Inactive Redirection virus

[Inactive] Redirection virus

Another person here with a redirect virus. I've had it for about a year now. I managed to stop it once from redirecting (somehow) a few months ago, and it was fine for a while. I stopped using my computer when I got a new netbook, but my netbook is too lame to play games on, so I went back to this for gaming. I remembered that I was extremely lax with protection/updates when I was using this, so I decided to do most of the windows updates that I hadn't done (there were 80, god help me).

Anyway, after I finished with the updates, the redirects came back. It used to take me about 6 tries to get to a page, and now I can't even get to any. I have to make the page by homepage, then close firefox off and open it up again just to get it to load. It's fine if I'm browsing within a page, but as soon as I open up something from google, bam. I was doing some research on it, and someone mentioned checking my hosts file. I don't have one. All I have is lmhosts.sam, which I read was a sample file. I've tried running tdsskiller, and the first time I ran it it came up with two viruses. I think one was a trojan, and the other may have been a virus. I deleted them both anyway, but the redirect virus didn't go away. I tried renaming tdsskiller to 345yefds.com and ran it again, and again it did nothing.

I tried running combofix and it told me that wininit.exe and windows explorer were infected, and attempted to correct them. It said it worked with wininit.exe, but said something else with windows explorer. It went through the processes, and then restarted my computer, and then when it did that it wouldn't get to the user loading screen. It was all just black. I had to do a system restore back to a few days ago to even get it to boot up windows, so combofix is definitely out of the question. I've run malwarebytes, and it only came up with a trojan that wasn't the redirect virus. I tried Trendmicro's Housecall, and nothing. I'm basically buggered, and I desperately need help. I'm not smart enough to figure this garbage out on my own, and I've done everything people have said to do. I'm running Vista, 32 bit.

 

I downloaded Avast, and ran the scanner, and it came up with 4 infections. I have no idea how to post this particular log, so I'll just copy what it says:

File name: C:\Windows\explorer.exe | Severity: High | Threat: Win32:WinPatch
File name: C:\Windows\System32\nt.dll | Severity: High | Threat: Win32:Bamital-BS [Trj]
File name: C:\Windows\System32\wininit.exe | Severity: High | Threat: Win32:WinPatch
File name: C:\Windows\explorer.exe | Severity: High | Threat: Win32:WinPatch

So it looks like the bamital trojan is the one giving me my problems. I'm currently doing the rest of what you said to do, but I thought since it's going to take a while that I'd update you on that while I'm working on the rest.

 

MalwareBytes log:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7629

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19088

6/09/2011 9:13:38 PM
mbam-log-2011-09-06 (21-13-38).txt

Scan type: Quick scan
Objects scanned: 199330
Time elapsed: 12 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

---------- aswMBR

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-07 08:37:55
-----------------------------
08:37:55.905 OS Version: Windows 6.0.6001 Service Pack 1
08:37:55.905 Number of processors: 1 586 0x170A
08:37:55.906 ComputerName: INQUIST UserName: Danel
08:38:09.167 Initialize success
08:38:09.709 AVAST engine defs: 11070401
08:38:24.965 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
08:38:24.973 Disk 0 Vendor: ST9160310AS HP07 Size: 152627MB BusType: 3
08:38:26.995 Disk 0 MBR read successfully
08:38:26.997 Disk 0 MBR scan
08:38:27.000 Disk 0 unknown MBR code
08:38:27.018 Disk 0 scanning sectors +312573952
08:38:27.134 Disk 0 scanning C:\Windows\system32\drivers
08:38:38.876 Service scanning
08:38:40.328 Modules scanning
08:38:50.280 Disk 0 trace - called modules:
08:38:50.301 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS PCIIDEX.SYS msahci.sys
08:38:50.304 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x860749d0]
08:38:50.308 3 CLASSPNP.SYS[805b5745] -> nt!IofCallDriver -> [0x857d6540]
08:38:50.313 5 acpi.sys[806986a0] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85764398]
08:38:51.093 AVAST engine scan C:\Windows
08:38:51.902 File: C:\Windows\explorer.exe **INFECTED** Win32:WinPatch
08:38:54.959 AVAST engine scan C:\Windows\system32
08:40:22.653 File: C:\Windows\system32\nt.dll **INFECTED** Win32:Bamital-BS [Trj]
08:41:12.506 File: C:\Windows\system32\wininit.exe **INFECTED** Win32:WinPatch
08:41:44.070 AVAST engine scan C:\Windows\system32\drivers
08:42:10.837 AVAST engine scan C:\Users\Danel
08:54:05.574 AVAST engine scan C:\ProgramData
08:56:45.941 Scan finished successfully
08:57:04.330 Disk 0 MBR has been saved successfully to "C:\Users\Danel\Desktop\MBR.dat "
08:57:04.338 The log file has been saved successfully to "C:\Users\Danel\Desktop\aswMBR.txt "

