Inactive Odd Issue

[Inactive] Odd Issue

Hello. I have a very odd issue. Yesterday afternoon, my power went out and needless to say, my computer was on while it happened. Well, once the power came back on I tried to boot up my computer. I made it passed the log on screen, and noticed the entire thing was running slow. I tried to open up my internet browser (Firefox), and the computer froze. CTRL-ALT-DEL didn't work. So I rebooted. Again, I try this 3 or 4 times and get the same result. So I boot into safe mode, and I try a system restore. Now, the computer freezes before I can even open up the browser. So, I boot into safe mode with networking, and I try to use Firefox there. It still freezes. I then try IE, and oddly enough, it works! I can use internet explorer in safe mode, but when opening firefox in safe mode, it freezes up. So I thought, okay let me uninstall firefox, then reinstall it. Maybe that's the problem. But after trying that, it still doesn't work. Right now I'm able to go through all my files, watch videos, and use IE expolorer (While being in Safe mode). But I'm unable to use firefox, and I'm unable to boot into normal mode without it freezing on me. Any idea what this could mean? I'll post logs in my next reply.

 

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6726

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 9.0.8112.16421

5/30/2011 4:39:28 PM
mbam-log-2011-05-30 (16-39-28).txt

Scan type: Quick scan
Objects scanned: 147134
Time elapsed: 2 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-05-30 17:08:56
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\0000005c WDC_WD32 rev.01.0
Running: s8fbm9yq.exe; Driver: C:\Users\Jermaine\AppData\Local\Temp\uxlyapoc.sys


---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74A17817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [74A6A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [74A1BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [74A0F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74A175E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [74A0E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74A48395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [74A1DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [74A0FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [74A0FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [74A071CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [74A9CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [74A3C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [74A0D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74A06853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [74A0687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[248] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74A12AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusShutdown] [74A17817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCloneImage] [74A6A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDrawImageRectI] [74A1BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetInterpolationMode] [74A0F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusStartup] [74A175E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateFromHDC] [74A0E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74A48395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateBitmapFromStream] [74A1DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageHeight] [74A0FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageWidth] [74A0FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDisposeImage] [74A071CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipLoadImageFromFileICM] [74A9CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipLoadImageFromFile] [74A3C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDeleteGraphics] [74A0D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipFree] [74A06853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipAlloc] [74A0687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[1924] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetCompositingMode] [74A12AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp aswRdr.SYS (avast! TDI RDR Driver/AVAST Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Linkage@Export ??? da??????????????????????????????????????????????? ???<???:?????fil???'?'????? ???????3?????:?????;?%?? "???&????? ???????????oem14.inf???? ??? ??????????????????????????????netrasa.inf?????\SystemRoot\system32\drivers\adpu320.sys?y???????????i?????s? ??\SystemRoot\system32\drivers\adpu160m.sys????&?????$?&??????????????????????????????levice\NetBT_Tcpip6_{DF2EBF1A-3CAC-4E5E-8E03-A46CD17C4653}] DATAGRAM 8??D9}] SEQPACKET 12?????????????????????????f?????????????????????????????????????????????????????????@%SystemRoot%\System32\wshtcpip.dll,-60100??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????&C????N??!???????????????'?'????????????????? ??? ??? ?'nv????N?? ???5??????0???? ????????????? ???????%????????????(???????????????????????????? ??? ??????????? ???%??? ??? ??????????????{4d36e97d-e325-11ce-bfc1-08002be10318}???????????????!?????????????
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x1E 0x01 0xA8 0x67 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1D 0x7E 0x0A 0x19 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xCC 0x24 0x5D 0x15 ...
Reg HKLM\SYSTEM\ControlSet011\Services\LanmanServer\Linkage@Export ???d?d???????????2??ll????N??d???o????Dow|??{4d36e97d-e325-11ce-bfc1-08002be10318}?Dom??? ???????????????? ??d????????0?F? "?????ne????X??d???S???e??{4d36e97d-e325-11ce-bfc1-08002be10318}\0034?sc????F??d???F??????????????IO@0-0xFF:*;IO:HAL,MBRES;IRQ:HAL,*?8|E???d?????c???d????Keyboard Class??????mrxsmb??????v2.0|Action=Allow|Active=FALSE|Dir=In|Protocol=17|Profile=Domain|Profile=Public|LPort=3702|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=fdrespub|Name=@FirewallAPI.dll,-32809|Desc=@FirewallAPI.dll,-32810|EmbedCtxt=@FirewallAPI.dll,-32752|Edge=FALSE|???????????????????????????????????t???????????????????Network??????????????p??Mi??? ???c???0?????e10?? "NetBT" "Tcpip" "{1544BDD6-96D2-4D1B-A1E5-B4BFBAA745EC} "? "NetBT" "Tcpip" "{D41BB4E0-715C-418A-8AA6-8DFC60A623C6} "? "NetBT" "Tcpip" "{A74332CE-7E76-4A08-A6CB-F023D3724009} "? "NetBT" "Tcpip" "{DF0B9FC8-EF30-4592-94A4-601A3A1D4A7D} "? "NetBT" "Tcpip" "{1603E704-7751-44FD-9188-E30DEE7888ED} "? "NetBT" "Tcpip" "{BF55A200-C9EE-4E37-AD7A-6E27D940
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x85 0xD3 0x29 0xBC ...
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1D 0x7E 0x0A 0x19 ...
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xCC 0x24 0x5D 0x15 ...

