nvlddmkm.sys and network sniffer

[Blackiechan9000]

My screen crashes to black and then recovers saying "nvlddmkm.sys display driver has stopped responding and has successfully recovered."
I've had this problem before so i reformatted my entire harddrive and reinstalled a fresh copy of vista 64. Strangely, I never had this problem with XP 64.

I've downloaded and installed all updates for both my windows and gfx card.

The problem went away temporarily but came back recently, This time I can slightly grasp whats wrong with my computer.
I've been playing left 4 dead for hours and hours with no crash or stutters, but when i installed & played TF2 the problem seemed very obvious. Even though L4D is a newer game, TF2 is way more graphic intensive and forces the card to work in more stress. I read the temperature data and it showed that it ranged between 79 ~ 82'C (L4D) and 80~85'C (TF2).
Anyway, any suggestions to prevent this from happening?

Secondly, someone installed a network sniffer on my computer. I dont even know how it was done, it penetrated through my firewall/proxy and installed it. Its pretty crazy how they did it. Although the folder is invisible i know its there 100%, Ive seen it through scanning but the AVG bypasses it thinking that its fine.
How do i get rid of it? I've already have fraud department calling me that someone tried to purchase $400 worth of merchandise in England and France.

Thanks!

My specs: ALL STOCK (no OC)
P5N-D Q6600 @ 2.4 ghz
8800GT (180.42 driver)
6 GB RAM (tested & no errors)
500 GB HDD

[Fruss Tray Ted]

Take this computer offline IMMEDIATELY!!!! :eek: Leave it that way until further instructed.

Your credit card info has been stolen and is being used for those purchases you mentioned. Can you say, "Identity Theft?!?!"

It is also extremely important for you to contact your financial institution and freeze your account and have another card sent to you, or at the very least, change your pin but NOT with that computer! Do it over the phone with your bank using a number you recognize and know is safe.

As to your infection, you'll need to download HijackThis (http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html) and post a log in a reply here so our experts can have a look to help you get rid of it.

[Blackiechan9000]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:55:49 AM, on 12/9/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\AVG\AVG8\avgtray.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.ex e" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~2\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [url]http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab[/url]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgfws8.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7304 bytes

[Blackiechan9000]

Ignore utorrent, im too poor to buy good protection programs so i had to download 2 for my safety.

[Blackiechan9000]

Like None Of You Can Help Me????

[mjc]

Ignore utorrent, im too poor to buy good protection programs so i had to download 2 for my safety.

Umm...in a word. NO!

Or at least until you remove the 'protection' you pirated...actually, skip that idea and break out your 'restore' disk that came with your machine. Go here (http://www.dban.org/)...grab the boot disk, use and then reinstall Windows. All of you current data is severely compromised, so it isn't worth saving.

The most likely source for your infection is your 'downloaded' protection. There are many perfectly legit and better than average programs to handle all the protection you need...for free.

[Ajmukon]

I know you wanted to MJC:
free programs for antiviral:
Comodo ( http://www.comodo.com/ )
Spybot ( http://www.safer-networking.org/index2.html )
MBAM ( http://www.malwarebytes.org/mbam.php )

But only use/install after the computer is "clean"
And at this point it is probably impossible to get it 100% clean, so it is safer to just "restart" and reinstall windows. DO NOT USE SYSTEM RESTORE.

Either boot to the repair partition (F5 usually at boot) or insert your "system recovery disk"
and select "restore to factory settings" (if a menu pops up)

you will loose all data and saved files.

[mjc]

PS: They're all in the links in my sig...

[Fruss Tray Ted]

Like None Of You Can Help Me????
I went to work almost immediately after my reply post to you (12 hr shift / 7 days a week lately..) so please excuse any of us who have regular or extended jobs. This site is a hobby as it does not pay anything but the satisfaction of being able to help someone in need.

Well to be honest though, I do not see anything with HJT out of the ordinary other than you are running 2 antivirus softwares which is not a good thing to do. Considering that you got them via a torrent, get rid of both of them. And the torrent also!! I really don't see a need to illegally download something that is free in the first place! Yes both AVG and Avast have free versions! The free ones don't include a firewall but there are free firewalls out there that are as good if not better than theirs.

But this is about where I set my personal limit in helping others with trojans, bots and other malware. I kindly defer the rest to our resident experts, Budfred and Classicsoftware. When they find time in their busy schedules, I assume they will stop by and instruct you further.

Yes a complete reinstall or running your recovery CD would fix things like your identity theft which was probably done via some keystroke logger malware, but if you cannot reinstall for whatever reason, the two members mentioned above may be able to find and purge enough to get you going again.


A quote from ClassicS:
If you continue to use Torrent software, you will continue to get infected.

I trust that statement.

Edit:
But I am not trying to step on mjc's toes either. If he feels that it is imperative for you to wipe your drive clean and start over, well I'll defer to that also. /Edit

[Ajmukon]

PS: They're all in the links in my sig...

What?? you mean that little blue line thingy that i didn't see?

is that what your talking about?

*Squints really hard* hmmm.. still do not see it... :p :o :rolleyes: :eek: :D