mbam will not remove system tools 2011

cwojeski · November 23, 2010

System Tool reappears after mbam removes and after restart.

Requested software will not run in regular mode.

Requested software was run in safe mode.

Defogger <disabled>

Mbam log below (no infection found)

DDS log below

attach.txt zip attached

ark.txt zip attached

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 5167

Windows 6.1.7600 (Safe Mode)

Internet Explorer 8.0.7600.16385

11/22/2010 8:18:44 PM

mbam-log-2010-11-22 (20-18-44).txt

Scan type: Quick scan

Objects scanned: 146451

Time elapsed: 16 minute(s), 11 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-11-10.01) - NTFSx86 NETWORK

Run by Wojo at 19:36:50.58 on Mon 11/22/2010

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.367 [GMT -5:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\system32\ctfmon.exe

C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe

C:\Users\Wojo\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Wojo\Music\Defogger (1).exe

C:\Windows\system32\conhost.exe

C:\Users\Wojo\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Users\Wojo\Music\dds (1).scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

uURLSearchHooks: H - No File

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Norton Safety Minder: {b8e07826-0971-4f16-b133-047b88034e89} - c:\program files\norton online\addons\norton safety minder\engine\2.0.0.48\coIEPlg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [Google Update] "c:\users\wojo\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

uRunOnce: [eFeDm01834] c:\programdata\efedm01834\eFeDm01834.exe

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [PLFSetL] "c:\windows\PLFSetL.exe"

mRun: [sNUVCDSM] "c:\windows\snuvcdsm.exe"

mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "c:\program files\google\gmail notifier\gnotify.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [KBD] "c:\hp\kbd\KBD.EXE"

mRun: [PS2] "c:\windows\system32\ps2.exe"

mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"

mRun: [hpqSRMon] "c:\program files\hp\digital imaging\bin\hpqSRMon.exe"

mRun: [igfxTray] "c:\windows\system32\igfxtray.exe"

mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"

mRun: [Persistence] "c:\windows\system32\igfxpers.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [RtHDVCpl] "c:\program files\realtek\audio\hda\RtHDVCpl.exe" -s

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [bncsaui.exe] "%ProgramFiles%\Bradford Networks\Persistent Agent\bncsaui.exe"

mRun: [PWRISOVM.EXE] "c:\program files\poweriso\PWRISOVM.EXE"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [iSTray] "c:\program files\pc tools security\pctsGui.exe" /hideGUI

mRun: [WebrootTrayApp] "c:\program files\webroot\security\current\framework\WRTray.exe"

StartupFolder: c:\users\wojo\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-11-21 237632]

R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2010-11-21 338880]

R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2010-11-21 656320]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]

R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\security\current\plugins\antimalware\AEI.exe [2010-11-22 3872776]

R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\security\current\framework\WRConsumerService.exe [2010-11-22 3066528]

S2 BNPagent;Bradford Persistent Agent Service;c:\program files\bradford networks\persistent agent\bndaemon.exe [2010-7-14 3063576]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 NOF;Norton Online;c:\program files\norton online\engine\2.0.0.71\ccsvchst.exe [2010-7-6 126904]

S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2010-11-22 366840]

S2 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2010-11-22 1145304]

S2 ssfmonm;ssfmonm;c:\windows\system32\drivers\ssfmonm.sys [2010-11-22 45072]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632]

S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-1-13 27192]

S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Safety Minder;c:\windows\system32\drivers\nsm\0200000.030\symrdrs.sys [2010-7-6 154672]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-2-27 1343400]

=============== Created Last 30 ================

2010-11-22 21:38:44 45072 ----a-w- c:\windows\system32\drivers\ssfmonm.sys

2010-11-22 21:38:44 24496 ----a-w- c:\windows\system32\drivers\sshrmd.sys

2010-11-22 21:38:44 182056 ----a-w- c:\windows\system32\drivers\ssidrv.sys

2010-11-22 21:37:24 -------- dc-h--w- c:\progra~2\{E15A1CA7-D908-4C28-ADCF-C23723A9D28D}

