philinedinburgh

Kenny, Thank goodness. that's a wait of my mind, whilst removing combofix, it seemed to fight against Mcafee, Mcafee asked did the pup want to be trusted, I said yes and then ran it again. All good, system restore done and clean up is running. Honestly thank you very much, If you ever find your way to edinburgh, scotland email me tedroach@yahoo.com and I'll shout you a pint. Thanks again.

ok, i'll update Mcafee to inform about Java, things seem ok. Google is working fine, i seem to be able to run all manner of software now... Do you think that's the virus gone?

Kenny, I have followed your instructions, updated malwarebytes, quick scan, two objects were detected, both were highlighted, removed and then restarted. Whilst the scan was ongoing Mcafee advised that a JAVA file was trying to request outbound access which i declined. c:\documents and settings\el philo\local settings\temp\jre-6u15-windows-i586-iftw.exe I don't know if it is relevant. Thanks again for spedding so much time on this, here is my log: Malwarebytes' Anti-Malware 1.40 Database version: 2725 Windows 5.1.2600 Service Pack 3 01/09/2009 17:19:10 mbam-log-2009-09-01 (17-19-10).txt Scan type: Quick Scan Objects scanned: 109678 Time elapsed: 8 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Kenny no worries. Much obliged for your help. This may sound silly, but it'll be ok to switch off, I don't want to restart and find out that i'm back at square one?

this is from hijackthis... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:17:38, on 31/08/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe c:\PROGRA~1\mcafee.com\vso\OasClnt.exe c:\program files\mcafee.com\vso\mcvsshld.exe c:\program files\mcafee.com\agent\mcagent.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Apoint\HidFind.exe C:\PROGRA~1\mcafee.com\mps\mscifapp.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk-rel&channel=uk&ibd=5070222 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://desktop.google.com/uninstall-feedback.html?hl=en R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 11476 bytes thanks again.

Kenny, once again thanks for your help. I've ran combo fix... it downloaded windows recovery, I use mcafee which was turned off, seemed to come on again. Anyway combofix beeped and I turned it off. It gave my a list of files all of which startc:\windows\system32\ and then followed by drivers\UACoecltvemmf.sys UACetuwtumbyx.dll UACbmaxwvafce.dll UACyikfwyinqn.dat UACmrwsdpjeoi.db UACidgejdcuwg.dll UACvjtggebuam.dll It then reset and this is the log associated with combofix, to get back online I had to restart. you asked also for a hijack this log, is that from rootrepeal or malaware? ComboFix 09-08-30.04 - el philo 31/08/2009 15:42.1.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.472 [GMT 1:00] Running from: c:\documents and settings\el philo\Desktop\Combo-Fix.exe AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Installer\477539.msi c:\windows\system32\drivers\UACoecltvemmf.sys c:\windows\system32\UACbmaxwvafce.dll c:\windows\system32\UACetuwtumbyx.dll c:\windows\system32\UACidgejdcuwg.dll c:\windows\system32\uacinit.dll c:\windows\system32\UACmrwsdpjeoi.db c:\windows\system32\UACvjtggebuam.dll c:\windows\system32\UACyikfwyinqn.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_UACd.sys -------\Legacy_UACd.sys ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 ))))))))))))))))))))))))))))))) . 2009-08-31 12:35 . 2009-08-31 12:37 -------- d-----w- C:\rootrepeal 2009-08-31 00:46 . 2009-08-31 00:46 -------- d-----w- c:\documents and settings\el philo\Application Data\Malwarebytes 2009-08-30 23:33 . 2009-08-30 23:47 -------- d-----w- c:\program files\cheese 2009-08-30 23:31 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-30 23:31 . 2009-08-30 23:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-08-30 23:31 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-08-30 23:31 . 2009-08-31 00:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-08-30 19:03 . 2009-08-30 19:03 -------- d-sh--w- c:\documents and settings\el philo\IECompatCache 2009-08-30 19:03 . 2009-08-30 19:03 -------- d-sh--w- c:\documents and settings\el philo\PrivacIE 2009-08-30 18:43 . 2009-08-30 18:43 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-08-30 18:40 . 2009-08-30 18:40 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-08-30 18:39 . 2009-08-30 18:39 -------- d-sh--w- c:\documents and settings\el philo\IETldCache 2009-08-30 17:42 . 2009-08-07 08:48 100352 ------w- c:\windows\system32\dllcache\iecompat.dll 2009-08-30 17:42 . 2009-08-30 17:42 -------- d-----w- c:\windows\ie8updates 2009-08-30 17:41 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2009-08-30 17:41 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll 2009-08-30 17:40 . 2009-08-30 17:41 -------- dc-h--w- c:\windows\ie8 2009-08-27 21:58 . 2009-08-27 21:58 -------- d-----w- c:\program files\Windows Defender 2009-08-27 20:06 . 