---------- DDS
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.19088 BrowserJavaVersion: 1.6.0_27
Run by Danel at 9:02:10 on 2011-09-07
Microsoft® Windows Vistaâ„¢ Home Basic 6.0.6001.1.1252.61.1033.18.1978.886 [GMT 10:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\System32\WTMKM.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Creative\Software Update 3\SoftAuto.exe
C:\Program Files\Clarus\Samsung Auto Backup\ISFGuage.exe
C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\SMINST\BLService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskeng.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\atwtusb.exe
C:\Windows\system32\atwtusb.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_au&c=91&bd=Presario&pf=cnnb
uSearch Page =
uSearch Bar =
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_au&c=91&bd=Presario&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_au&c=91&bd=Presario&pf=cnnb
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - c:\progra~1\search~1\SEARCH~1.DLL
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [SoftAuto.exe] "c:\program files\creative\software update 3\SoftAuto.exe "
uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\AxAutoMntSrv.exe" -automount
uRun: [Samsung_AppInst] h:\samsungsoftware\AppInst.exe
mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe "
mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe "
mRun: [Persistence] "c:\windows\system32\igfxpers.exe "
mRun: [SynTPEnh] "c:\program files\synaptics\syntp\SynTPEnh.exe "
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe "
mRun: [HP Health Check Scheduler] "c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe "
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe "
mRun: [WirelessAssistant] "c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe "
mRun: [MacrokeyManager] WTMKM.exe
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\users\danel\appdata\roaming\micros~1\windows\startm~1\programs\startup\samsun~3.lnk - c:\program files\clarus\samsung auto backup\ISFGuage.exe
StartupFolder: c:\users\danel\appdata\roaming\micros~1\windows\startm~1\programs\startup\samsun~2.lnk - c:\program files\clarus\samsung auto backup\ISFRealTimeD.exe
StartupFolder: c:\users\danel\appdata\roaming\micros~1\windows\startm~1\programs\startup\samsun~1.lnk - c:\program files\clarus\samsung auto backup\ISFTimerD.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FD26658D-8620-40D2-84D0-BB6A9487D317} : DhcpNameServer = 192.168.1.1
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} -
Notify: igfxcui - igfxdev.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe "
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\danel\appdata\roaming\mozilla\firefox\profiles\dgw2mlbo.default\
FF - prefs.js: browser.startup.homepage - hxxp://forum.eeeuser.com/viewtopic.php?id=44783
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\sony\media go\npmediago.dll
FF - plugin: c:\users\danel\appdata\roaming\mozilla\firefox\profiles\dgw2mlbo.default\extensions\{000f1ea4-5e08-4564-a29b-29076f63a37a}\plugins\npsoe.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: LoudMo Contextual Ad Assistant: {c8e08f4b-76ac-df55-6c95-2388913986ab} - c:\program files\mozilla firefox\extensions\{c8e08f4b-76ac-df55-6c95-2388913986ab}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
FF - Ext: Lazarus: Form Recovery: lazarus@interclue.com - %profile%\extensions\lazarus@interclue.com
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Easy YouTube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Add to Search Bar: add-to-searchbox@maltekraus.de - %profile%\extensions\add-to-searchbox@maltekraus.de
FF - Ext: SOE Web Installer: {000F1EA4-5E08-4564-A29B-29076F63A37A} - %profile%\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\avast software\avast\webrep\FF
.
---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
============= SERVICES / DRIVERS ===============
.
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-9-6 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-9-6 309848]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-9-6 19544]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-9-6 54104]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-9-6 42184]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2009-2-26 365952]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2009-12-24 370688]
R2 WTService;WTService;c:\windows\system32\atwtusb.exe -s --> c:\windows\system32\atwtusb.exe -s [?]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-9-22 112128]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-4-20 136176]
S2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240]
S3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-2-26 222512]
S3 CTUPnPSv;Creative Centrale Media Server;c:\program files\creative\creative centrale\CTUPnPSv.exe [2008-5-21 64000]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-4-20 136176]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [2010-4-12 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [2010-4-12 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [2010-4-12 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [2010-4-12 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [2010-4-12 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [2010-4-12 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [2010-4-12 109864]
S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [2010-3-26 16640]
.
=============== Created Last 30 ================
.
2011-09-06 10:17:33 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 10:17:29 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-09-06 10:16:42 40112 ----a-w- c:\windows\avastSS.scr
2011-09-06 10:16:14 -------- d-----w- c:\programdata\AVAST Software
2011-09-06 10:16:14 -------- d-----w- c:\program files\AVAST Software
2011-09-06 09:56:41 7152464 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{1e505e55-034b-41e6-8b91-31cb2d262fc5}\mpengine.dll
2011-09-03 00:42:39 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-09-03 00:42:39 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-09-03 00:42:39 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-09-03 00:42:39 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-09-03 00:42:39 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-09-02 00:43:23 241152 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2011-09-02 00:43:20 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2011-09-02 00:43:11 714240 ----a-w- c:\windows\system32\timedate.cpl
2011-09-02 00:42:44 147456 ----a-w- c:\windows\system32\Faultrep.dll
2011-09-02 00:42:44 125952 ----a-w- c:\windows\system32\wersvc.dll
2011-09-02 00:42:22 523776 ----a-w- c:\windows\system32\RMActivate_isv.exe
2011-09-02 00:42:22 511488 ----a-w- c:\windows\system32\RMActivate.exe
2011-09-02 00:42:22 472576 ----a-w- c:\windows\system32\secproc_isv.dll
2011-09-02 00:42:22 472064 ----a-w- c:\windows\system32\secproc.dll
2011-09-02 00:42:22 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2011-09-02 00:42:22 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2011-09-02 00:42:22 329216 ----a-w- c:\windows\system32\msdrm.dll
2011-09-02 00:42:22 151040 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2011-09-02 00:42:22 151040 ----a-w- c:\windows\system32\secproc_ssp.dll
2011-09-02 00:39:31 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-09-02 00:39:31 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-09-01 23:37:46 -------- d-----w- c:\users\danel\appdata\local\Temp(23)
2011-09-01 23:17:08 -------- d-s---w- C:\ComboFix
2011-09-01 22:17:08 7680 ----a-w- c:\program files\internet explorer\iecompat.dll
2011-09-01 21:44:02 97800 ----a-w- c:\windows\system32\infocardapi.dll
2011-09-01 21:44:02 622080 ----a-w- c:\windows\system32\icardagt.exe
2011-09-01 21:44:02 37384 ----a-w- c:\windows\system32\infocardcpl.cpl
2011-09-01 21:44:02 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2011-09-01 21:44:01 11264 ----a-w- c:\windows\system32\icardres.dll
2011-09-01 21:43:58 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2011-09-01 21:33:44 158720 ----a-w- c:\windows\system32\mscorier.dll
2011-09-01 21:33:38 83968 ----a-w- c:\windows\system32\mscories.dll
2011-09-01 21:30:21 231936 ----a-w- c:\windows\system32\msshsq.dll
2011-09-01 21:29:25 -------- d-----w- c:\program files\MSXML 4.0
2011-09-01 21:20:47 310784 ----a-w- c:\windows\system32\unregmp2.exe
2011-09-01 21:20:47 1418752 ----a-w- c:\program files\windows media player\setup_wm.exe
2011-09-01 21:20:45 7680 ----a-w- c:\windows\system32\spwmp.dll
2011-09-01 21:20:45 4096 ----a-w- c:\windows\system32\msdxm.ocx
2011-09-01 21:20:45 4096 ----a-w- c:\windows\system32\dxmasf.dll
2011-09-01 21:20:45 107520 ----a-w- c:\program files\windows media player\wmpshare.exe
2011-09-01 21:20:45 107520 ----a-w- c:\program files\windows media player\wmpconfig.exe
2011-09-01 21:10:12 531968 ----a-w- c:\windows\system32\comctl32.dll
2011-09-01 21:10:02 31744 ----a-w- c:\windows\system32\msvidc32.dll
2011-09-01 21:10:02 22528 ----a-w- c:\windows\system32\msyuv.dll
2011-09-01 21:10:02 13312 ----a-w- c:\windows\system32\msrle32.dll
2011-09-01 21:10:01 91136 ----a-w- c:\windows\system32\avifil32.dll
2011-09-01 21:10:01 82944 ----a-w- c:\windows\system32\mciavi32.dll
2011-09-01 21:10:01 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2011-09-01 21:10:01 11776 ----a-w- c:\windows\system32\tsbyuv.dll
2011-09-01 21:10:00 65024 ----a-w- c:\windows\system32\avicap32.dll
2011-09-01 21:10:00 123904 ----a-w- c:\windows\system32\msvfw32.dll
2011-09-01 21:09:48 168960 ----a-w- c:\program files\windows media player\wmplayer.exe
2011-09-01 21:09:47 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2011-09-01 21:09:16 501760 ----a-w- c:\windows\system32\usp10.dll
2011-09-01 21:09:13 66048 ----a-w- c:\program files\windows mail\wabmig.exe
2011-09-01 21:09:13 515584 ----a-w- c:\program files\windows mail\wab.exe
2011-09-01 21:09:13 33280 ----a-w- c:\program files\windows mail\wabfind.dll
2011-09-01 21:09:01 292864 ----a-w- c:\windows\system32\atmfd.dll
2011-09-01 21:09:00 72704 ----a-w- c:\windows\system32\fontsub.dll
2011-09-01 21:09:00 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-09-01 21:09:00 10240 ----a-w- c:\windows\system32\dciman32.dll
2011-09-01 21:07:22 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-09-01 21:07:15 513024 ----a-w- c:\windows\system32\wlansvc.dll
2011-09-01 21:07:15 302592 ----a-w- c:\windows\system32\wlansec.dll
2011-09-01 21:07:15 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2011-09-01 21:07:15 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2011-09-01 21:07:09 1399296 ----a-w- c:\windows\system32\msxml6.dll
2011-09-01 21:07:04 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-09-01 21:05:56 71680 ----a-w- c:\windows\system32\atl.dll
2011-09-01 21:05:50 1315840 ----a-w- c:\windows\system32\ole32.dll
2011-09-01 21:05:49 339968 ----a-w- c:\program files\windows nt\accessories\wordpad.exe
2011-09-01 21:05:44 126464 ----a-w- c:\windows\system32\spoolsv.exe
2011-09-01 21:05:39 562176 ----a-w- c:\windows\system32\msdtcprx.dll
2011-09-01 21:05:39 38912 ----a-w- c:\windows\system32\xolehlp.dll
2011-09-01 21:05:35 160256 ----a-w- c:\windows\system32\wkssvc.dll
2011-09-01 21:05:31 157184 ----a-w- c:\windows\system32\t2embed.dll
2011-09-01 21:05:26 2042368 ----a-w- c:\windows\system32\win32k.sys
2011-09-01 21:05:19 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-09-01 19:49:22 1169408 ----a-w- c:\windows\system32\sdclt.exe
2011-09-01 19:49:14 150016 ----a-w- c:\program files\movie maker\MOVIEMK.exe
2011-09-01 19:49:14 10926592 ----a-w- c:\program files\movie maker\MOVIEMK.dll
2011-09-01 19:49:07 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-09-01 19:49:06 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-09-01 19:47:59 551424 ----a-w- c:\windows\system32\rpcss.dll
2011-09-01 19:43:18 24064 ----a-w- c:\windows\system32\amxread.dll
2011-09-01 19:43:18 13824 ----a-w- c:\windows\system32\apilogen.dll
2011-09-01 19:40:50 81920 ----a-w- c:\windows\system32\consent.exe
2011-09-01 19:40:44 1257472 ----a-w- c:\windows\system32\msxml3.dll
2011-09-01 19:40:29 2048 ----a-w- c:\windows\system32\tzres.dll
2011-09-01 19:38:29 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2011-09-01 19:38:22 43520 ----a-w- c:\windows\system32\msdxm.tlb
2011-09-01 19:38:22 18432 ----a-w- c:\windows\system32\amcompat.tlb
2011-09-01 19:38:10 49152 ----a-w- c:\windows\system32\csrsrv.dll
2011-09-01 19:38:10 375808 ----a-w- c:\windows\system32\winsrv.dll
2011-09-01 19:38:04 61440 ----a-w- c:\windows\system32\msasn1.dll
2011-09-01 19:37:57 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2011-09-01 19:37:31 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-09-01 19:37:30 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-09-01 19:37:26 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-01 19:37:21 281600 ----a-w- c:\windows\system32\raschap.dll
2011-09-01 19:37:21 244224 ----a-w- c:\windows\system32\rastls.dll
2011-09-01 19:37:11 351232 ----a-w- c:\windows\system32\WSDApi.dll
2011-09-01 19:36:06 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2011-09-01 19:21:05 276992 ----a-w- c:\windows\system32\schannel.dll
2011-09-01 19:13:39 171520 ----a-w- c:\windows\system32\wintrust.dll
2011-09-01 19:08:49 98304 ----a-w- c:\windows\system32\cabview.dll
2011-09-01 18:50:13 2421760 ----a-w- c:\windows\system32\wucltux.dll
2011-09-01 18:49:26 87552 ----a-w- c:\windows\system32\wudriver.dll
2011-09-01 18:49:02 33792 ----a-w- c:\windows\system32\wuapp.exe
2011-09-01 18:49:02 171608 ----a-w- c:\windows\system32\wuwebv.dll
2011-09-01 15:38:35 7152464 ----a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll
2011-09-01 15:38:26 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-09-01 13:20:00 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-09-01 13:51:19 342584 ----a-w- c:\windows\system32\drivers\elxstor.sys
2011-07-18 19:05:24 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-07-06 14:56:47 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-07-06 09:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 09:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-05 08:37:00 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 08:37:00 69632 ----a-w- c:\windows\system32\QuickTime.qts
.
============= FINISH: 9:03:48.17 ===============