2010-11-22 21:37:12 -------- d-----w- c:\program files\Webroot

2010-11-22 21:36:32 -------- d-----w- c:\progra~2\Webroot

2010-11-22 21:36:29 -------- d-----w- c:\users\wojo\appdata\local\PackageAware

2010-11-22 03:30:07 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys

2010-11-22 03:30:07 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys

2010-11-22 03:30:06 249616 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-11-22 03:30:06 102184 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys

2010-11-22 03:30:01 237632 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-11-22 03:30:00 159936 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-11-22 03:29:42 87400 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2010-11-22 03:29:42 31960 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys

2010-11-22 03:29:42 123712 ----a-w- c:\windows\system32\drivers\pctplfw.sys

2010-11-22 03:29:38 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-11-22 03:29:13 -------- d-----w- c:\users\wojo\appdata\roaming\PC Tools

2010-11-22 03:29:13 -------- d-----w- c:\program files\PC Tools Security

2010-11-22 03:29:13 -------- d-----w- c:\program files\common files\PC Tools

2010-11-22 03:25:01 -------- d-----w- c:\progra~2\PC Tools

2010-11-22 02:58:52 -------- d-----w- c:\users\wojo\appdata\roaming\Malwarebytes

2010-11-22 02:58:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-11-22 02:58:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-22 02:58:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-11-22 02:58:43 -------- d-----w- c:\progra~2\Malwarebytes

2010-11-22 01:44:43 -------- d-----w- c:\progra~2\eFeDm01834

2010-11-19 09:56:30 6273872 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{0f537d84-0946-4972-bc7f-21830e1fd0c1}\mpengine.dll

2010-11-19 02:00:50 -------- d-----w- c:\program files\iPod

2010-11-19 02:00:45 -------- d-----w- c:\program files\iTunes

2010-11-17 01:11:28 -------- d-----w- c:\program files\PowerISO

2010-11-13 23:56:39 -------- d-----w- c:\program files\LSoft Technologies

2010-11-06 16:37:34 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

2010-10-29 19:52:17 -------- d-----w- c:\progra~2\Bradford Networks

2010-10-27 07:55:15 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-10-27 07:55:15 417792 ----a-w- c:\windows\system32\msdri.dll

2010-10-27 07:55:14 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-10-27 07:55:14 199680 ----a-w- c:\windows\system32\mpg2splt.ax

2010-10-27 07:55:05 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys

==================== Find3M ====================

2010-10-19 15:41:44 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-09-28 20:44:52 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

2010-09-15 09:50:37 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-08 15:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 15:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-09-08 04:30:04 978432 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 04:28:15 44544 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 03:22:31 386048 ----a-w- c:\windows\system32\html.iec

2010-09-08 02:48:16 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-09-05 17:00:34 3835624 ----a-w- c:\windows\system32\SpoonUninstall.exe

2010-09-03 22:18:50 395776 ----a-w- c:\windows\system32\RCoRes.dat

2010-09-03 20:16:18 1084008 ----a-w- c:\windows\system32\RTSndMgr.cpl

2010-09-03 20:16:08 66664 ----a-w- c:\windows\system32\RtkCoInst.dll

2010-09-03 20:16:08 1841768 ----a-w- c:\windows\system32\RtkPgExt.dll

2010-09-03 20:15:56 408168 ----a-w- c:\windows\system32\RtkApoApi.dll

2010-09-03 20:15:56 3605096 ----a-w- c:\windows\system32\RtkAPO.dll

2010-09-01 04:23:49 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2010-09-01 02:34:52 2327552 ----a-w- c:\windows\system32\win32k.sys

2010-08-31 20:28:46 1251944 ----a-w- c:\windows\RtlExUpd.dll

2010-08-31 04:32:30 954752 ----a-w- c:\windows\system32\mfc40.dll

2010-08-31 04:32:30 954288 ----a-w- c:\windows\system32\mfc40u.dll

2010-08-27 05:46:48 168448 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-26 04:39:58 109056 ----a-w- c:\windows\system32\t2embed.dll

============= FINISH: 19:40:09.51 ===============

Attach.zip

ark.zip

cwojeski · November 23, 2010

This is the original mbam scan, which located and deleted the system tools 2011 infection

. However, the issue continues to resurface.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 5166

Windows 6.1.7600 (Safe Mode)

Internet Explorer 8.0.7600.16385

11/21/2010 10:10:04 PM

mbam-log-2010-11-21 (22-10-04).txt

Scan type: Quick scan

Objects scanned: 143287

Time elapsed: 10 minute(s), 12 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Wojo\Desktop\System Tool 2011.LNK (Rogue.SystemTool) -> Quarantined and deleted successfully.