2009-03-06 14:22 284160 ------w- c:\windows\system32\dllcache\pdh.dll 2009-08-27 20:06 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe 2009-08-27 20:06 . 2009-02-09 12:10 401408 ------w- c:\windows\system32\dllcache\rpcss.dll 2009-08-27 20:06 . 2009-02-06 11:11 110592 ------w- c:\windows\system32\dllcache\services.exe 2009-08-27 20:06 . 2009-02-09 12:10 473600 ------w- c:\windows\system32\dllcache\fastprox.dll 2009-08-27 20:06 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe 2009-08-27 20:06 . 2009-02-09 12:10 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll 2009-08-27 20:05 . 2009-06-25 08:25 730112 ------w- c:\windows\system32\dllcache\lsasrv.dll 2009-08-27 20:05 . 2009-02-09 12:10 617472 ------w- c:\windows\system32\dllcache\advapi32.dll 2009-08-27 20:05 . 2009-02-09 12:10 714752 ------w- c:\windows\system32\dllcache\ntdll.dll 2009-08-27 19:49 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll 2009-08-27 19:44 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2009-08-27 19:44 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2009-08-27 19:32 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-08-27 19:15 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-08-27 19:14 . 2009-08-27 19:14 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864} 2009-08-27 19:14 . 2009-07-08 17:28 2920112 -c--a-w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe 2009-08-27 19:14 . 2009-08-27 19:14 -------- d-----w- c:\program files\Lavasoft 2009-08-27 19:14 . 2009-08-27 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-08-27 15:17 . 2009-08-27 15:17 -------- d-----w- c:\documents and settings\el philo\Application Data\Logs 2009-08-24 17:37 . 2009-08-24 17:37 -------- d-----w- c:\program files\Overland 2009-08-24 17:20 . 2009-08-24 17:29 24574 ----a-w- c:\windows\hpoins03.dat 2009-08-24 17:20 . 2004-01-05 08:27 38867 ------w- c:\windows\hpomdl03.dat 2009-08-24 17:11 . 2009-08-24 17:11 -------- d-----w- c:\windows\system32\NtmsData 2009-08-24 16:43 . 2009-08-24 16:43 -------- d-----w- c:\documents and settings\el philo\Local Settings\Application Data\HP 2009-08-24 16:38 . 2004-01-05 08:27 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys 2009-08-24 16:38 . 2004-01-05 08:27 51056 ----a-r- c:\windows\system32\drivers\hpzid412.sys 2009-08-24 16:37 . 2004-01-05 08:27 21488 ----a-r- c:\windows\system32\drivers\HPZius12.sys 2009-08-24 16:37 . 2008-04-13 17:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys 2009-08-24 16:37 . 2008-04-13 17:47 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys 2009-08-24 16:37 . 2008-04-13 17:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2009-08-24 16:37 . 2008-04-13 17:45 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys 2009-08-24 16:37 . 2008-04-13 17:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2009-08-24 16:37 . 2008-04-13 17:45 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys 2009-08-24 16:34 . 2003-12-11 10:15 626960 ----a-r- c:\windows\system32\hpvaut32.dll 2009-08-24 16:34 . 2003-12-11 10:15 487424 ----a-r- c:\windows\system32\hpvcp70.dll 2009-08-24 16:34 . 2003-12-11 10:15 44544 ----a-r- c:\windows\system32\MSXML4a.dll 2009-08-24 16:34 . 2003-12-11 10:15 344064 ----a-r- c:\windows\system32\hpvcr70.dll 2009-08-24 16:33 . 2009-08-24 16:33 -------- d-----w- c:\program files\Common Files\Hewlett-Packard 2009-08-24 16:29 . 2009-08-24 16:29 -------- d-----w- c:\program files\Common Files\HP 2009-08-24 16:29 . 2004-10-08 01:16 35840 ----a-w- c:\windows\system32\drivers\AFS2K.SYS 2009-08-24 16:13 . 2009-08-24 16:34 -------- d-----w- c:\program files\HP . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-28 19:05 . 2007-02-28 20:42 -------- d-----w- c:\program files\McAfee.com 2009-08-24 10:25 . 2009-06-14 17:57 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-08-12 17:35 . 2009-05-18 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Driving Test Success 2009-08-05 09:01 . 2004-08-11 17:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-07-29 04:37 . 2004-08-11 17:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-07-29 04:37 . 2004-08-11 17:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-07-17 19:01 . 2004-08-11 17:00 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-13 22:43 . 2004-08-11 17:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-03 17:09 . 2004-08-11 17:00 915456 ----a-w- c:\windows\system32\wininet.dll 2009-06-25 08:25 . 2004-08-11 17:00 54272 ----a-w- c:\windows\system32\wdigest.dll 2009-06-25 08:25 . 2004-08-11 17:00 56832 ----a-w- c:\windows\system32\secur32.dll 2009-06-25 08:25 . 2004-08-11 17:00 147456 ----a-w- c:\windows\system32\schannel.dll 2009-06-25 08:25 . 2004-08-11 17:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-06-25 08:25 . 2004-08-11 17:00 730112 ----a-w- c:\windows\system32\lsasrv.dll 2009-06-25 08:25 . 2004-08-11 17:00 301568 ----a-w- c:\windows\system32\kerberos.dll 2009-06-24 20:33 . 2009-06-24 20:33 22860 ---ha-w- c:\windows\system32\mlfcache.dat 2009-06-24 11:18 . 2004-08-11 17:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-06-18 11:35 . 2007-02-22 10:51 22792 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-13 14:27 . 2008-07-29 19:50 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys 2009-06-13 14:27 . 2008-07-29 19:50 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys 2009-06-12 12:31 . 2004-08-11 17:00 80896 ----a-w- c:\windows\system32\tlntsess.exe 2009-06-12 12:31 . 2004-08-11 17:00 76288 ----a-w- c:\windows\system32\telnet.exe 2009-06-10 14:13 . 2004-08-11 17:00 84992 ----a-w- c:\windows\system32\avifil32.dll 2009-06-10 08:19 . 2004-08-11 17:11 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-06-10 06:14 . 2004-08-11 17:00 132096 ----a-w- c:\windows\system32\wkssvc.dll 2009-06-03 19:09 . 2004-08-11 17:00 1291264 ----a-w- c:\windows\system32\quartz.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-06-29 1032192] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920] "VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552] "OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248] "VirusScan Online"="c:\program files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840] "MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104] "MCUpdateExe"="c:\progra~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 212992] "MPSExe"="c:\progra~1\mcafee.com\mps\mscifapp.exe" [2005-05-24 274432] "MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-04-05 950272] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-21 185896] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-2-22 24576] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "2064:TCP"= 2064:TCP:Akamai NetSession Interface "5000:UDP"= 5000:UDP:Akamai NetSession Interface R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27/08/2009 20:15 64160] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [03/07/2009 15:49 1029456] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592] S2 hofj;hofj;c:\windows\system32\drivers\doisij.sys --> c:\windows\system32\drivers\doisij.sys [?] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [29/07/2008 20:50 13224] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-08-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49] 2009-08-26 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34] 2009-08-31 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://en.wikipedia.org/wiki/Main_Page uInternet Connection Wizard,ShellNext = hxxp://desktop.google.com/uninstall-feedback.html?hl=en uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 LSP: c:\windows\system32\mclsp.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-31 15:52 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(1004) c:\windows\system32\mclsp.dll c:\windows\system32\SPORDER.dll c:\windows\system32\mclsphlr\gdlsphlr.dll c:\windows\system32\McRtl32.dll . Completion time: 2009-08-31 15:54 ComboFix-quarantined-files.txt 2009-08-31 14:54 Pre-Run: 30,652,350,464 bytes free Post-Run: 32,111,624,192 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 252 --- E O F --- 2009-08-30 17:43

Kenny, Thanks, I appreciate your help. Upon clicking on Root, it took a few attempts to load. ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/31 13:38 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: 1394BUS.SYS Image Path: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS Address: 0xF753E000 Size: 57344 File Visible: - Signed: - Status: - Name: ACPI.sys Image Path: ACPI.sys Address: 0xF738F000 Size: 187776 File Visible: - Signed: - Status: - Name: ACPI_HAL Image Path: \Driver\ACPI_HAL Address: 0x804D7000 Size: 2150400 File Visible: - Signed: - Status: - Name: AegisP.sys Image Path: C:\WINDOWS\system32\DRIVERS\AegisP.sys Address: 0xF786E000 Size: 19360 File Visible: - Signed: - Status: - Name: afd.sys Image Path: C:\WINDOWS\System32\drivers\afd.sys Address: 0xA9F46000 Size: 138496 File Visible: - Signed: - Status: - Name: AFS2K.SYS Image Path: C:\WINDOWS\System32\Drivers\AFS2K.SYS Address: 0xF69C3000 Size: 35840 File Visible: - Signed: - Status: - Name: Apfiltr.sys Image Path: C:\WINDOWS\system32\DRIVERS\Apfiltr.sys Address: 0xF5F98000 Size: 110400 File Visible: - Signed: - Status: - Name: APPDRV.SYS Image Path: C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS Address: 0xF797E000 Size: 16128 File Visible: - Signed: - Status: - Name: ASPI32.SYS Image Path: C:\WINDOWS\System32\Drivers\ASPI32.SYS Address: 0xF797A000 Size: 15936 File Visible: - Signed: - Status: - Name: atapi.sys Image Path: atapi.sys Address: 0xF7303000 Size: 96512 File Visible: - Signed: - Status: - Name: audstub.sys Image Path: C:\WINDOWS\system32\DRIVERS\audstub.sys Address: 0xF7ACE000 Size: 3072 File Visible: - Signed: - Status: - Name: BATTC.SYS Image Path: C:\WINDOWS\system32\DRIVERS\BATTC.SYS Address: 0xF78D6000 Size: 