BleepingComputer.com: Malware Takes Over Computer 10 Secs After Bootup

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Intel Corporation
BIOS Manufacturer: Phoenix Technologies LTD
System Manufacturer: TOSHIBA
System Product Name: Satellite A205
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 154):
0x82043000 \SystemRoot\system32\ntkrnlpa.exe
0x82010000 \SystemRoot\system32\hal.dll
0x80603000 \SystemRoot\system32\kdcom.dll
0x8060A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8067A000 \SystemRoot\system32\PSHED.dll
0x8068B000 \SystemRoot\system32\BOOTVID.dll
0x80693000 \SystemRoot\system32\CLFS.SYS
0x806D4000 \SystemRoot\system32\CI.dll
0x82601000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8267D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8268A000 \SystemRoot\system32\drivers\acpi.sys
0x826D0000 \SystemRoot\system32\drivers\WMILIB.SYS
0x826D9000 \SystemRoot\system32\drivers\msisadrv.sys
0x826E1000 \SystemRoot\system32\drivers\pci.sys
0x82708000 \SystemRoot\System32\drivers\partmgr.sys
0x82717000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8271A000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x82724000 \SystemRoot\system32\drivers\volmgr.sys
0x82733000 \SystemRoot\System32\drivers\volmgrx.sys
0x8277D000 \SystemRoot\system32\drivers\intelide.sys
0x82784000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x82792000 \SystemRoot\system32\DRIVERS\pcmcia.sys
0x827BF000 \SystemRoot\System32\drivers\mountmgr.sys
0x827CF000 \SystemRoot\system32\drivers\atapi.sys
0x827D7000 \SystemRoot\system32\drivers\ataport.SYS
0x807B4000 \SystemRoot\system32\drivers\fltmgr.sys
0x807E6000 \SystemRoot\system32\drivers\fileinfo.sys
0x827F5000 \SystemRoot\System32\Drivers\FSPFltd.sys
0x82C09000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82C7B000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x82C84000 \SystemRoot\system32\drivers\ndis.sys
0x82D8F000 \SystemRoot\system32\drivers\msrpc.sys
0x82DBA000 \SystemRoot\system32\drivers\NETIO.SYS
0x82E0C000 \SystemRoot\System32\drivers\tcpip.sys
0x82EF9000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8820B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8831B000 \SystemRoot\system32\drivers\volsnap.sys
0x88354000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
0x88359000 \SystemRoot\System32\Drivers\spldr.sys
0x88361000 \SystemRoot\System32\Drivers\mup.sys
0x88370000 \SystemRoot\System32\drivers\ecache.sys
0x88397000 \SystemRoot\system32\drivers\disk.sys
0x883A8000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x883C9000 \SystemRoot\system32\drivers\crcdisk.sys
0x883F2000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x88200000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x82F14000 \SystemRoot\system32\DRIVERS\FwLnk.sys
0x82F1C000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x82F2B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8BC0C000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8C2C7000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C367000 \SystemRoot\System32\drivers\watchdog.sys
0x8C373000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x82F2F000 \SystemRoot\system32\DRIVERS\yk60x86.sys
0x8C60C000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
0x8C995000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C9A0000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8C9DE000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C9ED000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x82F68000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x82F76000 \SystemRoot\system32\drivers\tifm21.sys
0x82FC2000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x82FDC000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8C600000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8CA05000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8CA35000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CA37000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8CA42000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0x8CA46000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8CA5E000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8CA8D000 \SystemRoot\system32\DRIVERS\storport.sys
0x8CACE000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8CAD9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8CAF0000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8CAFB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8CB1E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8CB2D000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8CB41000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8CB56000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8CB66000 \SystemRoot\system32\DRIVERS\VClone.sys
0x8CB72000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x8CB98000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8CB9A000 \SystemRoot\system32\DRIVERS\ks.sys
0x8CBC4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8CBCE000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8CE00000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8CE35000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8CE46000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8D00E000 \SystemRoot\system32\drivers\portcls.sys
0x8D03B000 \SystemRoot\system32\drivers\drmk.sys
0x8D060000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0x8D17C000 \SystemRoot\system32\drivers\modem.sys
0x8D189000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0x8D1B0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8D1B9000 \SystemRoot\System32\Drivers\Null.SYS
0x8D1C0000 \SystemRoot\System32\Drivers\Beep.SYS
0x8D1C7000 \SystemRoot\System32\drivers\vga.sys
0x8D1D3000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D1F4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D000000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8CFEE000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8CBDB000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8CBE9000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D409000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D41F000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D433000 \SystemRoot\system32\drivers\afd.sys
0x8D47B000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D4AD000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x8D4B6000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D4CC000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D4DA000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D4ED000 \SystemRoot\System32\Drivers\SCDEmu.SYS
0x8D4FB000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D537000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D541000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x8D54B000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D562000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8D579000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8D582000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8D592000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8D599000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8D5A1000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8D5AE000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8D5B9000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x8D5C1000 \SystemRoot\system32\DRIVERS\UVCFTR_S.SYS
0x8D5CA000 \SystemRoot\System32\Drivers\usbvideo.sys
0x96820000 \SystemRoot\System32\win32k.sys
0x8D5EB000 \SystemRoot\System32\drivers\Dxapi.sys
0x883D2000 \SystemRoot\system32\DRIVERS\monitor.sys
0x96A40000 \SystemRoot\System32\TSDDD.dll
0x96A60000 \SystemRoot\System32\cdd.dll
0xA860F000 \SystemRoot\system32\drivers\luafv.sys
0xA8632000 \SystemRoot\system32\drivers\spsys.sys
0xA86E2000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA86F2000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xA871C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA8726000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA8739000 \SystemRoot\system32\drivers\HTTP.sys
0xA87A6000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA87BF000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA87D4000 \SystemRoot\system32\drivers\mrxdav.sys
0xACE08000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xACE27000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xACE60000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xACE90000 \SystemRoot\system32\drivers\peauth.sys
0xACF6E000 \SystemRoot\System32\Drivers\secdrv.SYS
0xACF78000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xACF95000 \SystemRoot\System32\drivers\tcpipreg.sys
0xACFA1000 \SystemRoot\System32\DRIVERS\srv2.sys
0xB1409000 \SystemRoot\System32\DRIVERS\srv.sys
0xB1458000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xB146E000 \??\C:\Windows\system32\Drivers\PROCEXP151.SYS
0xB1479000 \SystemRoot\system32\DRIVERS\MpNWMon.sys
0x77620000 \Windows\System32\ntdll.dll