---------- DDS Attach File

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vistaâ„¢ Home Basic
Boot Device: \Device\HarddiskVolume1
Install Date: 5/06/2009 8:33:53 PM
System Uptime: 7/09/2011 6:50:37 AM (3 hours ago)
.
Motherboard: Quanta | | 3069
Processor: Intel(R) Celeron(R) CPU 900 @ 2.20GHz | CPU | 2194/800mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 139 GiB total, 81.442 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 1.752 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
.
2007 Microsoft Office system
7-Zip 4.65
Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader X (10.1.0)
Adobe Shockwave Player
Adobe Shockwave Player 11.6
Adobe Stock Photos 1.0
AGEIA PhysX v6.10.25
Agere Systems HDA Modem
AIM 7
Any DVD Converter Professional 4.0.5
Apple Application Support
Apple Software Update
Applian FLV Player
Atheros Driver Installation Program
µTorrent
Audacity 1.3.8 (Unicode)
AudibleManager
avast! Free Antivirus
AviSynth 2.5
Belarc Advisor 8.1
BORGChat (remove only)
Business Contact Manager for Outlook 2007
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon iP2700 series Printer Driver
Canon Utilities Easy-PhotoPrint EX
Canon Utilities My Printer
Canon Utilities Solution Menu
Creative Centrale
Creative Removable Disk Manager
Creative Software Update
Creative ZEN Mozaic User's Guide
Digital Video Repair version 2.2.0.1
DivX Plus DirectShow Filters
DivX Setup
DivX Version Checker
Download Updater (AOL LLC)
DVD Flick 1.3.0.7
ESU for Microsoft Vista
Fable - The Lost Chapters
Free Realms
Google Update Helper
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Common Access Service Library
HP Customer Experience Enhancements
HP DVD Play 3.7
HP Help and Support
HP Quick Launch Buttons 6.40 M1
HP Total Care Advisor
HP Total Care Setup
HP Update
HP User Guides 0138
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPNetworkAssistant
ImgBurn
Intel(R) Graphics Media Accelerator Driver
IrfanView (remove only)
Jasc Animation Shop 3
Java Auto Updater
Java(TM) 6 Update 27
La nuit des sacrifies
LAME v3.98.2 for Audacity
LightScribe System Software 1.14.17.1
ljArchive
Malwarebytes' Anti-Malware version 1.51.1.1800
Media Go
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.21)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
NVIDIA GAME System Software 2.8.1
Pando Media Booster
Pen Pad Driver with Macro Key Manager
PlayStation(R)Network Downloader
PSP Video 9 6
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek USB 2.0 Card Reader
Recuva
Samsung Auto Backup
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
SoftStylus
Sony Ericsson Device Data
Sony Ericsson Drivers
SpeedFan (remove only)
Spy Sweeper Core
swMSM
Synaptics Pointing Device Driver
Trillian
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Office 2007 (KB934528)
Vampire - The Masquerade Bloodlines
VC80CRTRedist - 8.0.50727.4053
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
Voice Finger
WeissRO Lite v2.1.4
Windows 7 Upgrade Advisor
Windows Media Player Firefox Plugin
Yahoo! Messenger
.
==== End Of File ===========================


I have a problem with GMER. I can run it and I have the log, but it's extremely long and my computer freezes when I try to post it. Should I re-run it with less options, or cut out the stuff that's basically just letters/numbers, or what?

 

Here we are:

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6001 (Service Pack 1)
Number of processors #1
==============================================
>Drivers
==============================================
0x8C404000 C:\Windows\system32\DRIVERS\igdkmd32.sys 7319552 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)
0x82018000 C:\Windows\system32\ntkrnlpa.exe 3911680 bytes (Microsoft Corporation, NT Kernel & System)
0x82018000 PnpManager 3911680 bytes
0x82018000 RAW 3911680 bytes
0x82018000 WMIxWDM 3911680 bytes
0x95680000 Win32k 2113536 bytes
0x95680000 C:\Windows\System32\win32k.sys 2113536 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8860B000 C:\Windows\system32\drivers\ql2300.sys 1277952 bytes (QLogic Corporation, QLogic Fibre Channel Stor Miniport Driver)
0x8D003000 C:\Windows\system32\DRIVERS\AGRSM.sys 1204224 bytes (Agere Systems, SoftModem Device Driver)
0x8CC0E000 C:\Windows\system32\DRIVERS\athr.sys 1200128 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver)
0x88A0D000 C:\Windows\System32\Drivers\Ntfs.sys 1110016 bytes (Microsoft Corporation, NT File System Driver)
0x8260E000 C:\Windows\system32\DRIVERS\NDIS.SYS 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x8887A000 C:\Windows\System32\drivers\tcpip.sys 954368 bytes (Microsoft Corporation, TCP/IP Driver)
0x804C5000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)
0xB14BA000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x88409000 C:\Windows\system32\drivers\megasr.sys 749568 bytes (LSI Corporation, Inc., LSI MegaRAID Software RAID Driver)
0xA8A05000 C:\Windows\system32\drivers\spsys.sys 716800 bytes (Microsoft Corporation, security processor)
0x82C0D000 C:\Windows\system32\drivers\iastorv.sys 659456 bytes (Intel Corporation, Intel Matrix Storage Manager driver (base))
0x8CAFF000 C:\Windows\System32\drivers\dxgkrnl.sys 651264 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x82E99000 C:\Windows\system32\drivers\elxstor.sys 606208 bytes (Emulex, Storport Miniport Driver for LightPulse HBAs)
0x80601000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)
0x88809000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x8D157000 C:\Windows\System32\Drivers\aswSnx.SYS 458752 bytes (AVAST Software, avast! Virtualization Driver)
0xA8AB4000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x82D44000 C:\Windows\system32\drivers\adp94xx.sys 434176 bytes (Adaptec, Inc., Adaptec Windows SAS/SATA Storport Driver)
0x8040B000 C:\Windows\system32\mcupdate_GenuineIntel.dll 393216 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x88743000 C:\Windows\system32\drivers\ql40xx.sys 348160 bytes (QLogic Corporation, QLogic iSCSI Storport Miniport Driver)
0xB140B000 C:\Windows\System32\DRIVERS\srv.sys 323584 bytes (Microsoft Corporation, Server driver)
0x82DAE000 C:\Windows\system32\drivers\adpahci.sys 311296 bytes (Adaptec, Inc., Adaptec Windows SATA Storport Driver)
0x8D66C000 C:\Windows\System32\Drivers\aswSP.SYS 303104 bytes (AVAST Software, avast! self protection module)
0x82740000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8CF5C000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x8068A000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)
0xB1472000 C:\Windows\system32\DRIVERS\atksgt.sys 274432 bytes
0x80484000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)
0x82CEE000 C:\Windows\system32\drivers\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x8CE4D000 C:\Windows\system32\drivers\HdAudio.sys 258048 bytes (Microsoft Corporation, High Definition Audio Function Driver)
0x8CBB6000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8D60F000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x884E6000 C:\Windows\system32\drivers\uliahci.sys 245760 bytes (ULi Electronics Inc., ULi SATA Controller Driver)
0x807AF000 C:\Windows\system32\DRIVERS\NETIO.SYS 237568 bytes (Microsoft Corporation, Network I/O Subsystem)
0xA8BAB000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x88B24000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x8D722000 C:\Windows\system32\drivers\aswMonFlt.sys 229376 bytes (AVAST Software, avast! File System Minifilter for Windows 2003/Vista)
0x8CE08000 C:\Windows\system32\DRIVERS\usbhub.sys 212992 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x823D3000 ACPI_HAL 208896 bytes
0x823D3000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x8856F000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x8CFA4000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8CD7B000 C:\Windows\system32\DRIVERS\SynTP.sys 200704 bytes (Synaptics, Inc., Synaptics Touchpad Driver)
0x889AE000 C:\Windows\system32\DRIVERS\msiscsi.sys 188416 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)
0x80756000 C:\Windows\system32\DRIVERS\ssidrv.sys 188416 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper Interdiction Driver)
0x8CE8C000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x88522000 C:\Windows\system32\drivers\ulsata2.sys 180224 bytes (Promise Technology, Inc., Promise SATAII150 Series Windows Drivers)
0x80784000 C:\Windows\system32\DRIVERS\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x82F9B000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)
0x8D76D000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x8D7B4000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x88B8E000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)
0x806E1000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x82E33000 C:\Windows\system32\drivers\adpu320.sys 155648 bytes (Adaptec, Inc., Adaptec StorPort Ultra320 SCSI Driver)
0x82E0D000 C:\Windows\system32\drivers\SCSIPORT.SYS 155648 bytes (Microsoft Corporation, SCSI Port Driver)
0x8CEB9000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0x8CD33000 C:\Windows\system32\DRIVERS\Rtlh86.sys 151552 bytes (Realtek Corporation , Realtek 8101E/8168/8169 NDIS6 32-bit Driver )
0x889DC000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x805A5000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8D136000 C:\Windows\system32\drivers\IntcHdmi.sys 135168 bytes (Intel(R) Corporation, Intel(R) High Definition Audio HDMI)
0x887DC000 C:\Windows\system32\drivers\ulsata.sys 135168 bytes (Promise Technology, Inc., Promise Ultra/Sata Series Driver for Win2003)
0x8CEDE000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x8854E000 C:\Windows\system32\drivers\vsmraid.sys 135168 bytes (VIA Technologies Inc.,Ltd, VIA RAID DRIVER FOR AMD-X86-64)
0xA8B6C000 C:\Windows\system32\drivers\mrxdav.sys 131072 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xA8B8C000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x82CB6000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)
0xA8B21000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)
0x80717000 C:\Windows\system32\drivers\mpio.sys 114688 bytes (Microsoft Corporation, MultiPath Support Bus-Driver)
0x805C6000 C:\Windows\system32\drivers\adpu160m.sys 110592 bytes (Adaptec, Inc., Adaptec LH Ultra160 Driver (x86))
0x88963000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x8D707000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x827DF000 C:\Windows\system32\drivers\nvraid.sys 110592 bytes (NVIDIA Corporation, NVIDIA® nForce(TM) RAID Driver)
0x82F5F000 C:\Windows\system32\drivers\lsi_fc.sys 106496 bytes (LSI Logic, LSI Logic Fusion-MPT FC Driver (StorPort))
0x82CD4000 C:\Windows\system32\drivers\lsi_scsi.sys 106496 bytes (LSI Logic, LSI Logic Fusion-MPT SCSI Driver (StorPort))
0x827C5000 C:\Windows\system32\drivers\msdsm.sys 106496 bytes (Microsoft Corporation, Microsoft Device Specific Module)
0xA8B3E000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x8CDB9000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x82F79000 C:\Windows\system32\drivers\lsi_sas.sys 98304 bytes (LSI Logic, LSI Logic Fusion-MPT SAS Driver (StorPort))
0xA8BE4000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x8D655000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x8CDDA000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x82E6D000 C:\Windows\system32\drivers\arc.sys 90112 bytes (Adaptec, Inc., Adaptec RAID Storport Driver)
0x82E83000 C:\Windows\system32\drivers\arcsas.sys 90112 bytes (Adaptec, Inc., Adaptec SAS RAID WS03 Driver)
0x8D6B6000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x8CFD6000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x8CF29000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)
0xA8B57000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x885D4000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x88B69000 C:\Windows\system32\drivers\sbp2port.sys 86016 bytes (Microsoft Corporation, SBP-2 Protocol Driver)
0x887A5000 C:\Windows\system32\drivers\sisraid4.sys 86016 bytes (Silicon Integrated Systems, SiS AHCI Stor-Miniport Driver)
0x82E59000 C:\Windows\system32\drivers\djsvs.sys 81920 bytes (Adaptec, Inc., Adaptec Ultra SCSI miniport)
0x885C0000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x8CF48000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)
0x8CD58000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)
0x8D7A1000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x82FD2000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x8899C000 C:\Windows\system32\DRIVERS\HDAudBus.sys 73728 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x88BB5000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x8CE3C000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x8046B000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x885A1000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x82F37000 C:\Windows\system32\drivers\iirsp.sys 65536 bytes (Intel Corp./ICP vortex GmbH, Intel/ICP Raid Storport Driver)
0x8D75D000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x827B5000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)
0x885E9000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)
0x8897E000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)
0x80708000 C:\Windows\system32\drivers\isapnp.sys 61440 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0x8D6F8000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)
0x88B7E000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0x80733000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)
0x885B1000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x8898D000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x82731000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)
0x958C0000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)
0x8CFEC000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x884CB000 C:\Windows\system32\drivers\nfrd960.sys 57344 bytes (IBM Corporation, IBM ServeRAID Controller Driver)
0x8CF12000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x82791000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8D6CC000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x8D129000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)
0x884D9000 C:\Windows\system32\drivers\nvstor.sys 53248 bytes (NVIDIA Corporation, NVIDIA® nForce(TM) Sata Performance Driver)
0x88798000 C:\Windows\system32\drivers\sisraid2.sys 53248 bytes (Microsoft Corporation, SiS RAID Stor Miniport Driver)
0x82FC5000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x8CB9E000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x8067D000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0x82F47000 C:\Windows\system32\drivers\iteatapi.sys 49152 bytes (Integrated Technology Express, Inc., ITE IT8211 ATA/ATAPI SCSI miniport)
0x82F53000 C:\Windows\system32\drivers\iteraid.sys 49152 bytes (Integrated Technology Express, Inc., ITE IT8212 ATA RAID SCSI miniport)
0x887BA000 C:\Windows\system32\drivers\symc8xx.sys 49152 bytes (LSI Logic, LSI Logic 8XX SCSI Miniport Driver)
0xB15A2000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8D1EE000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8D6D9000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0x82D39000 C:\Windows\system32\drivers\hpcisss.sys 45056 bytes (Hewlett-Packard Company, Smart Array Storport Driver)
0x8CD70000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)
0x8CDAE000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)
0x884C0000 C:\Windows\system32\drivers\mraid35x.sys 45056 bytes (LSI Logic Corporation, MegaRAID RAID Controller Driver for Windows Vista/Longhorn for x86)
0x8CF07000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x8CDF1000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8074B000 C:\Windows\system32\DRIVERS\ssfs0bbc.sys 45056 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper FileSystem Filter Driver)
0x887C6000 C:\Windows\system32\drivers\sym_hi.sys 45056 bytes (LSI Logic, LSI Logic Hi-Perf SCSI Miniport Driver)
0x887D1000 C:\Windows\system32\drivers\sym_u3.sys 45056 bytes (LSI Logic, LSI Logic Ultra160 SCSI Miniport Driver)
0x82719000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x88BF1000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8CBAB000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x82727000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)
0x8D6E4000 C:\Windows\System32\Drivers\dump_msahci.sys 40960 bytes
0x8D6EE000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x82F2D000 C:\Windows\system32\drivers\i2omp.sys 40960 bytes (Microsoft Corporation, I2O Miniport Driver)
0x82F91000 C:\Windows\system32\drivers\megasas.sys 40960 bytes (LSI Corporation, MEGASAS RAID Controller Driver for Windows Vista/Longhorn for x86)
0x82D2F000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)
0x8CC00000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x8D797000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x8D64B000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0xB1598000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x8CF3F000 C:\Windows\System32\Drivers\aswTdi.SYS 36864 bytes (AVAST Software, avast! TDI Filter Driver)
0xB15AE000 C:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0x88BC6000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)
0x8D1C7000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x8CF20000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0x80742000 C:\Windows\system32\DRIVERS\sshrmd.sys 36864 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper Mini Driver)
0x958A0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x88A00000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8CDD1000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0x806D0000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x82CAE000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x8047C000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x827AD000 C:\Windows\system32\drivers\cmdide.sys 32768 bytes (CMD Technology, Inc., CMD PCI IDE Bus Driver)
0x80403000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0x806D9000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x8D1DE000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8CEFF000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x88B5D000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x807E9000 C:\Windows\system32\drivers\viaide.sys 32768 bytes (VIA Technologies, Inc., VIA Generic PCI IDE Bus Driver)
0x88B1C000 C:\Windows\system32\drivers\wd.sys 32768 bytes (Microsoft Corporation, Microsoft Watchdog Timer Driver)
0x8279F000 C:\Windows\system32\drivers\aliide.sys 28672 bytes (Acer Laboratories Inc., ALi mini IDE Driver)
0x827A6000 C:\Windows\system32\drivers\amdide.sys 28672 bytes (Microsoft Corporation, AMD IDE Driver)
0x8D1D7000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x8D1E7000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x8278A000 C:\Windows\system32\drivers\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0x8D1D0000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x82600000 C:\Windows\system32\drivers\pciide.sys 28672 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x8D1FA000 C:\Windows\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver)
0x8CD6B000 C:\Windows\system32\DRIVERS\HpqKbFiltr.sys 20480 bytes (Hewlett-Packard Development Company, L.P., HpqKbFiltr Keyboard Filter Driver)
0xB14B5000 C:\Windows\system32\DRIVERS\lirsgt.sys 20480 bytes
0x88A09000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x88B65000 C:\Windows\system32\speedfan.sys 16384 bytes (Almico Software, Speed Fan x32 Driver)
0x8D75A000 C:\Windows\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver)
0x82724000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0x8CDFC000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x8CDAC000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0x88B8D000 C:\Windows\system32\giveio.sys 4096 bytes
==============================================
>Stealth
==============================================

 

I did the ComboFix and it actually went through to the log this time, so I have the log, but I ended up having to do a system restore because explorer.exe wasn't working and wouldn't work no matter what I tried.

ComboFix 11-09-08.03 - Danel 09/09/2011 3:41.1.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.61.1033.18.1978.1166 [GMT 10:00]
Running from: c:\users\Danel\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\dll
c:\windows\system32\nt.dll
.
---- Previous Run -------
.
c:\users\Danel\AppData\Local\Microsoft\Windows\Temporary Internet Files\cookies.sqlite
.
c:\windows\explorer.exe . . . is infected!!
.
Infected copy of c:\windows\System32\wininit.exe was found and disinfected
Restored copy from - c:\windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-08-08 to 2011-09-08 )))))))))))))))))))))))))))))))
.
.
2011-09-08 18:15 . 2011-09-08 18:27 -------- d-----w- c:\users\Danel\AppData\Local\temp
2011-09-08 18:15 . 2011-09-08 18:15 -------- d-----w- c:\users\Stacey\AppData\Local\temp
2011-09-08 18:15 . 2011-09-08 18:15 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-09-08 18:15 . 2011-09-08 18:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-06 10:17 . 2011-07-04 11:32 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-06 10:17 . 2011-07-04 11:36 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-06 10:17 . 2011-07-04 11:32 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-06 10:17 . 2011-07-04 11:35 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-06 10:17 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 10:17 . 2011-07-04 11:32 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-09-06 10:16 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-09-06 10:16 . 2011-07-04 11:43 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-06 10:16 . 2011-09-06 10:16 -------- d-----w- c:\programdata\AVAST Software
2011-09-06 10:16 . 2011-09-06 10:16 -------- d-----w- c:\program files\AVAST Software
2011-09-03 00:42 . 2009-11-08 00:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-09-03 00:42 . 2009-11-08 00:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-09-03 00:42 . 2009-11-08 00:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-09-03 00:42 . 2009-11-08 00:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-09-03 00:42 . 2009-11-08 00:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-09-02 00:43 . 2008-10-22 03:57 241152 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2011-09-02 00:43 . 2011-05-02 12:00 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-09-02 00:43 . 2009-10-23 17:42 714240 ----a-w- c:\windows\system32\timedate.cpl
2011-09-02 00:42 . 2008-09-18 04:56 125952 ----a-w- c:\windows\system32\wersvc.dll
2011-09-02 00:42 . 2008-09-18 04:56 147456 ----a-w- c:\windows\system32\Faultrep.dll
2011-09-02 00:42 . 2010-01-25 12:48 472576 ----a-w- c:\windows\system32\secproc_isv.dll
2011-09-02 00:42 . 2010-01-25 12:48 151040 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2011-09-02 00:42 . 2010-01-25 12:48 151040 ----a-w- c:\windows\system32\secproc_ssp.dll
2011-09-02 00:42 . 2010-01-25 12:48 472064 ----a-w- c:\windows\system32\secproc.dll
2011-09-02 00:42 . 2010-01-25 12:45 329216 ----a-w- c:\windows\system32\msdrm.dll
2011-09-02 00:42 . 2010-01-25 08:35 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2011-09-02 00:42 . 2010-01-25 08:35 523776 ----a-w- c:\windows\system32\RMActivate_isv.exe
2011-09-02 00:42 . 2010-01-25 08:34 511488 ----a-w- c:\windows\system32\RMActivate.exe
2011-09-02 00:42 . 2010-01-25 08:34 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2011-09-02 00:39 . 2011-03-03 14:56 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-09-02 00:39 . 2011-03-03 13:01 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-09-01 23:37 . 2011-09-02 00:08 -------- d-----w- c:\users\Danel\AppData\Local\Temp(23)
2011-09-01 22:17 . 2010-10-19 04:27 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2011-09-01 21:44 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2011-09-01 21:44 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2011-09-01 21:44 . 2008-06-20 01:14 37384 ----a-w- c:\windows\system32\infocardcpl.cpl
2011-09-01 21:44 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2011-09-01 21:44 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2011-09-01 21:43 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2011-09-01 21:33 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2011-09-01 21:33 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2011-09-01 21:30 . 2010-09-20 09:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2011-09-01 21:29 . 2011-09-01 21:29 -------- d-----w- c:\program files\MSXML 4.0
2011-09-01 21:20 . 2009-09-10 15:21 1418752 ----a-w- c:\program files\Windows Media Player\setup_wm.exe
2011-09-01 21:20 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2011-09-01 21:20 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\msdxm.ocx
2011-09-01 21:20 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2011-09-01 21:20 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2011-09-01 21:20 . 2009-07-14 10:59 107520 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2011-09-01 21:20 . 2009-07-14 10:58 107520 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2011-09-01 21:10 . 2010-08-31 15:40 531968 ----a-w- c:\windows\system32\comctl32.dll
2011-09-01 21:10 . 2009-12-28 12:32 22528 ----a-w- c:\windows\system32\msyuv.dll
2011-09-01 21:10 . 2009-12-28 12:32 31744 ----a-w- c:\windows\system32\msvidc32.dll
2011-09-01 21:10 . 2009-12-28 12:32 13312 ----a-w- c:\windows\system32\msrle32.dll
2011-09-01 21:10 . 2009-12-28 12:35 11776 ----a-w- c:\windows\system32\tsbyuv.dll
2011-09-01 21:10 . 2009-12-28 12:31 82944 ----a-w- c:\windows\system32\mciavi32.dll
2011-09-01 21:10 . 2009-12-28 12:31 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2011-09-01 21:10 . 2009-12-28 12:28 91136 ----a-w- c:\windows\system32\avifil32.dll
2011-09-01 21:10 . 2009-12-28 12:32 123904 ----a-w- c:\windows\system32\msvfw32.dll
2011-09-01 21:10 . 2009-12-28 12:28 65024 ----a-w- c:\windows\system32\avicap32.dll
2011-09-01 21:09 . 2010-09-10 16:35 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2011-09-01 21:09 . 2010-09-10 16:37 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2011-09-01 21:09 . 2010-04-16 16:10 501760 ----a-w- c:\windows\system32\usp10.dll
2011-09-01 21:09 . 2010-10-12 15:48 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2011-09-01 21:09 . 2010-10-12 13:52 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2011-09-01 21:09 . 2010-10-12 13:52 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2011-09-01 21:09 . 2011-02-16 13:24 292864 ----a-w- c:\windows\system32\atmfd.dll
2011-09-01 21:09 . 2011-02-16 15:29 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-09-01 21:09 . 2010-06-16 15:12 72704 ----a-w- c:\windows\system32\fontsub.dll
2011-09-01 21:09 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2011-09-01 21:07 . 2011-02-22 12:51 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-09-01 21:07 . 2009-07-11 19:32 513024 ----a-w- c:\windows\system32\wlansvc.dll
2011-09-01 21:07 . 2009-07-11 19:32 302592 ----a-w- c:\windows\system32\wlansec.dll
2011-09-01 21:07 . 2009-07-11 19:32 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2011-09-01 21:07 . 2009-07-11 19:29 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2011-09-01 21:07 . 2009-08-10 11:01 1399296 ----a-w- c:\windows\system32\msxml6.dll
2011-09-01 21:07 . 2011-04-14 14:24 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-09-01 21:05 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll
2011-09-01 21:05 . 2010-06-28 16:15 1315840 ----a-w- c:\windows\system32\ole32.dll
2011-09-01 21:05 . 2010-06-28 14:31 339968 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2011-09-01 21:05 . 2010-08-17 13:32 126464 ----a-w- c:\windows\system32\spoolsv.exe
2011-09-01 21:05 . 2008-06-06 03:27 38912 ----a-w- c:\windows\system32\xolehlp.dll
2011-09-01 21:05 . 2008-06-06 03:27 562176 ----a-w- c:\windows\system32\msdtcprx.dll
2011-09-01 21:05 . 2009-06-10 12:12 160256 ----a-w- c:\windows\system32\wkssvc.dll
2011-09-01 21:05 . 2010-08-26 16:07 157184 ----a-w- c:\windows\system32\t2embed.dll
2011-09-01 21:05 . 2011-06-02 12:59 2042368 ----a-w- c:\windows\system32\win32k.sys