16384 File Visible: - Signed: - Status: - Name: Beep.SYS Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS Address: 0xF79F0000 Size: 4224 File Visible: - Signed: - Status: - Name: BOOTVID.dll Image Path: C:\WINDOWS\system32\BOOTVID.dll Address: 0xF78CE000 Size: 12288 File Visible: - Signed: - Status: - Name: Cdfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS Address: 0xF765E000 Size: 63744 File Visible: - Signed: - Status: - Name: cdrom.sys Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys Address: 0xF69B3000 Size: 62976 File Visible: - Signed: - Status: - Name: CLASSPNP.SYS Image Path: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS Address: 0xF74FE000 Size: 53248 File Visible: - Signed: - Status: - Name: CmBatt.sys Image Path: C:\WINDOWS\system32\DRIVERS\CmBatt.sys Address: 0xF798A000 Size: 13952 File Visible: - Signed: - Status: - Name: compbatt.sys Image Path: compbatt.sys Address: 0xF78D2000 Size: 10240 File Visible: - Signed: - Status: - Name: disk.sys Image Path: disk.sys Address: 0xF74EE000 Size: 36352 File Visible: - Signed: - Status: - Name: DLABOIOM.SYS Image Path: C:\WINDOWS\System32\DLA\DLABOIOM.SYS Address: 0xF7856000 Size: 25568 File Visible: - Signed: - Status: - Name: DLACDBHM.SYS Image Path: C:\WINDOWS\System32\Drivers\DLACDBHM.SYS Address: 0xF79DE000 Size: 5568 File Visible: - Signed: - Status: - Name: DLADResN.SYS Image Path: C:\WINDOWS\System32\DLA\DLADResN.SYS Address: 0xF7AE7000 Size: 2432 File Visible: - Signed: - Status: - Name: DLAIFS_M.SYS Image Path: C:\WINDOWS\System32\DLA\DLAIFS_M.SYS Address: 0xA9CEF000 Size: 86464 File Visible: - Signed: - Status: - Name: DLAOPIOM.SYS Image Path: C:\WINDOWS\System32\DLA\DLAOPIOM.SYS Address: 0xF78EA000 Size: 14624 File Visible: - Signed: - Status: - Name: DLAPoolM.SYS Image Path: C:\WINDOWS\System32\DLA\DLAPoolM.SYS Address: 0xF7A14000 Size: 6304 File Visible: - Signed: - Status: - Name: DLARTL_N.SYS Image Path: C:\WINDOWS\System32\Drivers\DLARTL_N.SYS Address: 0xF7806000 Size: 22624 File Visible: - Signed: - Status: - Name: DLAUDF_M.SYS Image Path: C:\WINDOWS\System32\DLA\DLAUDF_M.SYS Address: 0xA9CC1000 Size: 86976 File Visible: - Signed: - Status: - Name: DLAUDFAM.SYS Image Path: C:\WINDOWS\System32\DLA\DLAUDFAM.SYS Address: 0xA9CD7000 Size: 94272 File Visible: - Signed: - Status: - Name: dmio.sys Image Path: dmio.sys Address: 0xF731B000 Size: 153344 File Visible: - Signed: - Status: - Name: drmk.sys Image Path: C:\WINDOWS\system32\drivers\drmk.sys Address: 0xF75CE000 Size: 61440 File Visible: - Signed: - Status: - Name: DRVMCDB.SYS Image Path: DRVMCDB.SYS Address: 0xF72BB000 Size: 87104 File Visible: - Signed: - Status: - Name: DRVNDDM.SYS Image Path: C:\WINDOWS\System32\Drivers\DRVNDDM.SYS Address: 0xAA115000 Size: 38304 File Visible: - Signed: - Status: - Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xA9E45000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7A0C000 Size: 8192 File Visible: No Signed: - Status: - Name: Dxapi.sys Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys Address: 0xF5E90000 Size: 12288 File Visible: - Signed: - Status: - Name: dxg.sys Image Path: C:\WINDOWS\System32\drivers\dxg.sys Address: 0xBF000000 Size: 73728 File Visible: - Signed: - Status: - Name: dxgthk.sys Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys Address: 0xF7BD8000 Size: 4096 File Visible: - Signed: - Status: - Name: Fastfat.SYS Image Path: C:\WINDOWS\System32\Drivers\Fastfat.SYS Address: 0xAA014000 Size: 143744 File Visible: - Signed: - Status: - Name: Fips.SYS Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS Address: 0xF762E000 Size: 44544 File Visible: - Signed: - Status: - Name: fltmgr.sys Image Path: fltmgr.sys Address: 0xF72E3000 Size: 129792 File Visible: - Signed: - Status: - Name: Fs_Rec.SYS Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Address: 0xF79EE000 Size: 7936 File Visible: - Signed: - Status: - Name: ftdisk.sys Image Path: ftdisk.sys Address: 0xF7341000 Size: 125056 File Visible: - Signed: - Status: - Name: fyyifk.sys Image Path: C:\WINDOWS\system32\drivers\fyyifk.sys Address: 0xAA125000 Size: 61440 File Visible: No Signed: - Status: - Name: GEARAspiWDM.sys Image Path: C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys Address: 0xF6993000 Size: 40960 File Visible: - Signed: - Status: - Name: hal.dll Image Path: C:\WINDOWS\system32\hal.dll Address: 0x806E4000 Size: 134400 File Visible: - Signed: - Status: - Name: HDAudBus.sys Image Path: C:\WINDOWS\system32\DRIVERS\HDAudBus.sys Address: 0xF6179000 Size: 163840 File Visible: - Signed: - Status: - Name: HSX_CNXT.sys Image Path: C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys Address: 0xAA135000 Size: 745472 File Visible: - Signed: - Status: - Name: HSX_DPV.sys Image Path: C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys Address: 0xAA1EB000 Size: 1011712 File Visible: - Signed: - Status: - Name: HSXHWAZL.sys Image Path: C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys Address: 0xAA2E2000 Size: 237568 File Visible: - Signed: - Status: - Name: HTTP.sys Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys Address: 0xA89D2000 Size: 264832 File Visible: - Signed: - Status: - Name: i2omgmt.SYS Image Path: C:\WINDOWS\System32\Drivers\i2omgmt.SYS Address: 0xF7966000 Size: 8576 File Visible: - Signed: - Status: - Name: i8042prt.sys Image Path: C:\WINDOWS\system32\DRIVERS\i8042prt.sys Address: 0xF69F3000 Size: 52480 File Visible: - Signed: - Status: - Name: ialmdd5.DLL Image Path: C:\WINDOWS\System32\ialmdd5.DLL Address: 0xBF077000 Size: 925696 File Visible: - Signed: - Status: - Name: ialmdev5.DLL Image Path: C:\WINDOWS\System32\ialmdev5.DLL Address: 0xBF042000 Size: 217088 File Visible: - Signed: - Status: - Name: ialmdnt5.dll Image Path: C:\WINDOWS\System32\ialmdnt5.dll Address: 0xBF020000 Size: 139264 File Visible: - Signed: - Status: - Name: ialmnt5.sys Image Path: C:\WINDOWS\system32\DRIVERS\ialmnt5.sys Address: 0xF61B5000 Size: 1364448 File Visible: - Signed: - Status: - Name: ialmrnt5.dll Image Path: C:\WINDOWS\System32\ialmrnt5.dll Address: 0xBF012000 Size: 57344 File Visible: - Signed: - Status: - Name: imapi.sys Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys Address: 0xF69D3000 Size: 42112 File Visible: - Signed: - Status: - Name: intelppm.sys Image Path: C:\WINDOWS\system32\DRIVERS\intelppm.sys Address: 0xF755E000 Size: 36352 File Visible: - Signed: - Status: - Name: ipfltdrv.sys Image Path: C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys Address: 0xA962A000 Size: 32896 File Visible: - Signed: - Status: - Name: ipnat.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys Address: 0xA9E5D000 Size: 152832 File Visible: - Signed: - Status: - Name: ipsec.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys Address: 0xAA001000 Size: 75264 File Visible: - Signed: - Status: - Name: isapnp.sys Image Path: isapnp.sys Address: 0xF74BE000 Size: 37248 File Visible: - Signed: - Status: - Name: kbdclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Address: 0xF77CE000 Size: 24576 File Visible: - Signed: - Status: - Name: KDCOM.DLL Image Path: C:\WINDOWS\system32\KDCOM.DLL Address: 0xF79BE000 Size: 8192 File Visible: - Signed: - Status: - Name: kmixer.sys Image Path: C:\WINDOWS\system32\drivers\kmixer.sys Address: 0xA7E20000 Size: 172416 File Visible: - Signed: - Status: - Name: ks.sys Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys Address: 0xF5F75000 Size: 143360 File Visible: - Signed: - Status: - Name: KSecDD.sys Image Path: KSecDD.sys Address: 0xF72A4000 Size: 92928 File Visible: - Signed: - Status: - Name: Lbd.sys Image Path: Lbd.sys Address: 0xF750E000 Size: 57472 File Visible: - Signed: - Status: - Name: mdmxsdk.sys Image Path: C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys Address: 0xA983C000 Size: 12544 File Visible: - Signed: - Status: - Name: mnmdd.SYS Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS Address: 0xF79F2000 Size: 4224 File Visible: - Signed: - Status: - Name: Modem.SYS Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS Address: 0xF77D6000 Size: 30080 File Visible: - Signed: - Status: - Name: mouclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys Address: 0xF77C6000 Size: 23040 File Visible: - Signed: - Status: - Name: MountMgr.sys Image Path: MountMgr.sys Address: 0xF74CE000 Size: 42368 File Visible: - Signed: - Status: - Name: MpFirewall.sys Image Path: C:\WINDOWS\System32\Drivers\MpFirewall.sys Address: 0xA9F90000 Size: 98304 File Visible: - Signed: - Status: - Name: mrxdav.sys Image Path: C:\WINDOWS\system32\DRIVERS\mrxdav.sys Address: 0xA985C000 Size: 180608 File Visible: - Signed: - Status: - Name: mrxsmb.sys Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Address: 0xA9E83000 Size: 455296 File Visible: - Signed: - Status: - Name: Msfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS Address: 0xF7816000 Size: 19072 File Visible: - Signed: - Status: - Name: msgpc.sys Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys Address: 0xF757E000 Size: 35072 File Visible: - Signed: - Status: - Name: mssmbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Address: 0xF79B6000 Size: 15488 File Visible: - Signed: - Status: - Name: Mup.sys Image Path: Mup.sys Address: 0xF71BD000 Size: 105344 File Visible: - Signed: - Status: - Name: naiavf5x.sys Image Path: C:\WINDOWS\system32\drivers\naiavf5x.sys Address: 0xA8C93000 Size: 114464 File Visible: - Signed: - Status: - Name: NDIS.sys Image Path: NDIS.sys Address: 0xF71D7000 Size: 182656 File Visible: - Signed: - Status: - Name: ndistapi.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Address: 0xF799A000 Size: 10112 File Visible: - Signed: - Status: - Name: ndisuio.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndisuio.sys Address: 0xA9B91000 Size: 14592 File Visible: - Signed: - Status: - Name: ndiswan.