---- EOF - GMER 1.0.15 ----

 

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Acer
BIOS Manufacturer: Phoenix Technologies, LTD
System Manufacturer: Acer
System Product Name: Aspire X1200
Logical Drives Mask: 0x0000006c

Kernel Drivers (total 123):
0x82E1D000 \SystemRoot\system32\ntkrnlpa.exe
0x831D7000 \SystemRoot\system32\hal.dll
0x8040C000 \SystemRoot\system32\kdcom.dll
0x80413000 \SystemRoot\system32\PSHED.dll
0x80424000 \SystemRoot\system32\BOOTVID.dll
0x8042C000 \SystemRoot\system32\CLFS.SYS
0x8046D000 \SystemRoot\system32\CI.dll
0x8054D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C9000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x806F4000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x806FD000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x80723000 \SystemRoot\system32\drivers\acpi.sys
0x80769000 \SystemRoot\system32\drivers\msisadrv.sys
0x80771000 \SystemRoot\system32\drivers\pci.sys
0x80798000 \SystemRoot\System32\drivers\partmgr.sys
0x807A7000 \SystemRoot\system32\drivers\volmgr.sys
0x807B6000 \SystemRoot\System32\drivers\volmgrx.sys
0x805D6000 \SystemRoot\system32\drivers\pciide.sys
0x805DD000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x805EB000 \SystemRoot\System32\drivers\mountmgr.sys
0x80400000 \SystemRoot\System32\Drivers\UBHelper.sys
0x8A60F000 \SystemRoot\system32\drivers\atapi.sys
0x8A617000 \SystemRoot\system32\drivers\ataport.SYS
0x8A635000 \SystemRoot\system32\DRIVERS\msahci.sys
0x8A63F000 \SystemRoot\system32\DRIVERS\nvstor32.sys
0x8A663000 \SystemRoot\system32\DRIVERS\storport.sys
0x8A6A4000 \SystemRoot\system32\drivers\fltmgr.sys
0x8A6D6000 \SystemRoot\system32\drivers\fileinfo.sys
0x8A6E6000 \SystemRoot\system32\DRIVERS\psdfilter.sys
0x8A6EF000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8A801000 \SystemRoot\system32\drivers\ndis.sys
0x8A90C000 \SystemRoot\system32\drivers\msrpc.sys
0x8A937000 \SystemRoot\system32\drivers\NETIO.SYS
0x8AA02000 \SystemRoot\System32\drivers\tcpip.sys
0x8AAEC000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8AC08000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8AD18000 \SystemRoot\system32\drivers\volsnap.sys
0x8AD59000 \SystemRoot\System32\Drivers\mup.sys
0x8AD68000 \SystemRoot\System32\drivers\ecache.sys
0x8AD8F000 \SystemRoot\system32\drivers\disk.sys
0x8ADA0000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x8ADC1000 \SystemRoot\system32\drivers\crcdisk.sys
0x8ADEC000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8ADF7000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8ADE1000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8AC00000 \SystemRoot\system32\DRIVERS\nvsmu.sys
0x8AB2B000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8AB35000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8AB73000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8A972000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8AB82000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8AD51000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
0x8AB9A000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8ABAA000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8ABB8000 \SystemRoot\system32\DRIVERS\wacomvhid.sys
0x8ABBB000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8ABCB000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8ADEA000 \SystemRoot\system32\DRIVERS\WacomVKHid.sys
0x8ABD2000 \SystemRoot\system32\DRIVERS\WacomVTHid.sys
0x8A760000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8ABD4000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8ABDF000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8A78F000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8A79A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8A7BD000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8A7CC000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8A7E0000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x80600000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8A7F5000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8A600000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8ABF6000 \SystemRoot\system32\DRIVERS\swenum.sys
0x80610000 \SystemRoot\system32\DRIVERS\ks.sys
0x8063A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x80644000 \SystemRoot\system32\DRIVERS\umbus.sys
0x80651000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8ABF8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x80686000 \SystemRoot\system32\DRIVERS\wacommousefilter.sys
0x8068E000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x80697000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x806A8000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x806B1000 \SystemRoot\System32\Drivers\Null.SYS
0x806B8000 \SystemRoot\System32\Drivers\Beep.SYS
0x806BF000 \SystemRoot\System32\drivers\vga.sys
0x806CB000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8EA02000 \SystemRoot\System32\drivers\watchdog.sys
0x8EA0E000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8EA16000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8EA21000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8EA2F000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8EA38000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8EA58000 \SystemRoot\system32\DRIVERS\smb.sys
0x8EA6C000 \SystemRoot\system32\drivers\afd.sys
0x8EAB4000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x8EAB9000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8EAEB000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8EB01000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8EB0F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8EB4B000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8EB55000 \SystemRoot\System32\Drivers\dfsc.sys
0x8EB6C000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8EB83000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8EB85000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8EB8E000 \SystemRoot\system32\DRIVERS\WUSB54GCx86.sys
0x8EBD2000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x8EBE7000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8EBF4000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x8AB07000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
0x988C0000 \SystemRoot\System32\win32k.sys
0x8EA4E000 \SystemRoot\System32\drivers\Dxapi.sys
0x98AD0000 \SystemRoot\System32\drivers\dxg.sys
0x98B00000 \SystemRoot\System32\TSDDD.dll
0x98B80000 \SystemRoot\System32\framebuf.dll
0x98B90000 \SystemRoot\System32\ATMFD.DLL
0x9AE03000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9AE2D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9AE37000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9AE50000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9AE65000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9AE84000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9AEBD000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9AED5000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x9AEEB000 \??\C:\Users\Jermaine\AppData\Local\Temp\uxlyapoc.sys
0x77B00000 \Windows\System32\ntdll.dll