Processes (total 52):
0 System Idle Process
4 System
584 C:\Windows\System32\smss.exe
724 csrss.exe
768 C:\Windows\System32\wininit.exe
780 csrss.exe
812 C:\Windows\System32\services.exe
840 C:\Windows\System32\winlogon.exe
856 C:\Windows\System32\lsass.exe
868 C:\Windows\System32\lsm.exe
1012 C:\Windows\System32\svchost.exe
1056 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
1104 C:\Windows\System32\svchost.exe
1144 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
1272 C:\Windows\System32\svchost.exe
1304 C:\Windows\System32\svchost.exe
1332 C:\Windows\System32\svchost.exe
1424 C:\Windows\System32\audiodg.exe
1440 C:\Windows\System32\svchost.exe
1460 C:\Windows\System32\SLsvc.exe
1552 C:\Windows\System32\svchost.exe
1684 C:\Windows\System32\svchost.exe
1960 C:\Windows\System32\spoolsv.exe
2008 C:\Windows\System32\svchost.exe
764 C:\Windows\System32\dwm.exe
1088 C:\Windows\System32\taskeng.exe
1412 C:\Windows\explorer.exe
604 C:\Windows\System32\taskeng.exe
684 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1532 C:\Program Files\My Lockbox\mylbx.exe
2052 C:\Program Files\Microsoft Security Client\msseces.exe
2068 C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
2140 C:\Windows\ehome\ehtray.exe
2616 C:\Windows\System32\svchost.exe
2656 C:\Windows\System32\svchost.exe
2708 C:\Windows\System32\TODDSrv.exe
2736 C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
2828 C:\Windows\System32\svchost.exe
2848 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
3228 C:\Windows\ehome\ehmsas.exe
3412 C:\Windows\System32\wbem\unsecapp.exe
3740 WmiPrvSE.exe
3884 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2060 C:\Program Files\Windows Media Player\wmpnscfg.exe
2168 C:\Program Files\Windows Media Player\wmpnetwk.exe
272 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
3852 C:\Windows\System32\svchost.exe
3640 C:\Windows\System32\svchost.exe
1540 C:\Program Files\Synaptics\SynTP\SynToshiba.exe
2380 C:\Windows\System32\taskeng.exe
1328 taskeng.exe
3544 C:\Users\User\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541616J9SA00, Rev: SB4OC7DP

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: BBAD517F7EAC529451E4B9586C847AE190574F61


Done!

Hello


I don't think this is a malware issue. If you go here you will see a program that will help you find which one is causing it. - http://www.bleepingcomputer.com/forums/topic354690.html

there is a learning curve to it and I have not used it so I don't have any instructions for it



TFC(Temp File Cleaner):

• Please download TFC to your desktop,
  
• Save any unsaved work. TFC will close all open application windows.
  
• Double-click TFC.exe to run the program.
  
• If prompted, click "Yes" to reboot.

Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

: Malwarebytes' Anti-Malware :

Please download Malwarebytes' Anti-Malware to your desktop.


• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
    
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  
  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

• Go Here to download HijackThis Installer
  
• Save HijackThis Installer to your desktop.
  
• Double-click on the HijackThis Installer icon on your desktop. (Vista and Win 7 right click and run as admin)
  
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
  
• Click on Install.
  
• It will create a HijackThis icon on the desktop.
  
• Once installed it will launch Hijackthis.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  
• Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
  
• Come back here to this thread and Paste the log in your next reply.
  
• DO NOT use the AnalyseThis button its findings are dangerous if misinterpreted.
  
• DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

NOTE**
sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe
(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit
(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit
and select to run as administrator

"information and logs"

In your next post I need the following


• Log From MBAM
  
• report from Hijackthis
  
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.03.11

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
User :: USER-PC [administrator]

2/3/2012 9:46:08 PM
mbam-log-2012-02-03 (21-46-08).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 168989
Time elapsed: 5 minute(s), 48 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:02:31 PM, on 2/3/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskeng.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\My Lockbox\mylbx.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe /a
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

--
End of file - 3758 bytes

HiJack This encountered two errors. I tried to copy details but it would not let me. After closing the error window the program completed.

The computer's hard drive seems to be running lots more, not just at start up. But CPU usage is only high at start-up.

What next?

Greetings

These logs are looking very good, we are almost done!!! Just one more scan to go.

:Remove unneeded start-up entries:

This part of the fix is purely optional
These are programs that start up when you turn on your computer but don't need to be, any of these programs you can click on their icons (or start from the control panel) and start the program when you need it. By stopping these programs you will boot up faster and your computer will work faster.

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

• Run HijackThis
  
• Click on the Scan button
  
• Put a check beside all of the items listed below (if present):
  
  
  O4 - HKLM\..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe /a
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
  
  
  
  
• Close all open windows and browsers/email, etc...
  
• Click on the "Fix Checked" button
  
• When completed, close the application.
  
  
  NOTE**You can research each of those lines >here< and see if you want to keep them or not
  just copy the name between the brackets and paste into the search space
  O4 - HKLM\..\Run: [IntelliPoint]

NOTE**
sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe
(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit
(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit
and select to run as administrator

Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go Eset web page to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
  
• click on the ESET Online Scanner button
  
• Tick the box next to YES, I accept the Terms of Use.
  
  • Click Start
• When asked, allow the ActiveX control to install
  
  • Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  
• Click on Advanced Settings, ensure the options
  
  Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
  
• Wait for the scan to finish
  
• Click on copy to clipboard and paste the results here in this topic
  
• you may also find here C:\Program Files\Eset\Eset Online Scanner\log.txt

Copy and paste that log as a reply to this topic

Good Morning Gringo,

First thanks for giving me so much of your time on this problem.

I can tell you are pulling methods from your vast experience and I appreciate your efforts.

ESET ran VERY slow. I watched it till after midnight and it appeared it still had a long way to go.

When I got up this morning it had finished but found nothing. Here is the log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=5373364debb8f64ca8511fa559de448b
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-02-04 07:04:32
# local_time=2012-02-04 02:04:32 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 1401856 1401856 0 0
# compatibility_mode=5892 16776574 100 100 17281600 164933866 0 0
# compatibility_mode=8192 67108863 100 0 288747 288747 0 0
# scanned=209830
# found=0
# cleaned=0
# scan_time=12733

Very well done!! This is my general post for when your logs show no more signs of malware - Please let me know if you still are having problems with your computer and what these problems are.


The following procedure will implement some cleanup procedures. It will also reset your System Restore by flushing out previous restore points and create a new restore point. It will also remove all the backups our tools may have made.