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Address: 0xF5F5E000 Size: 91520 File Visible: - Signed: - Status: - Name: NDProxy.SYS Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS Address: 0xF75AE000 Size: 40576 File Visible: - Signed: - Status: - Name: netbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys Address: 0xF761E000 Size: 34688 File Visible: - Signed: - Status: - Name: netbt.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys Address: 0xA9F68000 Size: 162816 File Visible: - Signed: - Status: - Name: NETw3x32.sys Image Path: C:\WINDOWS\system32\DRIVERS\NETw3x32.sys Address: 0xF5FD7000 Size: 1711104 File Visible: - Signed: - Status: - Name: Npfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS Address: 0xF781E000 Size: 30848 File Visible: - Signed: - Status: - Name: Ntfs.sys Image Path: Ntfs.sys Address: 0xF7204000 Size: 574976 File Visible: - Signed: - Status: - Name: ntkrnlpa.exe Image Path: C:\WINDOWS\system32\ntkrnlpa.exe Address: 0x804D7000 Size: 2150400 File Visible: - Signed: - Status: - Name: Null.SYS Image Path: C:\WINDOWS\System32\Drivers\Null.SYS Address: 0xF7AF4000 Size: 2944 File Visible: - Signed: - Status: - Name: ohci1394.sys Image Path: ohci1394.sys Address: 0xF752E000 Size: 61696 File Visible: - Signed: - Status: - Name: omci.sys Image Path: C:\WINDOWS\system32\DRIVERS\omci.sys Address: 0xF77F6000 Size: 17088 File Visible: - Signed: - Status: - Name: PartMgr.sys Image Path: PartMgr.sys Address: 0xF7746000 Size: 19712 File Visible: - Signed: - Status: - Name: pci.sys Image Path: pci.sys Address: 0xF737E000 Size: 68224 File Visible: - Signed: - Status: - Name: pciide.sys Image Path: pciide.sys Address: 0xF7A86000 Size: 3328 File Visible: - Signed: - Status: - Name: PCIIDEX.SYS Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS Address: 0xF773E000 Size: 28672 File Visible: - Signed: - Status: - Name: pcmcia.sys Image Path: pcmcia.sys Address: 0xF7360000 Size: 120192 File Visible: - Signed: - Status: - Name: PnpManager Image Path: \Driver\PnpManager Address: 0x804D7000 Size: 2150400 File Visible: - Signed: - Status: - Name: portcls.sys Image Path: C:\WINDOWS\system32\drivers\portcls.sys Address: 0xAA31C000 Size: 147456 File Visible: - Signed: - Status: - Name: psched.sys Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys Address: 0xF5F4D000 Size: 69120 File Visible: - Signed: - Status: - Name: ptilink.sys Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys Address: 0xF77E6000 Size: 17792 File Visible: - Signed: - Status: - Name: PxHelp20.sys Image Path: PxHelp20.sys Address: 0xF751E000 Size: 35712 File Visible: - Signed: - Status: - Name: rasacd.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys Address: 0xF6323000 Size: 8832 File Visible: - Signed: - Status: - Name: rasl2tp.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Address: 0xF6973000 Size: 51328 File Visible: - Signed: - Status: - Name: raspppoe.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Address: 0xF6963000 Size: 41472 File Visible: - Signed: - Status: - Name: raspptp.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys Address: 0xF756E000 Size: 48384 File Visible: - Signed: - Status: - Name: raspti.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys Address: 0xF77EE000 Size: 16512 File Visible: - Signed: - Status: - Name: RAW Image Path: \FileSystem\RAW Address: 0x804D7000 Size: 2150400 File Visible: - Signed: - Status: - Name: rdbss.sys Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys Address: 0xA9F1B000 Size: 175744 File Visible: - Signed: - Status: - Name: RDPCDD.sys Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Address: 0xF79F4000 Size: 4224 File Visible: - Signed: - Status: - Name: rdpdr.sys Image Path: C:\WINDOWS\system32\DRIVERS\rdpdr.sys Address: 0xF5F1D000 Size: 196224 File Visible: - Signed: - Status: - Name: redbook.sys Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys Address: 0xF69A3000 Size: 57600 File Visible: - Signed: - Status: - Name: RootMdm.sys Image Path: C:\WINDOWS\System32\Drivers\RootMdm.sys Address: 0xF79E0000 Size: 5888 File Visible: - Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA7EDB000 Size: 49152 File Visible: No Signed: - Status: - Name: s24trans.sys Image Path: C:\WINDOWS\system32\DRIVERS\s24trans.sys Address: 0xA9C79000 Size: 12544 File Visible: - Signed: - Status: - Name: serenum.sys Image Path: C:\WINDOWS\system32\DRIVERS\serenum.sys Address: 0xF7992000 Size: 15744 File Visible: - Signed: - Status: - Name: serial.sys Image Path: C:\WINDOWS\system32\DRIVERS\serial.sys Address: 0xF69E3000 Size: 64512 File Visible: - Signed: - Status: - Name: SMCLIB.SYS Image Path: C:\WINDOWS\system32\DRIVERS\SMCLIB.SYS Address: 0xF796E000 Size: 16384 File Visible: - Signed: - Status: - Name: sr.sys Image Path: sr.sys Address: 0xF72D1000 Size: 73472 File Visible: - Signed: - Status: - Name: srv.sys Image Path: C:\WINDOWS\system32\DRIVERS\srv.sys Address: 0xA96F2000 Size: 333952 File Visible: - Signed: - Status: - Name: sthda.sys Image Path: C:\WINDOWS\system32\drivers\sthda.sys Address: 0xAA340000 Size: 1111840 File Visible: - Signed: - Status: - Name: swenum.sys Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys Address: 0xF79E2000 Size: 4352 File Visible: - Signed: - Status: - Name: sysaudio.sys Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys Address: 0xA93EA000 Size: 60800 File Visible: - Signed: - Status: - Name: tcpip.sys Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys Address: 0xA9FA8000 Size: 361600 File Visible: - Signed: - Status: - Name: TDI.SYS Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS Address: 0xF77DE000 Size: 20480 File Visible: - Signed: - Status: - Name: termdd.sys Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys Address: 0xF758E000 Size: 40704 File Visible: - Signed: - Status: - Name: tosporte.sys Image Path: C:\WINDOWS\system32\DRIVERS\tosporte.sys Address: 0xF759E000 Size: 47488 File Visible: - Signed: - Status: - Name: tosrfbd.sys Image Path: C:\WINDOWS\System32\Drivers\tosrfbd.sys Address: 0xA85CB000 Size: 111232 File Visible: - Signed: - Status: - Name: tosrfbnp.sys Image Path: C:\WINDOWS\System32\Drivers\tosrfbnp.sys Address: 0xA863A000 Size: 37632 File Visible: - Signed: - Status: - Name: tosrfcom.sys Image Path: C:\WINDOWS\System32\Drivers\tosrfcom.sys Address: 0xF6983000 Size: 64896 File Visible: - Signed: - Status: - Name: Tosrfhid.sys Image Path: C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys Address: 0xA9297000 Size: 60672 File Visible: - Signed: - Status: - Name: tosrfnds.sys Image Path: C:\WINDOWS\system32\DRIVERS\tosrfnds.sys Address: 0xF78A6000 Size: 17504 File Visible: - Signed: - Status: - Name: tosrfusb.sys Image Path: C:\WINDOWS\System32\Drivers\tosrfusb.sys Address: 0xF772E000 Size: 40192 File Visible: - Signed: - Status: - Name: update.sys Image Path: C:\WINDOWS\system32\DRIVERS\update.sys Address: 0xF5EBF000 Size: 384768 File Visible: - Signed: - Status: - Name: usbccid.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbccid.sys Address: 0xF760E000 Size: 49152 File Visible: - Signed: - Status: - Name: USBD.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS Address: 0xF79EC000 Size: 8192 File Visible: - Signed: - Status: - Name: usbehci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys Address: 0xF77BE000 Size: 30208 File Visible: - Signed: - Status: - Name: usbhub.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys Address: 0xF75DE000 Size: 59520 File Visible: - Signed: - Status: - Name: USBPORT.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Address: 0xF5FB3000 Size: 147456 File Visible: - Signed: - Status: - Name: usbuhci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbuhci.sys Address: 0xF77B6000 Size: 20608 File Visible: - Signed: - Status: - Name: vga.sys Image Path: C:\WINDOWS\System32\drivers\vga.sys Address: 0xF780E000 Size: 20992 File Visible: - Signed: - Status: - Name: VIDEOPRT.SYS Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Address: 0xF61A1000 Size: 81920 File Visible: - Signed: - Status: - Name: VolSnap.sys Image Path: VolSnap.sys Address: 0xF74DE000 Size: 52352 File Visible: - Signed: - Status: - Name: wanarp.sys Image Path: C:\WINDOWS\system32\DRIVERS\wanarp.sys Address: 0xF763E000 Size: 34560 File Visible: - Signed: - Status: - Name: watchdog.sys Image Path: C:\WINDOWS\System32\watchdog.sys Address: 0xF7836000 Size: 20480 File Visible: - Signed: - Status: - Name: wdmaud.sys Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys Address: 0xA92F5000 Size: 83072 File Visible: - Signed: - Status: - Name: Win32k Image Path: \Driver\Win32k Address: 0xBF800000 Size: 1847296 File Visible: - Signed: - Status: - Name: win32k.sys Image Path: C:\WINDOWS\System32\win32k.sys Address: 0xBF800000 Size: 1847296 File Visible: - Signed: - Status: - Name: wmiacpi.sys Image Path: C:\WINDOWS\system32\DRIVERS\wmiacpi.sys Address: 0xF7986000 Size: 8832 File Visible: - Signed: - Status: - Name: WMILIB.SYS Image Path: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS Address: 0xF79C0000 Size: 8192 File Visible: - Signed: - Status: - Name: WMIxWDM Image Path: \Driver\WMIxWDM Address: 0x804D7000 Size: 2150400 File Visible: - Signed: - Status: - Name: ws2ifsl.sys Image Path: C:\WINDOWS\System32\drivers\ws2ifsl.sys Address: 0xF631F000 Size: 12032 File Visible: - Signed: - Status: - Name: WudfPf.sys Image Path: WudfPf.sys Address: 0xF7291000 Size: 77568 File Visible: - Signed: - Status: -