Processes (total 28):
0 System Idle Process
4 System
344 C:\Windows\System32\smss.exe
404 csrss.exe
440 csrss.exe
448 C:\Windows\System32\wininit.exe
492 C:\Windows\System32\winlogon.exe
520 C:\Windows\System32\services.exe
532 C:\Windows\System32\lsass.exe
540 C:\Windows\System32\lsm.exe
692 C:\Windows\System32\svchost.exe
748 C:\Windows\System32\svchost.exe
784 C:\Windows\System32\svchost.exe
864 C:\Windows\System32\svchost.exe
892 C:\Windows\System32\svchost.exe
924 C:\Windows\System32\svchost.exe
980 C:\Windows\System32\svchost.exe
996 C:\Windows\System32\svchost.exe
1132 C:\Windows\System32\wisptis.exe
1140 C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
1192 C:\Windows\System32\svchost.exe
1360 C:\Windows\System32\svchost.exe
1964 C:\Windows\System32\wisptis.exe
1972 C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
248 C:\Windows\explorer.exe
1924 C:\Windows\explorer.exe
2104 C:\Program Files\Windows NT\Accessories\wordpad.exe
2728 C:\Users\Jermaine\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000004`00100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000026`c9704e00 (NTFS)

PhysicalDrive0 Model Number: WDC WD3200AAJS-22B4A, Rev: 01.0

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: D668348080F48C0B8285A3EE42767FC5A5F0E989


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

 