Any programs and logs that are left over you can just be deleted from the desktop. TFC is a free temp file cleaner that is very easy to use, I would keep this and use before you do any scans or when you want to free up some space.

:DeFogger:

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
  
• Click the Re-enable button to re-enable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger will now ask to reboot the machine - click OK

Your Emulation drivers are now re-enabled.

:Uninstall ComboFix:

• turn off all active protection software
  
• push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  
• please copy and past the following into the box ComboFix /Uninstall and click OK.
  
• Note the space between the X and the /Uninstall, it needs to be there.
  
• 

:remove tools:

Please download OTCleanIt and save it to desktop. This tool will remove all the tools we used to clean your pc.

• Double-click OTCleanIt.exe.
  
• Click the CleanUp! button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes, if not delete it by yourself.
  
• If asked to restart the computer, please do so

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.


:Make your Internet Explorer more secure:

• From within Internet Explorer click on the Tools menu and then click on Options.
  
• Click once on the Security tab
  
• Click once on the Internet icon so it becomes highlighted.
  
• Click once on the Custom Level button.
  
• Change the Download signed ActiveX controls to Prompt
  
• Change the Download unsigned ActiveX controls to Disable
  
• Change the Initialise and script ActiveX controls not marked as safe to Disable
  
• Change the Installation of desktop items to Prompt
  
• Change the Launching programs and files in an IFRAME to Prompt
  
• When all these settings have been made, click on the OK button.
  
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
  Next press the Apply button and then the OK to exit the Internet Properties page.

:Make Firefox more secure:

please visit this page to explain how to make Firefox more secure - How to Secure Firefox

Make sure your applications have all of their updates

It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector


:Turn On Automatic Updates:

Turn On Automatic Updates
1. Click Start, click Run, type sysdm.cpl, and then press ENTER.
2. Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended) Automatically download recommended updates for my computer and install them

If you click this setting, click to select the day and time for scheduled updates to occur. You can schedule Automatic Updates for any time of day. Remember, your computer must be on at the scheduled time for updates to be installed. After you set this option, Windows recognizes when you are online and uses your Internet connection to find updates on the Windows Update Web site or on the Microsoft Update Web site that apply to your computer. Updates are downloaded automatically in the background, and you are not notified or interrupted during this process. An icon appears in the notification area of your taskbar when the updates are being downloaded. You can point to the icon to view the download status. To pause or to resume the download, right-click the icon, and then click Pause or Resume. When the download is completed, another message appears in the notification area so that you can review the updates that are scheduled for installation. If you choose not to install at that time, Windows starts the installation on your set schedule.

or visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

:antispyware programs:

I would reccomend the download and installation of some or all of the following programs (all free), and the updating of them regularly:

• WinPatrol As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
  
  
• Spyware Blaster - By altering your registry, this program stops harmful sites from installing things like ActiveX Controls on your machines.
  
  
• Malwarebytes' Anti-Malware Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
  totally free but for real-time protection you will have to pay a small one-time fee. We used this to help clean your computer and recomend keeping it and using often.

Here is some great reading about how to be safer online:

PC Safety and Security - What Do I Need? from my friends at Tech Support Forum
and
COMPUTER SECURITY - a short guide to staying safer online from my friends at Malware Removal

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.

I Will Keep This Open For About Three Days, If Anything Comes Up - Just Come Back And Let Me Know, after that time you will have to send me a PM

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here --><-- Don't worry every little bit helps.

Gringo

OK Gringo. I will do as you suggest and reply when finished.

OK Gringo,

I did everything you suggested.

Then I did a clean shutdown and then start.

and......

Lo and behold it still had the exact very high CPU and HD activity.

In fact after about 10 minutes I captured the activity via Process Explore.

Two processes are the long term offenders ID 4 System and ID 1336 SVChost.exe "H Host Process for Windows Services"

I can attach a screen capture of Process Explorer if that would help.

Any ideas before you cut me loose?

Right now I don't have any ideas




sorry


gringo

OK. Well thank you very much for your time and effort.

I guess you can close the topic.

Is there anyway (for security) that the whole 3 pages can be erased?

Best Regards,

NHGuy

Have a drink on me.

Thanks again.

NHGuy (John)

it cant be erased but I can remove any info you think should be removed

Only if you feel some of the scan present a security/privacy risk.

I'll leave it to your good judgement.

Thanks Again and enjoy the Super Bowl.

Hello

working tonight but taping it.

there is nothing that can get to your computer - but some people ask to remove user names and such if it is a office computer