LDTate · November 23, 2010

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

c:\programdata\efedm01834\eFeDm01834.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

cwojeski · November 23, 2010

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: eFeDm01834.exe

Submission date: 2010-11-23 02:26:57 (UTC)

Current status: finished

Result: 5/ 43 (11.6%)

VT Community

not reviewed

Safety score: -

Compact

Print results

Antivirus Version Last Update Result

AhnLab-V3 2010.11.21.01 2010.11.21 -

AntiVir 7.10.14.56 2010.11.21 -

Antiy-AVL 2.0.3.7 2010.11.22 -

Avast 4.8.1351.0 2010.11.21 -

Avast5 5.0.594.0 2010.11.21 -

AVG 9.0.0.851 2010.11.21 -

BitDefender 7.2 2010.11.22 -

CAT-QuickHeal 11.00 2010.11.09 (Suspicious) - DNAScan

ClamAV 0.96.4.0 2010.11.21 -

Command 5.2.11.5 2010.11.21 -

Comodo 6802 2010.11.22 -

DrWeb 5.0.2.03300 2010.11.22 -

Emsisoft 5.0.0.50 2010.11.22 -

eSafe 7.0.17.0 2010.11.21 -

eTrust-Vet 36.1.7992 2010.11.22 -

F-Prot 4.6.2.117 2010.11.21 -

F-Secure 9.0.16160.0 2010.11.22 -

Fortinet 4.2.254.0 2010.11.20 -

GData 21 2010.11.22 -

Ikarus T3.1.1.90.0 2010.11.22 -

Jiangmin 13.0.900 2010.11.20 -

K7AntiVirus 9.68.3041 2010.11.20 -

Kaspersky 7.0.0.125 2010.11.22 -

McAfee 5.400.0.1158 2010.11.22 -

McAfee-GW-Edition 2010.1C 2010.11.22 -

Microsoft 1.6402 2010.11.22 -

NOD32 5637 2010.11.21 -

Norman 6.06.10 2010.11.21 -

nProtect 2010-11-22.01 2010.11.22 -

Panda 10.0.2.7 2010.11.21 -

PCTools 7.0.3.5 2010.11.22 -

Prevx 3.0 2010.11.23 High Risk Cloaked Malware

Rising 22.74.06.03 2010.11.22 -

Sophos 4.59.0 2010.11.22 Sus/UnkPack-C

SUPERAntiSpyware 4.40.0.1006 2010.11.22 Rogue.SecurityAV

Symantec 20101.2.0.161 2010.11.22 -

TheHacker 6.7.0.1.087 2010.11.20 -

TrendMicro 9.120.0.1004 2010.11.22 -

TrendMicro-HouseCall 9.120.0.1004 2010.11.22 -

VBA32 3.12.14.2 2010.11.19 -

VIPRE 7376 2010.11.22 FraudTool.Win32.FakeVimes!delf (v)

ViRobot 2010.11.20.4158 2010.11.22 -

VirusBuster 13.6.52.1 2010.11.21 -

Additional informationShow all

MD5 : b1f461d78d65645ab18451700db57eda

SHA1 : 4c34149866da5f0b96f38b9ac14e77eb6ad5a213

SHA256: a0b67c6947f171c73c0d1148449a7bc02d7da02feb3b34361d39ea9cc453104d

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:
c:\programdata\efedm01834\eFeDm01834.exe
Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If virustotal is too busy you can try these.
http://virusscan.jotti.org
http://www.kaspersky.com/scanforvirus.html

LDTate · November 23, 2010

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have SP3, use the SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

cwojeski · November 23, 2010

At present, my machine is only able to run in safe mode. I'm hoping ComboFix will signal the beginning of the end.