.
DDS (Ver_11-05-19.01) - NTFSx86 NETWORK
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_24
Run by Jermaine at 17:12:03 on 2011-05-30
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.2814.2016 [GMT -4:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Users\Jermaine\Desktop\dds.scr
C:\Windows\system32\WSCRIPT.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = hxxp://eis.esnips.com/page/search/?client_uuid=bda82ac0-85c3-4b48-b0d2-41fde8d1391d
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: {B530A9A4-1722-4D16-AAD6-AA85E3AD2ADE} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
mRun: [Acer Empowering Technology Monitor] c:\program files\acer\empowering technology\SysMonitor.exe
mRun: [EmpoweringTechnology] c:\program files\acer\empowering technology\Framework.Launcher.exe boot
mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [BkupTray] "c:\program files\newtech infosystems\nti backup now 5\BkupTray.exe "
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Acer Product Registration] "c:\program files\acer\acer registration\ACE1.exe" /startup
mRun: [Ask and Record FLV Service] "c:\program files\ask & record toolbar\FLVSrvc.exe" /run
mRun: [PAC207_Monitor] c:\windows\pixart\pac207\Monitor.exe
mRun: [Freecorder FLV Service] "c:\program files\freecorder\FLVSrvc.exe" /run
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRunOnce: [GrpConv] grpconv -o
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
AppInit_DLLs: c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\jermaine\appdata\roaming\mozilla\firefox\profiles\ow3uqcqr.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\users\jermaine\appdata\local\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\users\jermaine\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\jermaine\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\jermaine\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
.
---- FIREFOX POLICIES ----


.
============= SERVICES / DRIVERS ===============
.
R3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\drivers\WUSB54GCx86.sys [2009-6-12 256000]
R3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\drivers\WacomVTHid.sys [2009-12-24 13224]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-3 441176]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-6-17 307928]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-6-17 19544]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-6-17 53592]
S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-7-11 42184]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2008-4-30 24576]
S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-30 136176]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-26 45056]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-26 131072]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-12-24 4408616]
S2 WTouchService;WTouch Service;c:\program files\wtouch\WTouchService.exe [2009-12-24 112936]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-30 136176]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-4-29 43552]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [2008-2-13 618112]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2009-12-24 15656]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-05-30 19:55:08 -------- d-----w- c:\users\jermaine\appdata\local\temp
2011-05-30 19:54:21 -------- d-sh--w- C:\$RECYCLE.BIN
2011-05-30 19:14:52 -------- d-----w- c:\windows\system32\wbem\repository
2011-05-30 19:14:43 6962000 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{8b7b2dc6-0dee-4fc3-9428-9d42bbfa1474}\mpengine.dll
2011-05-30 19:13:46 -------- d-----w- c:\windows\Registration
2011-05-30 11:09:45 0 ---ha-w- c:\users\jermaine\appdata\local\BITA72.tmp
2011-05-29 02:27:40 -------- d-----w- c:\users\jermaine\appdata\local\{B960F906-AC71-434C-84B7-9E934F83483B}
2011-05-14 03:27:40 -------- d-----w- c:\users\jermaine\appdata\local\{48505BA4-355F-4706-9B4B-6FD419EA5375}
2011-05-12 01:51:47 -------- d-----w- c:\users\jermaine\appdata\local\{8C0C168D-2948-4B49-951B-B50179027974}
2011-05-11 22:29:30 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-05-11 20:45:46 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2011-05-03 16:29:51 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
.
==================== Find3M ====================
.
2011-05-10 12:10:59 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 11:59:44 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-03-12 21:55:52 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-03-10 17:03:51 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-10 17:03:51 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:42:03 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 15:40:13 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40:07 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40:05 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40:05 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40:04 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35:36 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25:11 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-03-02 15:44:27 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
.
============= FINISH: 17:12:34.51 ===============