2011-09-01 21:05 . 2011-04-21 13:16 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-09-01 19:49 . 2010-12-14 15:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
2011-09-01 19:49 . 2010-06-17 17:15 10926592 ----a-w- c:\program files\Movie Maker\MOVIEMK.dll
2011-09-01 19:49 . 2010-06-17 15:49 150016 ----a-w- c:\program files\Movie Maker\MOVIEMK.exe
2011-09-01 19:49 . 2011-04-29 12:49 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-09-01 19:49 . 2011-04-29 12:49 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-09-01 19:47 . 2009-03-03 04:39 551424 ----a-w- c:\windows\system32\rpcss.dll
2011-09-01 19:43 . 2009-03-17 03:38 13824 ----a-w- c:\windows\system32\apilogen.dll
2011-09-01 19:43 . 2009-03-17 03:38 24064 ----a-w- c:\windows\system32\amxread.dll
2011-09-01 19:40 . 2010-10-18 14:01 81920 ----a-w- c:\windows\system32\consent.exe
2011-09-01 19:40 . 2010-06-11 15:30 1257472 ----a-w- c:\windows\system32\msxml3.dll
2011-09-01 19:40 . 2010-10-28 12:56 2048 ----a-w- c:\windows\system32\tzres.dll
2011-09-01 19:38 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2011-09-01 19:38 . 2009-07-14 08:30 43520 ----a-w- c:\windows\system32\msdxm.tlb
2011-09-01 19:38 . 2009-07-14 08:30 18432 ----a-w- c:\windows\system32\amcompat.tlb
2011-09-01 19:38 . 2011-04-20 14:47 375808 ----a-w- c:\windows\system32\winsrv.dll
2011-09-01 19:38 . 2011-04-20 14:44 49152 ----a-w- c:\windows\system32\csrsrv.dll
2011-09-01 19:38 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll
2011-09-01 19:37 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2011-09-01 19:37 . 2010-12-17 16:43 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-09-01 19:37 . 2010-12-17 15:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-09-01 19:37 . 2010-06-16 15:59 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-01 19:37 . 2009-10-07 12:41 244224 ----a-w- c:\windows\system32\rastls.dll
2011-09-01 19:37 . 2009-10-07 12:41 281600 ----a-w- c:\windows\system32\raschap.dll
2011-09-01 19:37 . 2009-08-10 13:05 351232 ----a-w- c:\windows\system32\WSDApi.dll
2011-09-01 19:36 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2011-09-01 19:21 . 2011-04-29 14:54 276992 ----a-w- c:\windows\system32\schannel.dll
2011-09-01 19:13 . 2009-12-23 12:43 171520 ----a-w- c:\windows\system32\wintrust.dll
2011-09-01 19:08 . 2010-01-15 00:04 98304 ----a-w- c:\windows\system32\cabview.dll
2011-09-01 18:50 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2011-09-01 18:50 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2011-09-01 18:50 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2011-09-01 18:50 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2011-09-01 18:49 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2011-09-01 18:49 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-01 13:51 . 2006-11-02 07:36 342584 ----a-w- c:\windows\system32\drivers\elxstor.sys
2011-08-15 22:48 . 2011-09-06 09:56 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1E505E55-034B-41E6-8B91-31CB2D262FC5}\mpengine.dll
2011-07-18 19:05 . 2010-06-17 15:30 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-07-06 09:52 . 2010-05-11 03:11 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 09:52 . 2010-05-11 03:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-05 08:37 . 2011-07-05 08:37 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 08:37 . 2011-07-05 08:37 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-20 11:00 . 2011-06-20 11:00 0 ---ha-w- c:\users\Danel\AppData\Local\BITFAE3.tmp
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoftAuto.exe "= "c:\program files\Creative\Software Update 3\SoftAuto.exe" [2008-05-28 401408]
"AlcoholAutomount "= "c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2010-08-20 33120]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2008-10-28 150040]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2008-10-28 178712]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2008-10-28 154136]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-04 1410344]
"QPService "= "c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
"HP Health Check Scheduler "= "c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update "= "c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"WirelessAssistant "= "c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-12-08 432432]
"MacrokeyManager "= "WTMKM.exe" [2007-11-13 1969824]
"DivXUpdate "= "c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\users\Danel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung Auto Backup Guage.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFGuage.exe [2011-1-2 823296]
Samsung Auto Backup Real-Time Daemon.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2011-1-2 65536]
Samsung Auto Backup Scheduler.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFTimerD.exe [2011-1-2 102400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-20 136176]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-12-05 222512]
R3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-20 136176]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [2009-03-25 86824]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 15016]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 114728]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 106208]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 26024]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [2009-03-25 104744]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [2009-03-25 109864]
R3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [2008-11-18 16640]
S0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2009-11-06 29808]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-07-04 54104]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-12-24 365952]
S2 WTService;WTService;c:\windows\system32\atwtusb.exe [2007-12-05 364192]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-09-22 112128]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-20 06:38]
.
2011-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-20 06:38]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_au&c=91&bd=Presario&pf=cnnb
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Danel\AppData\Roaming\Mozilla\Firefox\Profiles\dgw2mlbo.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.hotfrog.com.au/Companies/Red-Balloon-Days
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: LoudMo Contextual Ad Assistant: {c8e08f4b-76ac-df55-6c95-2388913986ab} - c:\program files\Mozilla Firefox\extensions\{c8e08f4b-76ac-df55-6c95-2388913986ab}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
FF - Ext: Lazarus: Form Recovery: lazarus@interclue.com - %profile%\extensions\lazarus@interclue.com
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Easy YouTube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Add to Search Bar: add-to-searchbox@maltekraus.de - %profile%\extensions\add-to-searchbox@maltekraus.de
FF - Ext: SOE Web Installer: {000F1EA4-5E08-4564-A29B-29076F63A37A} - %profile%\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{389943B0-C3A2-4E69-82CB-8596A84CB3DC} - c:\progra~1\SEARCH~1\SEARCH~1.DLL
HKCU-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe
HKCU-Run-ISUSPM - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
HKCU-Run-Samsung_AppInst - h:\samsungsoftware\AppInst.exe
SafeBoot-31022013.sys
SafeBoot-89462169.sys
AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
AddRemove-Belarc Advisor - c:\progra~1\Belarc\Advisor\Uninstall.exe
AddRemove-LAME for Audacity_is1 - c:\program files\Lame for Audacity\unins000.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-09 04:26
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Samsung_AppInst = h:\samsungsoftware\AppInst.exe???????????????????????????????????????????????????????@$???????p??????????????????? ??????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Creative\Shared Files\CTDevSrv.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
.
**************************************************************************
.
Completion time: 2011-09-09 04:36:31 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-08 18:36
.
Pre-Run: 87,156,527,104 bytes free
Post-Run: 87,052,877,824 bytes free
.
- - End Of File - - A480965AB55516833073F116137623BC