ComboFix 10-11-22.04 - Wojo 11/22/2010 21:54:37.1.2 - x86 NETWORK

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.351 [GMT -5:00]

Running from: c:\users\Wojo\Music\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\eFeDm01834

c:\programdata\eFeDm01834\eFeDm01834

c:\programdata\eFeDm01834\eFeDm01834.exe

c:\users\Wojo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool

c:\users\Wojo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool\System Tool 2011.lnk

c:\windows\system32\ps2.bat

.

((((((((((((((((((((((((( Files Created from 2010-10-23 to 2010-11-23 )))))))))))))))))))))))))))))))

.

2010-11-23 03:09 . 2010-11-23 03:09 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-11-22 21:38 . 2010-06-17 19:49 45072 ----a-w- c:\windows\system32\drivers\ssfmonm.sys

2010-11-22 21:38 . 2010-06-17 19:49 24496 ----a-w- c:\windows\system32\drivers\sshrmd.sys

2010-11-22 21:38 . 2010-06-17 19:49 182056 ----a-w- c:\windows\system32\drivers\ssidrv.sys

2010-11-22 21:37 . 2010-11-22 21:37 -------- dc-h--w- c:\programdata\{E15A1CA7-D908-4C28-ADCF-C23723A9D28D}

2010-11-22 21:37 . 2010-11-22 21:37 -------- d-----w- c:\program files\Webroot

2010-11-22 21:36 . 2010-11-23 00:53 -------- d-----w- c:\programdata\Webroot

2010-11-22 21:36 . 2010-11-22 21:36 -------- d-----w- c:\users\Wojo\AppData\Local\PackageAware

2010-11-22 03:30 . 2010-07-16 19:59 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys

2010-11-22 03:30 . 2010-07-16 19:59 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys

2010-11-22 03:30 . 2010-10-05 16:10 249616 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-11-22 03:30 . 2010-08-28 17:28 102184 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys

2010-11-22 03:30 . 2010-08-18 18:51 237632 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-11-22 03:30 . 2010-09-30 13:58 159936 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-11-22 03:29 . 2010-10-05 16:11 123712 ----a-w- c:\windows\system32\drivers\pctplfw.sys

2010-11-22 03:29 . 2010-09-03 17:28 87400 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2010-11-22 03:29 . 2010-08-10 22:58 31960 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys

2010-11-22 03:29 . 2010-08-27 14:26 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-11-22 03:29 . 2010-11-23 00:32 -------- d-----w- c:\program files\PC Tools Security

2010-11-22 03:29 . 2010-11-22 03:43 -------- d-----w- c:\program files\Common Files\PC Tools

2010-11-22 03:29 . 2010-11-22 03:29 -------- d-----w- c:\users\Wojo\AppData\Roaming\PC Tools

2010-11-22 03:25 . 2010-11-22 03:29 -------- d-----w- c:\programdata\PC Tools

2010-11-22 02:58 . 2010-11-22 02:58 -------- d-----w- c:\users\Wojo\AppData\Roaming\Malwarebytes

2010-11-22 02:58 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-11-22 02:58 . 2010-11-22 02:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-11-22 02:58 . 2010-11-22 02:58 -------- d-----w- c:\programdata\Malwarebytes

2010-11-22 02:58 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-19 09:56 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0F537D84-0946-4972-BC7F-21830E1FD0C1}\mpengine.dll

2010-11-19 02:00 . 2010-11-19 02:00 -------- d-----w- c:\program files\iPod

2010-11-19 02:00 . 2010-11-19 02:01 -------- d-----w- c:\program files\iTunes

2010-11-17 01:11 . 2010-11-17 01:11 -------- d-----w- c:\program files\PowerISO

2010-11-13 23:56 . 2010-11-13 23:56 -------- d-----w- c:\program files\LSoft Technologies

2010-11-06 16:37 . 2010-11-06 16:37 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll

2010-10-29 19:52 . 2010-10-29 19:52 -------- d-----w- c:\programdata\Bradford Networks

2010-10-27 07:55 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-10-27 07:55 . 2010-08-04 06:17 417792 ----a-w- c:\windows\system32\msdri.dll