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-05-19.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 10/11/2006 3:16:55 AM
System Uptime: 5/30/2011 4:29:54 PM (1 hours ago)
.
Motherboard: Acer | | WMCP78M
Processor: Athlon(tm) Dual Core Processor 4050e | Socket AM2 | 2100/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 139 GiB total, 44.365 GiB free.
D: is FIXED (NTFS) - 143 GiB total, 142.671 GiB free.
F: is CDROM ()
G: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0000
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter
PNP Device ID: ROOT\*ISATAP\0000
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: NVIDIA nForce Networking Controller
Device ID: PCI\VEN_10DE&DEV_0760&SUBSYS_01531025&REV_A2\3&2411E6FE&0&50
Manufacturer: NVIDIA
Name: NVIDIA nForce 10/100/1000 Mbps Networking Controller
PNP Device ID: PCI\VEN_10DE&DEV_0760&SUBSYS_01531025&REV_A2\3&2411E6FE&0&50
Service: NVENETFD
.
==== System Restore Points ===================
.
RP894: 5/21/2011 5:45:50 AM - Scheduled Checkpoint
RP895: 5/22/2011 3:20:18 AM - Scheduled Checkpoint
RP896: 5/23/2011 6:44:51 PM - Scheduled Checkpoint
RP897: 5/24/2011 2:08:24 PM - Windows Update
RP898: 5/26/2011 12:49:42 AM - Scheduled Checkpoint
RP899: 5/27/2011 3:19:31 AM - Scheduled Checkpoint
RP900: 5/28/2011 - Scheduled Checkpoint
RP901: 5/28/2011 6:06:38 AM - Windows Update
RP902: 5/29/2011 1:36:51 AM - Scheduled Checkpoint
RP903: 5/29/2011 2:25:39 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
µTorrent
Acer eDataSecurity Management
Acer Empowering Technology
Acer eRecovery Management
Acer Registration
Acer ScreenSaver
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Shockwave Player 11.5
Agere Systems PCI-SV92EX Soft Modem
AIM 7
AMCap
Ask & Record Toolbar 4.00
Ask Toolbar
AV Input Selection
avast! Free Antivirus
Bamboo
CamStudio
CamStudio Lossless Codec v1.4
CCleaner
CEP (Color Enable Package) v.9.2 (beta)
Color Efex Pro 3.0 Wacom Edition 3
D3DX10
DivX Setup
Download Updater (AOL LLC)
Freecorder
Google Gears
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java Auto Updater
Java(TM) 6 Update 24
LightScribe 1.4.142.1
Linksys Compact Wireless-G USB Adapter Driver - WUSB54GC
Madden NFL 08
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework SDK (English) 1.1
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Microsoft WSE 3.0 Runtime
Mozilla Firefox 4.0.1 (x86 en-US)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
NVIDIA Photoshop Plug-ins
OGA Notifier 2.0.0048.0
PeerBlock 1.1 (r518)
Photo****et
QuickTime
Realtek High Definition Audio Driver
Recuva
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2466156)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft Office Excel 2007 (KB2464583)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Segoe UI
System Requirements Lab
System Requirements Lab CYRI
The Sims™ 3
TS3 Install Helper Monkey
Unity Web Player
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.18
VLC media player 1.0.5
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Messenger
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Media Player Firefox Plugin
WinRAR archiver
Xvid 1.2.1 final uninstall
.
==== Event Viewer Messages From Past Week ========
.
5/30/2011 9:34:16 AM, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.105.365.0 Loading engine version: 1.1.6903.0
5/30/2011 9:29:44 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
5/30/2011 9:28:47 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswRdr aswSnx aswSP aswTdi DfsC i8042prt NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr sptd tdx Wanarpv6
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/30/2011 9:28:47 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
5/30/2011 9:28:00 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
5/30/2011 9:28:00 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
5/30/2011 9:27:27 AM, Error: EventLog [6008] - The previous system shutdown at 9:24:50 AM on 5/30/2011 was unexpected.
5/30/2011 9:24:02 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
5/30/2011 8:57:36 AM, Error: EventLog [6008] - The previous system shutdown at 8:46:18 AM on 5/30/2011 was unexpected.
5/30/2011 8:45:12 AM, Error: EventLog [6008] - The previous system shutdown at 7:09:45 AM on 5/30/2011 was unexpected.
5/30/2011 6:50:26 AM, Error: EventLog [6008] - The previous system shutdown at 9:19:01 PM on 5/29/2011 was unexpected.
5/30/2011 4:49:26 PM, Error: nvstor32 [5] - A parity error was detected on \Device\RaidPort0.
5/30/2011 4:32:19 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
5/30/2011 4:32:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
5/30/2011 4:32:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
5/30/2011 4:32:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/30/2011 4:32:09 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
5/30/2011 4:31:55 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx aswSP aswTdi i8042prt spldr sptd Wanarpv6
5/30/2011 4:31:55 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
5/30/2011 4:30:48 PM, Error: EventLog [6008] - The previous system shutdown at 4:27:34 PM on 5/30/2011 was unexpected.
5/30/2011 4:29:59 PM, Error: sptd [4] - Driver detected an internal error in its data structures for .
5/30/2011 4:26:52 PM, Error: EventLog [6008] - The previous system shutdown at 4:25:09 PM on 5/30/2011 was unexpected.
5/30/2011 3:53:26 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
5/30/2011 3:40:40 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service stisvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
5/30/2011 3:14:40 PM, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80092003 Error description: An error occurred while reading or writing to a file. Signatures loading: Backup Loading signature version: 1.105.365.0 Loading engine version: 1.1.6903.0
5/30/2011 3:08:39 PM, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80092003 Error description: An error occurred while reading or writing to a file. Signatures loading: Backup Loading signature version: 1.105.365.0 Loading engine version: 1.1.6903.0
5/30/2011 3:04:48 PM, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80092003 Error description: An error occurred while reading or writing to a file. Signatures loading: Backup Loading signature version: 1.105.365.0 Loading engine version: 1.1.6903.0
5/30/2011 3:00:11 PM, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80092003 Error description: An error occurred while reading or writing to a file. Signatures loading: Backup Loading signature version: 1.105.365.0 Loading engine version: 1.1.6903.0
5/29/2011 9:18:07 PM, Error: EventLog [6008] - The previous system shutdown at 9:14:34 PM on 5/29/2011 was unexpected.
5/29/2011 9:13:55 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.2.2 for the Network Card with network address 0018F8A56CE7 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).
5/29/2011 9:13:48 PM, Error: EventLog [6008] - The previous system shutdown at 9:12:45 PM on 5/29/2011 was unexpected.
5/24/2011 6:59:30 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {4991D34B-80A1-4291-83B6-3328366B9097} to the user LOISLANE\Jermaine SID (S-1-5-21-3562517957-1098623875-406478773-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
.
==== End Of File ===========================

