Recently Removed Trojan - CPU still running @ 100%

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by F#$*CoolWebSearch, Jan 12, 2008.

  1. F#$*CoolWebSearch

    F#$*CoolWebSearch Private E-2

    Hello - I recently removed a trojan from my PC with Norton, it did not specify which one, only setup.exe... My processor is still running at 100% with no programs running, I am wondering if the Trojan made a change to my Windows settings...

    There doesn't seem to be any out of the ordinary processes running in the Task Manager or Administrative Tools Utilities... it seems explorer.exe is taking upwards of 35000 k which I found to be odd....

    Could there still be programsrunning in the background that Task Manager is not showing ?

    I am attaching a hijackthis log, as I do not know what information would be helpful....

    Any input would be appreciated...

    Kind Regards - J
     

    Attached Files:

    F#$*CoolWebSearch, Jan 12, 2008
    #1
  2. abri

    abri MajorGeek

    Hi F#$*CoolWebSearch!
    Welcome to the Malware Forum!

    I looked through your HijackThis log, but it's installed incorrectly and HJT never gives us enough information to help you adequately. There are a couple of things in your HJT that aren't right, but I really need the full set of logs to be of any help to you. Normally, when there's one virus, there's a good chance there are others. I recommend that you work through the READ & RUN ME FIRST which has hijackthis already worked into the MGTools automatically so you don't need to reinstall it and run it separately. Please note those instructions that apply to your operating system and attach the requested logs with your next post.

    abri
     
    abri, Jan 13, 2008
    #2
  3. F#$*CoolWebSearch

    F#$*CoolWebSearch Private E-2

    Here are the requested logs.... Thanks !
     

    Attached Files:

    F#$*CoolWebSearch, Jan 15, 2008
    #3
  4. abri

    abri MajorGeek

    Hi F#$*CoolWebSearch,
    Below are some filler steps while I get some more information about some of the things in your logs. You have some unusual things, but I'm not sure if they're what's causing the problem. I'll get back to you about this. For now, please do the following:

    1) Open your Windows Live Messenger, go to Help -> Customer Experience Improvement Program and turn it off. That will stop you getting all those sqm files. Those under C:\ you can just delete.

    sq2fa8~1.sqm Jan 13 2008 244 "sqmnoopt04.sqm"
    sq2fac~1.sqm Jan 13 2008 244 "sqmnoopt05.sqm"
    sqa37a~1.sqm Jan 13 2008 232 "sqmdata04.sqm"
    sqa77a~1.sqm Jan 13 2008 232 "sqmdata05.sqm"
    sqmdat~1.sqm Nov 7 2007 232 "sqmdata00.sqm"
    sqmdat~2.sqm Nov 8 2007 232 "sqmdata01.sqm"
    sqmdat~3.sqm Nov 8 2007 232 "sqmdata02.sqm"
    sqmdat~4.sqm Jan 13 2008 232 "sqmdata03.sqm"
    sqmnoo~1.sqm Nov 7 2007 244 "sqmnoopt00.sqm"
    sqmnoo~2.sqm Nov 8 2007 244 "sqmnoopt01.sqm"
    sqmnoo~3.sqm Nov 8 2007 244 "sqmnoopt02.sqm"
    sqmnoo~4.sqm Jan 13 2008 244 "sqmnoopt03.sqm"


    2) Go to add/remove programs and uninstall the below:


    Viewpoint Media Player
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 2
    J2SE Runtime Environment 5.0 Update 5
    J2SE Runtime Environment 5.0 Update 6
    Java(TM) 6 Update 2
    Java(TM) SE Runtime Environment 6 Update 1

    3) Reboot after uninstalling the above.

    4) Install the current version of Sun Java from: Sun Java Runtime Environment

    abri
     
    abri, Jan 16, 2008
    #4
  5. F#$*CoolWebSearch

    F#$*CoolWebSearch Private E-2

    Hello Abri:

    I have completed the instructions you left, although the Customer Experience Improvement Program in Windows Messenger was grayed out so I couldn't mess with it.... my puter is still having the same issues...

    Do you need updated logs ?

    Thanks - J
     
    F#$*CoolWebSearch, Jan 16, 2008
    #5
  6. abri

    abri MajorGeek

    Hi F#$*CoolWebSearch!

    These are some questions Chaslang has about your computer:
    • What process or process show high CPU useage (if any do)?
    • Does it happen in safe boot mode?
    • Does it happen when physically unplugged from the internet?
    • If the cable being plugged in makes a difference, what about whether a browser is opened or closed and which browser?
    • Why are two AIM's loading?
    • Why is all the stuff being stored on the Desktop? Move them someplace permanent and safe or Delete them. The desktop is not a place to store stuff like this and can cause slow downs since it reloads frequently and an antivirus program could end up having to scan things on the Desktop all the time and this guy has huge files on the Desktop.
    After answering the above questions, please go to Alternate Scans and scroll down about half way down the page where you'll find a list of rootkit scans. Run several of those and attach the results. If they don't find anything, just report that.

    Next, please go to Start / Run and type in msconfig and click on ok. In the window that opens up choose diagnostic or selective mode and then open up the start tab. Put a check next to the system items and leave the rest unchecked. Then click on accept and okay and allow the computer to reboot or reboot yourself. See what results you get doing this. Then add add or subtract items from this list and see if you can locate what is running that could be contributing to the problem.