2010-10-27 07:55 . 2010-08-04 06:15 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-10-27 07:55 . 2010-08-04 06:15 199680 ----a-w- c:\windows\system32\mpg2splt.ax

2010-10-27 07:55 . 2010-07-13 05:22 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-19 15:41 . 2009-12-15 17:53 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-09-28 20:44 . 2010-09-28 20:44 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2010-09-28 20:44 . 2010-09-28 20:44 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

2010-09-15 09:50 . 2010-05-16 17:00 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-08 15:17 . 2010-09-08 15:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 15:17 . 2010-09-08 15:17 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-09-08 04:30 . 2010-10-12 22:50 978432 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 04:28 . 2010-10-12 22:50 44544 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 03:22 . 2010-10-12 22:50 386048 ----a-w- c:\windows\system32\html.iec

2010-09-08 02:48 . 2010-10-12 22:50 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-09-05 17:00 . 2010-09-05 16:40 3835624 ----a-w- c:\windows\system32\SpoonUninstall.exe

2010-09-03 22:18 . 2010-09-26 18:31 395776 ----a-w- c:\windows\system32\RCoRes.dat

2010-09-03 20:16 . 2010-09-26 18:31 3185640 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys

2010-09-03 20:16 . 2010-09-26 18:31 1084008 ----a-w- c:\windows\system32\RTSndMgr.cpl

2010-09-03 20:16 . 2010-09-26 18:31 1841768 ----a-w- c:\windows\system32\RtkPgExt.dll

2010-09-03 20:16 . 2010-09-26 18:31 66664 ----a-w- c:\windows\system32\RtkCoInst.dll

2010-09-03 20:15 . 2010-09-26 18:31 408168 ----a-w- c:\windows\system32\RtkApoApi.dll

2010-09-03 20:15 . 2010-09-26 18:31 3605096 ----a-w- c:\windows\system32\RtkAPO.dll

2010-09-01 04:23 . 2010-10-12 22:39 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2010-09-01 02:34 . 2010-10-12 22:38 2327552 ----a-w- c:\windows\system32\win32k.sys

2010-08-31 20:28 . 2010-09-26 18:30 1251944 ----a-w- c:\windows\RtlExUpd.dll

2010-08-31 04:32 . 2010-10-12 22:40 954752 ----a-w- c:\windows\system32\mfc40.dll

2010-08-31 04:32 . 2010-10-12 22:40 954288 ----a-w- c:\windows\system32\mfc40u.dll

2010-08-27 05:46 . 2010-10-12 22:38 168448 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-27 03:31 . 2010-10-12 22:38 310784 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-27 03:30 . 2010-10-12 22:38 308736 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-08-27 03:30 . 2010-10-12 22:38 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2010-08-26 04:39 . 2010-10-12 22:41 109056 ----a-w- c:\windows\system32\t2embed.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\users\Wojo\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-12-17 135664]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-29 328056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]

"SNUVCDSM"="c:\windows\snuvcdsm.exe" [2009-08-10 27184]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"KBD"="c:\hp\KBD\KBD.EXE" [2001-07-06 61440]

"PS2"="c:\windows\system32\ps2.exe" [2001-07-03 81920]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-09-03 9726568]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-11 421160]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

"ISTray"="c:\program files\PC Tools Security\pctsGui.exe" [2010-09-29 1588184]

"WebrootTrayApp"="c:\program files\Webroot\Security\Current\Framework\WRTray.exe" [2010-11-22 1286960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"GrpConv"="grpconv -o" [X]

c:\users\Wojo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-12-25 66864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]

@="Service"

R2 BNPagent;Bradford Persistent Agent Service;c:\program files\Bradford Networks\Persistent Agent\bndaemon.exe [2010-07-14 3063576]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 NOF;Norton Online;c:\program files\Norton Online\Engine\2.0.0.71\ccSvcHst.exe [2010-05-23 126904]

R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [2010-03-15 366840]

R2 ssfmonm;ssfmonm;c:\windows\system32\DRIVERS\ssfmonm.sys [2010-06-17 45072]

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]

R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]

R3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Safety Minder;c:\windows\System32\Drivers\NSM\0200000.030\SymRdrS.SYS [2010-05-11 154672]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-02-27 1343400]

S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-08-18 237632]

S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2010-07-16 338880]

S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2010-07-16 656320]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Security\Current\Framework\WRConsumerService.exe [2010-11-22 3066528]

--- Other Services/Drivers In Memory ---

*Deregistered* - kxldqpog

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

2010-11-21 c:\windows\Tasks\Driver Fetch.job

- c:\program files\Driver Fetch\Driver Fetch.lnk [2010-08-25 22:18]

2010-11-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-225733379-1794320830-2180015835-1000Core.job

- c:\users\Wojo\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-17 13:49]

2010-11-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-225733379-1794320830-2180015835-1000UA.job

- c:\users\Wojo\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-17 13:49]

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKLM-Run-bncsaui.exe - %ProgramFiles%\Bradford Networks\Persistent Agent\bncsaui.exe

HKLM-RunOnce-<NO NAME> - (no file)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NOF]

"ImagePath"="\"c:\program files\Norton Online\Engine\2.0.0.71\ccSvcHst.exe\" /s \"NOF\" /m \"c:\program files\Norton Online\Engine\2.0.0.71\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2010-11-22 22:21:26

ComboFix-quarantined-files.txt 2010-11-23 03:21

Pre-Run: 61,387,694,080 bytes free

Post-Run: 63,638,061,056 bytes free

- - End Of File - - 5CE0FB4430DDDB407BB7EF5522E0B04A

Download ComboFix from one of these locations:
Link 1
Link 2 If using this link, Right Click and select Save As.
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have SP3, use the SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Give it atleast 20-30 minutes to finish if needed.
Please do not attach the scan results from Combofx. Use copy/paste.
Also please describe how your computer behaves at the moment.

LDTate · November 23, 2010

http://www.eset.eu/online-scanner

Go here to run an online scannner from ESET.

Click the green ESET Online Scanner button.

Read the End User License Agreement and check the box: YES, I accept the Terms of Use.

Click on the Start button next to it.

You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.

A new window will appear asking "Do you want to install this software?"".

Answer Yes to download and install the ActiveX controls that allows the scan to run.

Click Start.

Check Remove found threats and Scan potentially unwanted applications.

Click Scan to begin.

If offered the option to get information or buy software. Just close the window.

Wait for the scan to finish

Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt

Copy and paste that log as a reply to this topic.

cwojeski · November 23, 2010

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=3c19d355c6a41b4b9cdd62cdf02158f1

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-11-23 04:23:44

# local_time=2010-11-23 11:23:44 (-0500, Eastern Standard Time)

# country="United States"

# lang=1033

# osver=6.1.7600 NT

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=2560 16777215 100 0 0 0 0 0

# compatibility_mode=5893 16776573 100 94 0 42065478 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=115140

# found=1

# cleaned=1

# scan_time=8738

C:\Qoobox\Quarantine\C\ProgramData\eFeDm01834\eFeDm01834.exe.vir a variant of Win32/Kryptik.IIX trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Check Remove found threats and Scan potentially unwanted applications.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.

LDTate · November 23, 2010

1.Click Start > Settings > Control Panel.

2.Next, open Add/Remove Programs and remove everything related to :

Webroot

Reboot

cwojeski · November 23, 2010

I removed one program called "Webroot". Upon restart System Tools did not appear. Is there anything else I can/should do to ensure that this infection is removed?

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove everything related to :
Webroot
Reboot

LDTate · November 23, 2010

Run a new combofix scan and post the results

cwojeski · November 23, 2010

ComboFix 10-11-22.04 - Wojo 11/23/2010 16:36:13.2.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.395 [GMT -5:00]

Running from: c:\users\Wojo\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

Infected copy of c:\windows\system32\scecli.dll was found and disinfected

Restored copy from - c:\windows\ERDNT\cache\scecli.dll

.

((((((((((((((((((((((((( Files Created from 2010-10-23 to 2010-11-23 )))))))))))))))))))))))))))))))

.

2010-11-23 22:29 . 2010-11-23 22:29 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-11-23 19:21 . 2010-11-23 19:21 -------- d-----w- c:\programdata\Webroot

2010-11-23 13:51 . 2010-11-23 13:51 -------- d-----w- c:\program files\ESET