 

I opened the first program, and while it was running it gave me the blue screen of death. I didn't get a chance to read the message, but it said something about IRQL not less or equal..

 

I tried to run the second program as you advised, and I got the error:

NTSTATUSCODE: 0XC00035F

 

Before the outage? No. I just used the computer as normal with no problems. All this started to happen after the outage, so I restored it after the fact. Back to the 27th I believe.

 

I'm not sure what you mean by run your name.exe but here's the logs:


This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 05/30/2011 at 21:37:52.
Operating System: Windows Vista (TM) Home Premium


Processes terminated by Rkill or while it was running:

.exe


Rkill completed on 05/30/2011 at 21:37:55.

 

ComboFix 11-05-30.06 - Jermaine 05/30/2011 21:19:08.2.2 - x86 NETWORK
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.2814.2156 [GMT -4:00]
Running from: c:\users\Jermaine\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-04-28 to 2011-05-31 )))))))))))))))))))))))))))))))
.
.
2011-05-31 01:24 . 2011-05-31 01:24 -------- d-----w- c:\users\Jermaine\AppData\Local\temp
2011-05-31 01:24 . 2011-05-31 01:24 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-05-31 01:24 . 2011-05-31 01:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-30 23:29 . 2011-05-30 23:30 34560 ----a-w- c:\windows\system32\drivers\Normandy.sys
2011-05-30 19:14 . 2011-05-30 23:57 -------- d-----w- c:\windows\system32\wbem\repository
2011-05-30 19:14 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8B7B2DC6-0DEE-4FC3-9428-9D42BBFA1474}\mpengine.dll
2011-05-30 11:09 . 2011-05-30 11:09 0 ---ha-w- c:\users\Jermaine\AppData\Local\BITA72.tmp
2011-05-30 11:01 . 2011-05-30 11:01 -------- d-----w- c:\programdata\WindowsSearch
2011-05-29 02:27 . 2011-05-29 02:27 -------- d-----w- c:\users\Jermaine\AppData\Local\{B960F906-AC71-434C-84B7-9E934F83483B}
2011-05-14 03:27 . 2011-05-14 03:28 -------- d-----w- c:\users\Jermaine\AppData\Local\{48505BA4-355F-4706-9B4B-6FD419EA5375}
2011-05-12 01:51 . 2011-05-12 01:51 -------- d-----w- c:\users\Jermaine\AppData\Local\{8C0C168D-2948-4B49-951B-B50179027974}
2011-05-11 22:29 . 2011-05-11 22:29 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-05-11 20:45 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-05-03 16:29 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-01 19:32 . 2011-05-01 19:32 -------- d-----w- c:\program files\Recuva
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-10 12:10 . 2010-07-11 17:05 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 12:10 . 2009-06-17 10:17 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-10 12:03 . 2009-06-17 10:17 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 12:02 . 2009-06-17 10:17 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 11:59 . 2009-06-17 10:17 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 11:59 . 2009-06-17 10:17 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 11:59 . 2009-06-17 10:17 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-06 12:39 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-12 21:55 . 2011-04-27 04:53 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-03-10 17:03 . 2011-04-14 01:28 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-10 17:03 . 2011-04-14 01:28 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:42 . 2011-04-14 01:27 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 15:40 . 2011-04-27 04:54 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40 . 2011-04-27 04:54 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-27 04:54 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-27 04:54 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-27 04:54 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35 . 2011-04-27 04:54 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25 . 2011-04-14 01:27 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-03-02 15:44 . 2011-04-14 01:27 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2009-07-31 23:06 . 2010-08-15 18:03 89600 ----a-w- c:\program files\mozilla firefox\plugins\Extras.dll
2009-07-31 22:47 . 2010-08-15 18:03 112128 ----a-w- c:\program files\mozilla firefox\plugins\Movies.dll