here are the rest of my logs in order I've now done a full scan, and still i'm left with uacinit.dll and just an hour ago it's reinfected me. Malwarebytes' Anti-Malware 1.40 Database version: 2720 Windows 5.1.2600 Service Pack 3 31/08/2009 02:03:03 mbam-log-2009-08-31 (02-03-03).txt Scan type: Quick Scan Objects scanned: 125483 Time elapsed: 14 minute(s), 41 second(s) Memory Processes Infected: 0 Memory Modules Infected: 2 Registry Keys Infected: 7 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 1 Files Infected: 7 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: \\?\globalroot\systemroot\system32\UACidgejdcuwg.dll (Rootkit.TDSS) -> Delete on reboot. \\?\globalroot\systemroot\system32\UACvjtggebuam.dll (Rootkit.TDSS) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully. Files Infected: \\?\globalroot\systemroot\system32\UACidgejdcuwg.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. \\?\globalroot\systemroot\system32\UACvjtggebuam.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\net.net (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\el philo\Local Settings\Temp\oncxesmawr.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\VideoEgg\user.dat (Adware.VideoEgg) -> Quarantined and deleted successfully. C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\fmark2.dat (Malware.Trace) -> Quarantined and deleted successfully. next one Malwarebytes' Anti-Malware 1.40 Database version: 2720 Windows 5.1.2600 Service Pack 3 31/08/2009 02:25:50 mbam-log-2009-08-31 (02-25-50).txt Scan type: Quick Scan Objects scanned: 124758 Time elapsed: 13 minute(s), 12 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot. next one Malwarebytes' Anti-Malware 1.40 Database version: 2720 Windows 5.1.2600 Service Pack 3 31/08/2009 03:01:20 mbam-log-2009-08-31 (03-01-20).txt Scan type: Quick Scan Objects scanned: 124754 Time elapsed: 15 minute(s), 9 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot. next one Malwarebytes' Anti-Malware 1.40 Database version: 2720 Windows 5.1.2600 Service Pack 3 31/08/2009 12:15:53 mbam-log-2009-08-31 (12-15-53).txt Scan type: Full Scan (C:\|) Objects scanned: 203725 Time elapsed: 47 minute(s), 37 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot. last one Malwarebytes' Anti-Malware 1.40 Database version: 2720 Windows 5.1.2600 Service Pack 3 31/08/2009 13:06:16 mbam-log-2009-08-31 (13-06-16).txt Scan type: Quick Scan Objects scanned: 125477 Time elapsed: 12 minute(s), 35 second(s) Memory Processes Infected: 0 Memory Modules Infected: 3 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: \\?\globalroot\systemroot\system32\UACbmaxwvafce.dll (Trojan.Agent) -> Delete on reboot. \\?\globalroot\systemroot\system32\UACidgejdcuwg.dll (Rootkit.TDSS) -> Delete on reboot. \\?\globalroot\systemroot\system32\UACvjtggebuam.dll (Rootkit.TDSS) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: \\?\globalroot\systemroot\system32\UACbmaxwvafce.dll (Trojan.Agent) -> Quarantined and deleted successfully. \\?\globalroot\systemroot\system32\UACidgejdcuwg.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. \\?\globalroot\systemroot\system32\UACvjtggebuam.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

Morning, I was led to your site from a yahoo page. I had problems with slow int and links away from google and suddenly my laptop downloaded anti-virus software that wasn't requested. This resulted in many .exe files not working. I downloaded your software, renamed the setup file to activate it.... eventually I had updated and ran my quick scan - 19 objects. It left my with two and upon restart I got a blue death screen, I ran the scan again and the same two objects were left this time on restart no blue death screen, but again i'm left with uacinit.dll and hkey_local_machine\software\uac Here are the logs... Any help or support would be much appreciated. Thanks Malwarebytes' Anti-Malware 1.40 Database version: 2720 Windows 5.1.2600 Service Pack 3 31/08/2009 02:02:36 mbam-log-2009-08-31 (02-02-29).txt Scan type: Quick Scan Objects scanned: 125483 Time elapsed: 14 minute(s), 41 second(s) Memory Processes Infected: 0 Memory Modules Infected: 2 Registry Keys Infected: 7 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 1 Files Infected: 7 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: \\?\globalroot\systemroot\system32\UACidgejdcuwg.dll (Rootkit.TDSS) -> No action taken. \\?\globalroot\systemroot\system32\UACvjtggebuam.dll (Rootkit.TDSS) -> No action taken. Registry Keys Infected: HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\VideoEgg (Adware.VideoEgg) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> No action taken. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. Folders Infected: C:\Documents and Settings\All Users\Application Data\VideoEgg (Adware.VideoEgg) -> No action taken. Files Infected: \\?\globalroot\systemroot\system32\UACidgejdcuwg.dll (Rootkit.TDSS) -> No action taken. \\?\globalroot\systemroot\system32\UACvjtggebuam.dll (Rootkit.TDSS) -> No action taken. C:\WINDOWS\system32\net.net (Trojan.Downloader) -> No action taken. C:\Documents and Settings\el philo\Local Settings\Temp\oncxesmawr.tmp (Trojan.Downloader) -> No action taken. C:\Documents and Settings\All Users\Application Data\VideoEgg\user.dat (Adware.VideoEgg) -> No action taken. C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\fmark2.dat (Malware.Trace) -> No action taken.