    Also, note which running processes are starting and think about whether you need them.

    Next, please download Process Explorer Process Explorer[/URL]
    Download it to a place where you can find it. Then extract the files to it's own folder. Start it by double clicking on proexp.exe and see what programs are running and what their cpu usage is.

    Let me know how this goes.
    abri
     
    abri, Jan 17, 2008
    #6
  7. F#$*CoolWebSearch

    F#$*CoolWebSearch Private E-2

    What process or process show high CPU useage (if any do)?
    svchost.exe, ccapp.exe, explorer.exe
    Does it happen in safe boot mode? no

    Does it happen when physically unplugged from the internet? yes

    If the cable being plugged in makes a difference, what about whether a browser is opened or closed and which browser? n/a

    Why are two AIM's loading? don't know

    Why is all the stuff being stored on the Desktop? frequently used items

    Move them someplace permanent and safe or Delete them. The desktop is not a place to store stuff like this and can cause slow downs since it reloads frequently and an antivirus program could end up having to scan things on the Desktop all the time and this guy has huge files on the Desktop.

    I will get started on the other items now... thanks
     
    F#$*CoolWebSearch, Jan 17, 2008
    #7
  8. F#$*CoolWebSearch

    F#$*CoolWebSearch Private E-2

    It seems "deferred procedure calls" is a problem, don't really know anything about it...my puter won't allow me to save the rootkill log so I will cut and paste it into a following post....

    Thanks - J
     

    Attached Files:

    F#$*CoolWebSearch, Jan 17, 2008
    #8
  9. F#$*CoolWebSearch

    F#$*CoolWebSearch Private E-2

    GMER 1.0.13.12551 - http://www.gmer.net
    Rootkit scan 2008-01-17 17:33:20
    Windows 5.1.2600 Service Pack 2


    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F06C2330] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F06C23A0] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ [F06C2330] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE [F06C23A0] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_POWER [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA [F06C2290] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA [F06C2290] SYMEVENT.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_READ [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_POWER [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7C27486] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [F7C27546] tcpipBM.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_READ [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_WRITE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_POWER [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_READ [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_POWER [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA [F0463919] SYMTDI.SYS
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F7B8FB7E] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F7B8FD8C] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F7B9099A] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [F7B8FAF6] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F7B912C8] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B91086] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [F7B8FAB2] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F7B91CD4] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F7B91790] mouclass.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_NAMED_PIPE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLOSE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_READ [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_WRITE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_EA [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_EA [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FLUSH_BUFFERS [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_VOLUME_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_VOLUME_INFORMATION [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DIRECTORY_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FILE_SYSTEM_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SHUTDOWN [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_LOCK_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLEANUP [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_MAILSLOT [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_SECURITY [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_SECURITY [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_POWER [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SYSTEM_CONTROL [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CHANGE [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_QUOTA [F6E11C00] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_QUOTA [F6E11C00] SynTP.sys

    ---- EOF - GMER 1.0.13 ----
     
    F#$*CoolWebSearch, Jan 17, 2008
    #9
  10. abri

    abri MajorGeek

    Hi F#$*CoolWebSearch,

    I have a couple of other questions. Was your computer running this way when Norton found the trojan or did you only experience the high CPU usage after Norton removed the setup.exe? This is important, because if the high CPU usage is the result of Norton removing the torjan, then I would ask you to go to the Norton quarantine and get it back out for starters to see if that makes a difference.

    It's possible that the ccapp.exe file is causing the problem. There's a way to move it from one place in the registry to another so that it starts up in a different way. However, before we do anything, please answer the question in the first paragraph.

    Also, could you run another set of logs? Go to the MGTools folder under C and find GetLogs.bat Double click on it and allow it to run until it tells you to hit any key to close the program. The logs it produces can be found directly under C next to the superman icon and they are called MGlogs.zip Please attach those with your next post.

    abri
     
    abri, Jan 18, 2008
    #10
  11. F#$*CoolWebSearch

    F#$*CoolWebSearch Private E-2

    Abri - the high CPU symptoms occurred when the trojan infection started and have continued after its removal....My Norton Quarantine apperars to be empty...
     

    Attached Files:

    F#$*CoolWebSearch, Jan 18, 2008
    #11
  12. abri

    abri MajorGeek

    Hi F#$*CoolWebSearch

    Your values in Process Explorer suggest that you may be having hardware problems and it would be a good idea to open a thread in the Hardware Forum and find out why the Interrups and DPC's are running so high.

    It's unlikely the malware would have caused hardware problems, however, it is possible they could have coincidentally occured at the same time.

    Also, I'm still suspecting your Nortons of being part of the problem. I recommend uninstalling it (get a free backup antivirus before you uninstall it like AVG or Avast which you can link to from How to Protect Yourself from Malware and seeing what happens, see if you find your cpu's dropping. Alternatively, you can use msconfig to turn off Norton at startup and slowly turn back on one feature at a time to see if this gives you any results.

    Sorry this is not an easy problem.
    abri
     
    abri, Jan 19, 2008
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds