Computer virus that controlls my mouse.

[Tunni]

Hello!
Since February, I've accidentally downloaded a virus, which controlls my mouse,clicking things.
I've tried to search for weird-looking files, and here's my list:
wmsyspr9.prx
etilqs_yjgwpWcwNWJga62 (0 bytes file)
etilqs_EkUj5aSWNQybphp(0 bytes file)
etilqs_EkUj5aSWNQybphp(0 bytes file)
GDIPFONTCACHEV1 (Video CD Movie file, opens with nero showtime)
brndlog (Text document)
index C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
EpfwUser ( is in C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus)
8db84eb2-0934-4407-ad38-5c1b68483739 (XML doument)
8C95PU9F(C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5)
CPMV8D2B(C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5)
FTPECWZK(C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5)
W1E3SLYV (C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5)
540228824_810007( in Corel Messages)
_default.CW_(CW_file)
1033 (Empty folder)
manifest.json (JSON file)
qmgr0 and qmgr1 (Nero Show time files)
OPA12.BAK
opa12 (Nero Show time file)
28KH2EYF(C:\Documents and Settings\My Pc\Application Data\Adobe\Flash Player\AssetCache)
and here  C:\Documents and Settings\My Pc\Application Data\Microsoft\CryptnetUrlCache\Content are files with lots of numbers and letters
7ee401672c98b8c41cde857a37d843f6-le32d8.cache-3 (CACHE-3 File)
6d14e4b1d8ca773bab785d1be032546e_5dafa7 39-502f-40a1-a3d6-21b29a9e169d
9921d43dc7a746715c0c2d40741ccd3c_5dafa7 39-502f-40a1-a3d6-21b29a9e169d
d42cc0c3858a58db2db37658219e6400_5dafa7 39-502f-40a1-a3d6-21b29a9e169d
What I want to know: are these malicious files?
Thanks!

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
We had better run some scans to see what's good and what's not good.

Please download AdwCleaner by Xplode onto your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  
• Click on Search.
  
• A logfile will automatically open after the scan has finished.
• Please post the content of that logfile in your reply.
• You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.

*********************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

[Tunni]

Hello Dave! Here's the log of Malwarebytes Anti Malware:
(Note! My mother language isn't english, so I translated it with Google translate)
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.04.03.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
My PC :: PC [administrator]

3/4/2013 3:26:42 PM
mbam-log-2013-04-03 (15-26-42). txt

Scan Mode: Full Scan (C: \ | E: \ |)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics / Extra | Heuristics / Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 254370
Elapsed time: 22 minutes, 19 seconds

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values ​​Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files detected: 4
E: \ kits \ Ahead.Nero.Burning.ROM.v6.6.0.16 \ CORE10k.EXE (PUP.Keygen.Intro) -> No action taken.
E: \ kits \ Ahead.Nero.Burning.ROM.v6.6.0.16 \ Ahead.NeroVision.Express.v3.1.0.16 \ CORE10k.EXE (PUP.Keygen.Intro) -> No action was taken.
E: \ kits \ Ahead.Nero.Burning.ROM.v6.6.0.16 \ KeyGen.exe (Malware.Packer.Gen) -> quarantined and removed successfully.
E: \ kits \ Ahead.Nero.Burning.ROM.v6.6.0.16 \ Ahead.NeroVision.Express.v3.1.0.16 \ KeyGen.exe (Malware.Packer.Gen) -> quarantined and removed successfully.

(end)
Please tell me if anything's wrong!

[SuperDave]

Please run MBAM again and remove those infections. I would also like to see the other two logs.

[Tunni]

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.04.03.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
My Pc :: PC [administrator]

4/4/2013 10:40:54 AM
mbam-log-2013-04-04 (10-40-54).txt

Scan type: Full scan (C:\|E:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 254100
Time elapsed: 22 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
SuperDave, here's the log. I can't believe there are no malicious items!

[SuperDave]

here's the log. I can't believe there are no malicious items!

They were there the first time your ran MBAM.
Please run adwCleaner and Security Check and post the logs.

[Tunni]

Here is the log of system check ( link you gave me)
Results of screen317's Security Check version 0.99.62 
 Windows XP Service Pack 3 x86   
 Internet Explorer 8 
``````````````Antivirus/Firewall Check:``````````````[/u]
 Windows Firewall Enabled! 
ESET NOD32 Antivirus 4.0   
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````[/u]
 Malwarebytes Anti-Malware version 1.70.0.1100 
 CCleaner     
 Adobe Flash Player 10 Flash Player out of Date!
  Adobe Flash Player    10.3.183.63 Flash Player out of Date! 
 Adobe Reader XI 
 Mozilla Firefox (3.6.28) Firefox out of Date! 
 Google Chrome 25.0.1364.172 
 Google Chrome 26.0.1410.43 
````````Process Check: objlist.exe by Laurent````````[/u] 
 ESET NOD32 Antivirus egui.exe 
 ESET NOD32 Antivirus ekrn.exe 
`````````````````System Health check`````````````````[/u]
 Total Fragmentation on Drive C:: 9%
````````````````````End of Log``````````````````````[/u]




And here's the log for adwCleaner:

# AdwCleaner v2.200 - Logfile created 04/09/2013 at 11:31:57
# Updated 02/04/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : My Pc - PC
# Boot Mode : Normal
# Running from : C:\Documents and Settings\My Pc\My Documents\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Documents and Settings\My Pc\Local Settings\Application Data\Conduit

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB1-4EC0-403E-8DD8-394C54984B2C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB9-4EC0-403E-8DD8-394C54984B2C}
Key Found : HKCU\Software\SmartBar
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Key Found : HKLM\SOFTWARE\Classes\IMsiDe1egate.Application.1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v3.6.28 (en-US)

File : C:\Documents and Settings\My Pc\Application Data\Mozilla\Firefox\Profiles\zo8gqx88.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v26.0.1410.43

File : C:\Documents and Settings\My Pc\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [2157 octets] - [09/04/2013 11:31:57]

########## EOF - C:\AdwCleaner[R1].txt - [2217 octets] ##########

[SuperDave]

Update your Adobe Reader. get.adobe.com/reader.

Be sure to uncheck the Free McAfee Security Scan so it isn't installed.

****************************************
Remove the Adware:

• Please close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
  
• Click on Delete.
  
• Confirm each time with OK
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile in your reply.
• You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.
  

******************************************
Download Combofix from any of the links below, and save it to your DESKTOP. 
If your version of Windows defaults to you download folder you will need to copy it to your desktop.

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with  ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to  have this pre-installed on your machine before doing any malware  removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair  mode that will allow us to more easily help you should your computer  have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

[Tunni]

Hello! Here is the adwCleaner log. I'll post the other one later :

# AdwCleaner v2.200 - Logfile created 04/10/2013 at 12:02:16
# Updated 02/04/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : My Pc - PC
# Boot Mode : Normal
# Running from : C:\Documents and Settings\My Pc\My Documents\Downloads\adwcleaner (1).exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Documents and Settings\My Pc\Local Settings\Application Data\Conduit

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB1-4EC0-403E-8DD8-394C54984B2C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB9-4EC0-403E-8DD8-394C54984B2C}
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Key Deleted : HKLM\SOFTWARE\Classes\IMsiDe1egate.Application.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v3.6.28 (en-US)

File : C:\Documents and Settings\My Pc\Application Data\Mozilla\Firefox\Profiles\zo8gqx88.default\prefs.js

C:\Documents and Settings\My Pc\Application Data\Mozilla\Firefox\Profiles\zo8gqx88.default\user.js ... Deleted !

[OK] File is clean.

-\\ Google Chrome v26.0.1410.43

File : C:\Documents and Settings\My Pc\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [2286 octets] - [09/04/2013 11:31:57]
AdwCleaner[S1].txt - [2367 octets] - [10/04/2013 12:02:16]

########## EOF - C:\AdwCleaner[S1].txt - [2427 octets] ##########

[Tunni]

And the Combo Fix.
ComboFix 13-04-10.01 - My Pc 04/10/2013  12:27:22.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2037.1404 [GMT 3:00]
Running from: c:\documents and settings\My Pc\My Documents\Downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\All Users\Application Data\CE325E3666.sys
C:\Thumbs.db
.
.
(((((((((((((((((((((((((   Files Created from 2013-03-10 to 2013-04-10  )))))))))))))))))))))))))))))))
.
.
2013-04-10 09:22 . 2013-04-10 09:22   --------   d-----w-   c:\windows\LastGood
2013-04-06 06:59 . 2013-04-06 06:59   --------   d-----w-   c:\documents and settings\My Pc\Local Settings\Application Data\Adobe
2013-04-06 05:48 . 2013-04-06 05:48   --------   d-----w-   C:\_OTL
2013-04-05 20:49 . 2013-04-05 20:49   --------   d-sh--w-   c:\documents and settings\My Pc\IECompatCache
2013-04-05 11:06 . 2013-04-05 11:06   --------   d-----w-   c:\program files\Common Files\Adobe
2013-04-03 12:25 . 2013-04-03 12:25   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2013-04-03 12:25 . 2012-12-14 13:49   21104   ----a-w-   c:\windows\system32\drivers\mbam.sys
2013-03-23 18:00 . 2013-03-23 18:00   --------   d-----w-   c:\program files\CCleaner
2013-03-23 17:45 . 2013-03-23 17:45   --------   d-----w-   c:\documents and settings\My Pc\Application Data\Malwarebytes
2013-03-23 17:45 . 2013-04-03 12:25   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2013-03-22 08:52 . 2013-03-22 08:52   --------   d-----w-   c:\windows\system32\wbem\Repository
2013-03-22 08:50 . 2013-03-22 08:50   --------   d-----w-   c:\documents and settings\My Pc\Local Settings\Application Data\WMTools Downloaded Files
2013-03-22 08:50 . 2013-03-22 08:50   --------   d--h--w-   c:\windows\PIF
2013-03-22 08:50 . 2013-03-22 08:50   --------   d-----w-   c:\windows\PixArt
2013-03-22 08:50 . 2013-03-22 08:50   --------   d-----w-   c:\program files\Common Files\PCCamera
2013-03-22 08:50 . 2013-03-22 08:50   --------   d-----w-   c:\windows\Downloaded Installations
2013-03-22 08:50 . 2013-03-22 08:50   --------   d-----w-   c:\program files\Trust
2013-03-22 08:47 . 2013-03-22 08:47   --------   d-----w-   c:\program files\MSXML 4.0
2013-03-22 08:45 . 2013-03-22 08:45   --------   d-----w-   c:\windows\system32\Lang
2013-03-22 08:45 . 2013-03-22 08:45   --------   d-----w-   c:\windows\system32\RTCOM
2013-03-22 08:45 . 2013-03-22 08:45   --------   d-----w-   c:\program files\Realtek
2013-03-22 08:45 . 2013-03-22 08:45   --------   d-----w-   c:\documents and settings\My Pc\Application Data\InstallShield
2013-03-22 08:44 . 2013-03-22 08:44   --------   d-----w-   c:\program files\Microsoft Works
2013-03-22 08:43 . 2013-03-22 08:43   --------   d-----w-   c:\documents and settings\My Pc\Local Settings\Application Data\Microsoft Help
2013-03-22 08:43 . 2013-03-22 08:43   --------   d-----w-   c:\documents and settings\My Pc\Local Settings\Application Data\Help
2013-03-18 15:30 . 2013-02-12 00:32   12928   -c----w-   c:\windows\system32\dllcache\usb8023x.sys
2013-03-18 15:27 . 2013-03-22 08:39   --------   d-s---w-   c:\documents and settings\Administrator
2013-03-18 15:20 . 2013-03-18 15:20   --------   d-----w-   c:\documents and settings\LocalService\IETldCache
2013-03-18 09:06 . 2013-03-18 09:06   --------   d-----w-   c:\documents and settings\My Pc\Local Settings\Application Data\visi_coupon
2013-03-16 22:47 . 2013-03-16 22:47   --------   d-----w-   c:\documents and settings\My Pc\Local Settings\Application Data\Nero
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-20 19:39 . 2013-02-20 19:39   419488   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-02-20 19:39 . 2013-02-20 19:30   70304   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-20 19:12 . 2013-02-20 19:07   2516   --sha-w-   c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2013-02-20 18:19 . 2013-02-20 18:19   315392   ----a-w-   c:\windows\HideWin.exe
2013-02-12 00:32 . 2008-04-14 14:00   12928   ----a-w-   c:\windows\system32\drivers\usb8023.sys
2013-02-05 20:05 . 2008-04-14 14:00   916480   ----a-w-   c:\windows\system32\wininet.dll
2013-02-05 20:05 . 2008-04-14 14:00   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2013-02-05 20:05 . 2008-04-14 14:00   1469440   ----a-w-   c:\windows\system32\inetcpl.cpl
2013-02-05 05:53 . 2008-04-14 14:00   385024   ----a-w-   c:\windows\system32\html.iec
2013-01-26 03:55 . 2008-04-14 14:00   552448   ----a-w-   c:\windows\system32\oleaut32.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2012-05-25 6595928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [3/19/2009 12:44 PM 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3/19/2009 12:45 PM 93848]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [3/19/2009 12:44 PM 731840]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [2/24/2005 1:29 PM 162176]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-02 12:48   1642448   ----a-w-   c:\program files\Google\Chrome\Application\26.0.1410.43\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-20 19:39]
.
2013-04-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-21 08:43]
.
2013-04-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-21 08:43]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\My Pc\Start Menu\Programs\IMVU\Run IMVU.lnk
FF - ProfilePath - c:\documents and settings\My Pc\Application Data\Mozilla\Firefox\Profiles\zo8gqx88.default\
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-03-18 11:07; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; c:\documents and settings\My Pc\Application Data\Mozilla\Firefox\Profiles\zo8gqx88.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-10 12:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ...
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3944)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2013-04-10  12:31:53
ComboFix-quarantined-files.txt  2013-04-10 09:31
.
Pre-Run: 1,892,757,504 bytes free
Post-Run: 1,883,181,056 bytes free
.
- - End Of File - - 2F6287257BCB8200C807791F2D38B99D
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Huh? When I ran ComboFix (and disabled my antivirus) my internet was disconected, and when I restarted , everything went back to normal.
And, it didn't ask me to restart it. Strange.
Anyway, the problem is still here

[SuperDave]

Anyway, the problem is still here

Did you try another mouse?

SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

[Tunni]

Look, I think you're right. It might be the mouse's problem.
If you don't mind, please wait until Saturday/Sunday, when I'll get another one.
I'm using:OS/2 Mouse / works with a ball/ from Addison.
Thanks for all the help done!

[SuperDave]

Ok, let me know how it turns out.

[Tunni]

Oh! I 've forgot to mention: I have the End.exe virus. I decided I shall give you the log.
The log for SysProt :
SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
Service Name: ---
Module Base: B9415000
Module End: B942D000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
Service Name: ---
Module Base: BA5C6000
Module End: BA5C8000
Hidden: Yes

******************************************************************************************
******************************************************************************************
SSDT:
Function Name: ZwAssignProcessToJobObject
Address: 893B0630
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwOpenProcess
Address: 893AFA60
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwOpenThread
Address: 893AFE80
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwSuspendProcess
Address: 893B0460
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwSuspendThread
Address: 893B0280
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwTerminateProcess
Address: 893AFC90
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwTerminateThread
Address: 893B00B0
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cookies.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied

[SuperDave]

Oh! I 've forgot to mention: I have the End.exe virus.

How do you know that?

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan

•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.

• Leave the check mark next to Remove found threats.
  

•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt