[SpeedofLight]

Ive been infected with a worm thats in my userinit.exe constantly. I downloaded gmer and said i have an mbr rootkit. is this a false positive or is it legitimate? will it cure my problem?

---- Kernel code sections - GMER 1.0.15 ----

? vklfchlb.sys The system cannot find the file specified. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8BC5360, 0x20574D, 0xE8000020]
.text win32k.sys!EngAcquireSemaphore + 20E2 BF808308 5 Bytes JMP 8871F4D0
.text win32k.sys!EngFreeUserMem + 5BD2 BF80EE8F 5 Bytes JMP 8871F430
.text win32k.sys!EngMultiByteToWideChar + 2F32 BF8A0D51 5 Bytes JMP 8871F750
.text win32k.sys!EngMulDiv + 90FA BF8B4264 5 Bytes JMP 8871F610
.text win32k.sys!XLATEOBJ_iXlate + 3A50 BF8B9E25 5 Bytes JMP 8871F570
.text win32k.sys!EngUnicodeToMultiByteN + 1756 BF8C322E 5 Bytes JMP 8871F6B0
.text win32k.sys!PATHOBJ_bCloseFigure + 19F1 BF8F98FC 5 Bytes JMP 8871F7F0

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 00: MBR rootkit code detected

---- EOF - GMER 1.0.15 ----

[dvk01]

Download MBR Check to your desktop

• Right click MBRcheck.exe and select Run as Administrator (Vista) or Double click MBRcheck.exe to run it (XP)
• It will show a Black screen with some data on it
• it will create a log called MBRcheck_time and date.txt on desktop
• Post that resultant log here please
• Do NOT fix anything or run any suggested fix before we see the report