[SOLVED] cpu problems

[removed22309]

Hello.

I have a ton of spyware on my computer. At first it was just making my computer run slowly but now I can't even run my computer in normal mode, I get a blue screen and I am forced to restart.

Below is my log. I have attached Attach.zip which contains ark.txt and Attach.txt


DDS (Ver_09-02-01.01) - NTFSx86 NETWORK
Run by Administrator at 15:11:04.84 on Sun 02/22/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_02
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.611 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\windres.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe
C:\Documents and Settings\Administrator\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = http://www.google.com/ig/dell?hl=en&...suk&channel=us
uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
mStart Page = hxxp://www.comcast.net/
mWindow Title = Windows Internet Explorer provided by Comcast
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\temp\init.exe,c:\windows\system32\windres.exe,c:\windows\system32\c++.exe,c:\windows\system32\idaw64.exe,
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: {09ae23a6-d0c2-4539-a5b6-63ac346625e9} - c:\windows\system32\cbXNDUoP.dll
BHO: {9b7125d8-f716-4ad8-bbd3-7b548a429bf2} - c:\windows\system32\vivamuzu.dll
TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - c:\program files\veoh networks\veoh\plugins\reg\VeohToolbar.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [SetDefaultMIDI] MIDIDef.exe
uRun: [Creative Detector] "c:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [Creative MediaSource Go] "c:\program files\creative\mediasource\go\CTCMSGo.exe" /SCB
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRunOnce: [SpybotDeletingB2714] command /c del "c:\program files\mjcore\Mjcore.dll"
uRunOnce: [SpybotDeletingD307] cmd /c del "c:\program files\mjcore\Mjcore.dll"
uRunOnce: [SpybotDeletingB1597] command /c del "c:\windows\system32\efcCstTN.dll_old"
uRunOnce: [SpybotDeletingD8496] cmd /c del "c:\windows\system32\efcCstTN.dll_old"
uRunOnce: [SpybotDeletingB4199] command /c del "c:\program files\webshow\WebShow.dll"
uRunOnce: [SpybotDeletingD6626] cmd /c del "c:\program files\webshow\WebShow.dll"
uRunOnce: [SpybotDeletingB7702] command /c del "c:\program files\icheck\Uninstall.exe"
uRunOnce: [SpybotDeletingD3513] cmd /c del "c:\program files\icheck\Uninstall.exe"
uRunOnce: [SpybotDeletingB8984] command /c del "c:\program files\vnrpack\trgts.gz"
uRunOnce: [SpybotDeletingD396] cmd /c del "c:\program files\vnrpack\trgts.gz"
uRunOnce: [SpybotDeletingB5093] command /c del "c:\program files\vnrpack\VnrPack25.exe"
uRunOnce: [SpybotDeletingD6614] cmd /c del "c:\program files\vnrpack\VnrPack25.exe"
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSCONFIG.EXE /auto
mRun: [vijitadibi] Rundll32.exe "c:\windows\system32\tifagutu.dll",s
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [reader_s] c:\windows\system32\reader_s.exe
mRunOnce: [SpybotDeletingC5805] cmd /c del "c:\program files\vnrpack\VnrPack25.exe"
mRunOnce: [SpybotSnD] "c:\program files\spybot - search & destroy\SpybotSD.exe" /autocheck
mRunOnce: [<NO NAME>]
mRunOnce: [GrpConv] grpconv -o
dRun: [reader_s] c:\documents and settings\mark nussbaum\reader_s.exe
dRun: [services] c:\windows\services.exe
mExplorerRun: [services] c:\windows\services.exe
dExplorerRun: [services] c:\windows\services.exe
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\temp\ntdll64.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
Notify: efccsttn - efcCstTN.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\cbXNDUoP
LSA: Notification Packages = scecli c:\windows\system32\kebozake.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\d0heko68.default\
FF - plugin: c:\program files\mozilla firefox\plugins\npCID.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\veoh networks\veoh\plugins\noreg\NPVeohVersion.dll