 

It didn't work properly again, and didn't finish ComboFix or come up with the log file. But I wrote down what it said just in case.

"System file is infected !! Attempting to restore "C:\Windows\explorer.exe "

Deleting files:

C:\Windows\system32\dll
C:\Windows\system32\nt.dll

System file is infected !! Attempting to restore "C:\Windows\System32\wininit.exe "
Successfully restored :> "

Then it rebooted windows. Once again, my computer stopped on the logging off screen, so I was forced to hit the power button, and then turn it back on. I got this message once it loaded up to the user screen:

"C:\Windows\system32\ntl.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or software vendor for support. "

Then I got this message. It's the same one I've gotten every time I've run ComboFix and I'll have to do another system restore unless you'd like me to do something else?

"Windows Explorer has stopped working

A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available. "

The only thing that shows on my screen is black with my cursor. I can move the cursor and go to the task manager etc. I can't use my computer in the meantime, and I'm on my netbook now.

 

Do I do the system restore and then follow the steps?

 

I've got the reatogo-x-pe desktop thing up, but whenever I click OTLPE, a black window flashes, and then I'm asked to browse for a folder. The options are:

RAMdisk (B:
Local Disk (C:
RECOVERY (D:
ReatogoPE (X:
Shared Documents

 

Whenever I try directing it anywhere, it says

"RunScanner Error
Target is not windows 2000 or later "

 

It won't let me do system restore. The screen goes light blue and I can move the cursor around, but nothing happens. I don't have any kind of windows CD, either.