.5.3023)
Remote Control USB Driver (Version: 2.3.2.317)
Rome - Total War™ (Version: 1.0)
Roxio CinemaNow 2.0 (Version: 1.0.278)
RtVOsd (Version: 1.0.3)
Sid Meier's Civilization 4 (Version: 1.00.0000)
Sid Meier's Civilization 4 (Version: 1.61)
Skype Toolbars (Version: 5.5.7896)
Skype™ 5.3 (Version: 5.3.120)
Star Wars Battlefront II (Version: 1.0)
StarCraft II (Version: 1.3.6.19269)
Steam (Version: 1.0.0.0)
Synaptics Pointing Device Driver (Version: 15.0.17.0)
Team Fortress 2
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2509470)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2586924)
Warhammer 40,000: Dawn Of War - Platinum Edition (Version: 1.51)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Movie Maker (Version: 14.0.8117.0416)
Windows Live Photo Gallery (Version: 14.0.8117.416)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8117.0416)
World of Tanks v.0.6.6

========================= Memory info: ===================================

Percentage of memory in use: 35%
Total physical RAM: 3893.86 MB
Available physical RAM: 2524.74 MB
Total Pagefile: 7785.86 MB
Available Pagefile: 6274.84 MB
Total Virtual: 4095.88 MB
Available Virtual: 3965.94 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:215.46 GB) (Free:70.8 GB) NTFS
2 Drive d: (RECOVERY) (Fixed) (Total:17.13 GB) (Free:2.48 GB) NTFS
3 Drive e: (CIV4DISK2) (CDROM) (Total:0.63 GB) (Free:0 GB) CDFS

========================= Users: ========================================

User accounts for \\LT

Administrator Guest j
L

========================= Minidump Files ==================================

No minidump file found

**** End of log ****

This post has been edited by target_dummy: 17 October 2011 - 05:50 PM

Hello, yes this what I suspected...identified rootkit.boot.pihar.b

Please run one last scan and be sure there is nothing left.

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check and check Remove found threats
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

NOTE: In some instances if no malware is found there will be no log produced.

 target_dummy, on 17 October 2011 - 05:48 PM, said:

Tried your steps and they've seemed to work for me also. I'm running the Malwarebytes scan now just to be sure.

OK,post hat log and update us.