============= SERVICES / DRIVERS ===============

R0 protect;protect;c:\windows\system32\drivers\protect.sys [2009-2-22 18944]
S0 aylnlfdx;aylnlfdx;c:\windows\system32\drivers\phqghume.sys [2009-2-22 25088]
S0 cuqvygsd;cuqvygsd;c:\windows\system32\drivers\gzfcosim.sys [2009-2-10 25088]
S0 nthntnfo;nthntnfo;c:\windows\system32\drivers\bqxsaqlf.sys [2009-2-22 25088]
S0 ykmnnmcp;ykmnnmcp;c:\windows\system32\drivers\zuladyxx.sys []
S1 2f404f0d;2f404f0d;c:\windows\system32\drivers\2f404f0d.sys [2009-2-14 99696]
S1 synsend;synsend;\??\c:\windows\system32\drivers\synsenddrv.sys --> c:\windows\system32\drivers\synsenddrv.sys [?]
S2 rlinuxfbt;rlinuxfbt;c:\windows\system32\drivers\jgcnmrpz.sys [2009-2-22 30976]
S3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys --> c:\windows\system32\drivers\BCGAME.SYS [?]
S3 bcgbus;Nostromo USB Device Driver;c:\windows\system32\drivers\bcgbus.sys --> c:\windows\system32\drivers\BCGBUS.SYS [?]
S3 Gpcnidiwfn;Gpcnidiwfn;c:\windows\system32\drivers\arp1394.sys [2004-8-3 60800]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-10-15 38496]
S3 restore;restore;c:\windows\system32\drivers\restore.sys [2009-2-22 6656]
S3 samhid;samhid;c:\windows\system32\drivers\samhid.sys --> c:\windows\system32\drivers\samhid.sys [?]

=============== Created Last 30 ================

2009-02-22 15:04 250 a------- c:\windows\gmer.ini
2009-02-22 14:52 <DIR> --d----- c:\windows\system32\Minidump
2009-02-22 14:33 37,888 a------- c:\windows\system32\1B.tmp
2009-02-22 14:33 30,208 a------- c:\documents and settings\administrator\reader_s.exe
2009-02-22 14:33 64,512 a------- c:\windows\system32\idaw64.exe
2009-02-22 14:33 67,585 a------- c:\windows\system32\19.tmp
2009-02-22 14:32 25,601 a------- c:\windows\system32\17.tmp
2009-02-22 14:32 168 a------- c:\windows\system32\13.tmp
2009-02-22 14:31 406,016 a------- c:\windows\system32\cmd.execf
2009-02-22 14:23 6,656 a------- c:\windows\system32\drivers\restore.sys
2009-02-22 14:15 2,091 a--sh--- c:\windows\system32\PoUDNXbc.ini2
2009-02-22 14:15 2,091 a--sh--- c:\windows\system32\PoUDNXbc.ini
2009-02-22 11:32 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-02-22 11:13 37,376 a------- c:\windows\system32\18.tmp
2009-02-22 11:13 67,585 a------- c:\windows\system32\16.tmp
2009-02-22 11:13 25,601 a------- c:\windows\system32\15.tmp
2009-02-22 11:13 212 a------- c:\windows\system32\F.tmp
2009-02-22 11:11 64,000 a------- c:\windows\system32\windres.exe
2009-02-22 11:11 35,774 a------- c:\windows\system32\14.tmp
2009-02-22 11:11 33,351 a------- c:\windows\system32\drivers\str.sys
2009-02-22 11:11 67,585 a------- c:\windows\system32\12.tmp
2009-02-22 11:11 30,976 a------- c:\windows\system32\drivers\jgcnmrpz.sys
2009-02-22 11:11 25,601 a------- c:\windows\system32\11.tmp
2009-02-22 11:10 212 a------- c:\windows\system32\C.tmp
2009-02-22 06:20 56,321 a------- c:\windows\services.ex_
2009-02-22 06:20 37,888 -------- c:\windows\system32\10.tmp
2009-02-22 06:20 67,585 a------- c:\windows\system32\E.tmp
2009-02-22 06:20 168 a------- c:\windows\system32\A.tmp
2009-02-22 05:28 <DIR> --dsh--- c:\windows\TWFyayBOdXNzYmF1bQ
2009-02-22 05:26 37,376 a------- c:\windows\system32\D.tmp
2009-02-22 05:26 67,585 a------- c:\windows\system32\B.tmp
2009-02-22 05:26 12,781 a------- c:\windows\system32\7.tmp
2009-02-22 05:26 212 a------- c:\windows\system32\4.tmp
2009-02-22 05:24 15,614 a------- c:\windows\system32\9.tmp
2009-02-22 05:24 64,000 a------- c:\windows\system32\c++.exe
2009-02-22 05:24 67,585 a------- c:\windows\system32\6.tmp
2009-02-22 05:24 25,601 a------- c:\windows\system32\5.tmp
2009-02-22 05:24 12,781 a------- c:\windows\system32\4.tm_
2009-02-22 05:23 4 a------- c:\windows\ykmnnmcp
2009-02-22 05:21 <DIR> --d----- c:\windows\wmrr
2009-02-22 05:21 <DIR> --d----- c:\program files\common files\wmrr
2009-02-22 05:17 <DIR> --d----- C:\ComboFix
2009-02-22 05:17 406,016 a------- c:\windows\system32\CF25604.exe
2009-02-22 05:16 406,016 a------- c:\windows\system32\CF25373.exe
2009-02-22 05:09 37,376 a------- c:\windows\system32\8.tmp
2009-02-22 05:09 29,677 a------- c:\windows\system32\mssrv32.exe
2009-02-22 05:09 67,585 a------- c:\windows\system32\6.tm_
2009-02-22 03:29 25,088 a------- c:\windows\system32\drivers\phqghume.sys
2009-02-22 03:05 6 a------- c:\windows\_id.dat
2009-02-22 03:04 128 a------- c:\windows\adobe.bat
2009-02-22 03:04 64,000 a------- c:\windows\system32\codeblocks.exe
2009-02-22 03:04 37,376 a------- c:\windows\system32\1564.tmp
2009-02-22 03:04 67,585 a------- c:\windows\system32\1562.tmp
2009-02-22 03:04 168 a------- c:\windows\system32\1560.tmp
2009-02-22 02:40 122,368 a------- c:\windows\system32\ntdll64.exe
2009-02-22 02:10 1,347 a------- c:\windows\system32\ahtn.htm
2009-02-22 02:10 4,785 a------- c:\windows\system32\warning.gif
2009-02-22 02:10 121,856 a------- c:\windows\system32\dllcache\userinit.exe
2009-02-22 02:10 469 a------- c:\windows\system32\win32hlp.cnf
2009-02-22 02:10 43,520 a------- c:\windows\system32\frmwrk32.exe
2009-02-22 02:10 44,032 a------- c:\windows\system32\998.exe
2009-02-22 02:09 616 a------- c:\windows\system32\1556.tmp
2009-02-22 02:09 182,656 a------- c:\windows\system32\dllcache\ndis.sys
2009-02-22 02:09 153,600 a------- c:\windows\system32\w.exe
2009-02-22 02:09 62,464 a------- c:\windows\system32\d.exe
2009-02-22 02:09 47,616 a------- c:\windows\system32\reader_s.exe
2009-02-22 02:09 37,888 -------- c:\windows\system32\1550.tmp
2009-02-22 02:09 18,944 a---h--- c:\windows\system32\drivers\protect.sys
2009-02-22 02:09 64,000 a------- c:\windows\system32\undname.exe
2009-02-22 02:09 67,585 a------- c:\windows\system32\154E.tmp
2009-02-22 02:09 25,601 a------- c:\windows\system32\154D.tmp
2009-02-22 02:09 168 a------- c:\windows\system32\154C.tmp
2009-02-22 02:02 48,640 a------- c:\windows\system32\ljJDTMfc.dll
2009-02-22 02:02 123,392 a------- c:\windows\system32\pafbfh.dll
2009-02-22 02:02 123,392 a------- c:\windows\system32\mtmhwimr.dll
2009-02-22 02:00 74,752 a------- c:\windows\system32\fgifblrf.dll
2009-02-22 01:59 25,088 a------- c:\windows\system32\drivers\bqxsaqlf.sys
2009-02-22 01:59 301,056 a------- c:\windows\system32\cbXNDUoP.dll
2009-02-22 01:54 79,148 a------- c:\windows\system32\prunnet.exe
2009-02-17 19:50 <DIR> --d----- c:\program files\Mozilla Sunbird
2009-02-15 05:11 54,156 a---h--- c:\windows\QTFont.qfn
2009-02-15 05:11 1,409 a------- c:\windows\QTFont.for
2009-02-14 15:52 99,696 a------- c:\windows\system32\drivers\2f404f0d.sys
2009-02-14 15:52 19,214 a------- c:\windows\system32\sf.ico
2009-02-14 15:52 13,942 a------- c:\windows\system32\m3.ico
2009-02-14 15:52 106,496 a------- c:\windows\system32\fejokt.dll
2009-02-14 15:52 155,156 a------- c:\windows\system\xccef090131.exe
2009-02-14 15:52 578,560 a------- c:\windows\system32\ehtb
2009-02-14 15:52 215,552 a------- c:\windows\system32\dllcache\termsrv.dll
2009-02-14 15:52 <DIR> --d----- c:\windows\system32\inf
2009-02-14 15:52 204,800 a------- c:\windows\system32\azton.mt
2009-02-14 15:51 83,968 a------- c:\windows\system32\smulqgbq.dll
2009-02-10 02:42 25,088 a------- c:\windows\system32\drivers\gzfcosim.sys
2009-02-10 02:42 303,104 a------- c:\windows\system32\rqRLeFvs.dll.vir
2009-02-10 02:36 51,200 a------- c:\windows\system32\fccBqqqP.dll

