Combofix freezes at the screen just after it says scanning for infected files but before Completed Stage 1 should appear. If I look at the running processes, the combofix process (in this case rmbr.cfxxe) is using about 50% of the CPU and System Idle the other 50%. I cannot end the process and only a hard shutdown will stop it. Running it from safemode has the same result. I tried stopping every other process before running combofix and also after combofix was already frozen (or busy a better word?). I have disabled the antivirus beforehand.
I ran gmer while in safe mode and here are those results (below). Running the most recent version of GMER froze just like combofix. I ran it from the Live CD and it found nothing.
I suspect combofix is fighting whatever is infecting my computer. Actually I should say I suspect I'm infected because someone gets my login name to one of my servers soon after I change it, and causes that account to be locked from too many failed login attempts. So I'm assuming I'm infected but no program has found anything and have nothing else suspicious going on. I have scanned with both malwarebytes and superantispyware. I booted from a live CD and scanned with superantispyware but nothing found.
Thanks
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-12-24 19:06:17
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\ERICB~1.BIO\LOCALS~1\Temp\kwtiyuob.sys
---- System - GMER 1.0.15 ----
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF766787E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF7667BFE]
---- Kernel code sections - GMER 1.0.15 ----
? C:\DOCUME~1\ERICB~1.BIO\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !
? C:\ComboFix\mbr.sys The system cannot find the file specified. !
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)
Device ACPI.sys (ACPI Driver for NT/Microsoft Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 timntr.sys (TrueImage Backup Archive Explorer/Acronis)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20@RefCount 1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
---- EOF - GMER 1.0.15 ----
Edit: Moved topic from XP to the more appropriate forum. ~ Animal