2011-04-14 16:26 . 2011-05-30 20:22 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-02-11 18:40 365960 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-02-11 365960]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-02-11 365960]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-16 68856]
"Aim "= "c:\program files\AIM\aim.exe" [2010-04-19 3972440]
"DAEMON Tools Lite "= "c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor "= "c:\program files\Acer\Empowering Technology\SysMonitor.exe" [2008-04-25 319488]
"EmpoweringTechnology "= "c:\program files\Acer\Empowering Technology\Framework.Launcher.exe" [2008-04-25 319488]
"eDataSecurity Loader "= "c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-05 526896]
"BkupTray "= "c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-26 28672]
"RtHDVCpl "= "RtHDVCpl.exe" [2008-03-26 5369856]
"Acer Product Registration "= "c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392]
"Ask and Record FLV Service "= "c:\program files\Ask & Record Toolbar\FLVSrvc.exe" [2009-03-10 156672]
"PAC207_Monitor "= "c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-11 323584]
"Freecorder FLV Service "= "c:\program files\Freecorder\FLVSrvc.exe" [2010-06-26 167936]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"DivXUpdate "= "c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv "= "grpconv -o" [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1 "=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Jermaine^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ubisoft register.lnk]
path=c:\users\Jermaine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ubisoft register.lnk
backup=c:\windows\pss\ubisoft register.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-09 20:56 77824 ----a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-07-24 22:13 327984 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001
.
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-01-02 691696]
R1 aswSnx;aswSnx; [x]
R1 aswSP;aswSP; [x]
R2 aswFsBlk;aswFsBlk; [x]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-04-25 24576]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 136176]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-26 45056]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-26 131072]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-07-15 4408616]
R2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-07-15 112936]
R3 ALSysIO;ALSysIO;c:\users\Jermaine\AppData\Local\Temp\ALSysIO.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 136176]
R3 Normandy;Normandy SR2; [x]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-04-22 43552]
R3 PAC207;PC Camer@;c:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-01-30 15656]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\DRIVERS\WUSB54GCx86.sys [2007-03-12 256000]
S3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\DRIVERS\WacomVTHid.sys [2009-05-20 13224]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 01:11]
.
2011-05-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 01:11]
.
2011-05-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3562517957-1098623875-406478773-1000Core.job
- c:\users\Jermaine\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-26 19:16]
.
2011-05-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3562517957-1098623875-406478773-1000UA.job
- c:\users\Jermaine\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-26 19:16]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = hxxp://eis.esnips.com/page/search/?client_uuid=bda82ac0-85c3-4b48-b0d2-41fde8d1391d
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Jermaine\AppData\Roaming\Mozilla\Firefox\Profiles\ow3uqcqr.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties


.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-30 21:24
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2011-05-30 21:25:57
ComboFix-quarantined-files.txt 2011-05-31 01:25
ComboFix2.txt 2011-05-30 19:55
ComboFix3.txt 2010-06-12 08:30
.
Pre-Run: 47,224,696,832 bytes free
Post-Run: 47,214,403,584 bytes free
.
- - End Of File - - 663F260547B39EE262D7D4CCCD18E6CD

 

Do you mean in Normal Mode?

 

I just tried, it freezes before it can be completed