==================== Find3M ====================

2009-02-22 14:26 90,112 a------- c:\windows\DUMP5c29.tmp
2009-02-22 14:24 90,112 a------- c:\windows\DUMP6159.tmp
2009-02-22 14:22 90,112 a------- c:\windows\DUMP5d23.tmp
2009-02-22 05:26 64,000 ac------ c:\windows\system32\regwiz.exe
2009-02-22 02:10 121,856 a------- c:\windows\system32\userinit.exe
2009-02-22 02:09 182,656 a------- c:\windows\system32\drivers\ndis.sys
2009-02-14 15:52 215,552 a------- c:\windows\system32\termsrv.dll
2009-02-11 10:19 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 10:19 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-03 15:58 79,303 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-02 01:31 98,051 a------- c:\windows\system32\siduyame.dll
2008-12-31 19:07 86,290 -------- c:\windows\system32\suhowumu.dll
2008-12-30 19:07 97,531 a--sh--- c:\windows\system32\porajiha.dll
2008-12-12 12:01 3,067,904 -------- c:\windows\system32\dllcache\mshtml.dll
2008-12-11 05:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2006-08-25 01:43 88 ---shr-- c:\windows\system32\56DF14BF84.sys
2007-03-21 22:00 56 ---shr-- c:\windows\system32\84BF14DF56.sys
0000-00-00 00:00 47,616 a--sh--- c:\windows\system32\kebozake.dll
2007-03-21 22:00 5,018 ac-sh--- c:\windows\system32\KGyGaAvL.sys
2005-11-24 16:26 561,152 a--shr-- c:\windows\system32\pcpevoke.exe
0000-00-00 00:00 47,616 a--sh--- c:\windows\system32\tifagutu.dll
0000-00-00 00:00 47,616 a--sh--- c:\windows\system32\vivamuzu.dll
2005-08-02 16:46 187,904 a--shr-- c:\windows\twfyaybodxnzymf1bq\asappsrv.dll
2005-08-02 16:58 314,368 a--shr-- c:\windows\twfyaybodxnzymf1bq\command.exe
2005-07-29 16:24 472 a--shr-- c:\windows\twfyaybodxnzymf1bq\nqIVuV1ixrhWsAIYvk.vbs

============= FINISH: 15:12:05.39 ===============

[tetonbob]

Hello -

Not sure if you'll see this post, as I see you've requested your account be deleted, but I feel I should inform you that from what I see in that log, the system needs to be formatted.

Your system is infected with a polymorphic file infector called Virut. Virut is capable of infecting all the machine's executable files (.exe) and screensaver files (.scr). However, the problem is that the virus has a number of bugs in its code, and as a result, it may misinfect a proportion of executable files and therefore, the files are corrupted beyond repair. As of now, security experts suggest that a format and clean install, or destructive recovery if you have an OEM recovery partition, is the best way to clean the infection and it is the best and safest way to return the machine to its normal working state.

Backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (softwares) and screensavers (*.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable.

Also, avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them. Virut can penetrate and infect .exe files inside compressed files too.

Recent variants also modify htm, html, asp and php files.

Do not back up to another machine, as it may become compromised. Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups.

See miekiemoes' blog for similar comments here:

http://miekiemoes.blogspot.com/2009/...-throwing.html