Mutilpe Devices Not Working After Malware Removal

[ZhaxRa]

Aloha,

Some system devices are not working. They're showing a Code 3 in Device Manager for the following devices:

TSSTcorp CDDVDW TS-L633B

Generic PNP Monitor

Broadcom 802.11g Network Adapter

Pentium® Dual-Core CPU T4400@2.20GHz

Pentium® Dual-Core CPU T4400@2.20GHz

High Definition Audio Controller

Intel® ICH9M LPC Interface Controller - 2919

and a Code 24 for the following hidden Device:

PEAUTH

I've tired uninstalling the devices, but after a reboot of Windows, the devices come back with the same errors. I was wondering if this could have been caused by Malware/Rootkit or be the remains of one. They did do a Malwarebytes and Avast scans before handing it over to me to fix. Normally, I'd just backup their data and preform a wipe and reload, but the User doesn't have their restore DVDs.

System Specs:

Lenovo 3000 G530 Notebook

T4400 2.20GHz Processor

3GB Ram

Windows 7 Home Premium 32-bit

DDS.LOG

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_29

Run by Takenaka at 13:00:37 on 2011-11-22

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3033.1661 [GMT -10:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\CONEXANT\SmartAudio\SmAudio.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Lenovo\Energy Management\utility.exe

C:\Program Files\HP\HP Software Update\hpwuschd2.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\System32\IgrsSvcs.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k HPService

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://lenovo.live.com/

mStart Page = hxxp://lenovo.live.com/

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll

BHO: 1 (0x1) - No File

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

mRun: [iAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe

mRun: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [updateP2GShortCut] "c:\program files\lenovo\power2go\muitransfer\muistartmenu.exe" "c:\program files\lenovo\power2go" updatewithcreateonce "software\cyberlink\power2go\5.0"

mRun: [EnergyUtility] c:\program files\lenovo\energy management\utility.exe

mRun: [Energy Management] c:\program files\lenovo\energy management\Energy Management.exe

mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

TCP: DhcpNameServer = 72.235.80.12 72.235.80.14

TCP: Interfaces\{78F4E29F-2993-4DC9-B242-6DD487AD9608} : DhcpNameServer = 72.235.80.12 72.235.80.14

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\takenaka\appdata\roaming\mozilla\firefox\profiles\xr9dpx29.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.co.jp/

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\avast software\avast\webrep\FF

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-11-18 64512]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-11-17 442200]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-11-17 320856]

R1 funfrm;funfrm;c:\windows\system32\drivers\funfrm.sys [2009-12-9 54800]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-11-17 20568]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-17 54616]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-11-17 44768]

R2 IGRS;IGRS;c:\program files\lenovo\readycomm\common\IGRS.exe [2009-7-14 38152]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-11-3 2152152]

R2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\system32\igrssvcs.exe -k igrssvcs --> c:\windows\system32\IgrsSvcs.exe -k IgrsSvcs [?]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2011-11-15 260648]

R3 wdmirror;wdmirror;c:\windows\system32\drivers\WDMirror.sys [2009-12-9 11792]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-1-18 136176]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-2-14 1153368]

S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [2009-12-9 21520]

S3 Bridge0;Bridge0;c:\windows\system32\drivers\wdbridge.sys [2009-12-9 63240]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-1-18 136176]

S3 k57nd60x;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\k57nd60x.sys [2009-7-13 229888]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-11-3 15232]

S3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\lenovo\readycomm\AppSvc.exe [2009-12-9 414984]

S3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\lenovo\readycomm\ConnSvc.exe [2009-12-9 472328]

S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]

S3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\system32\igrssvcs.exe -k igrssvcs --> c:\windows\system32\IgrsSvcs.exe -k IgrsSvcs [?]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-11-18 52224]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-13 14336]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-6-18 1343400]

S3 wsvd;wsvd;c:\windows\system32\drivers\wsvd.sys [2009-7-21 81704]

S4 AzBusFixService;User-mode service for AzBusFix;c:\windows\system32\AzBusMon.exe [2009-12-9 60928]

.

=============== Created Last 30 ================

.

2011-11-22 22:57:12 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{440caf0d-1422-4957-89d0-5e03f2001ec2}\offreg.dll

2011-11-22 22:57:11 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{440caf0d-1422-4957-89d0-5e03f2001ec2}\mpengine.dll

2011-11-22 22:41:56 -------- d-----w- c:\windows\system32\wbem\repository

2011-11-22 01:23:47 -------- d-----w- c:\windows\pss

2011-11-21 20:03:03 586752 ----a-w- c:\windows\system32\drivers\PEAuth.sys

2011-11-19 04:23:35 16432 ----a-w- c:\windows\system32\lsdelete.exe

2011-11-19 03:26:57 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-11-19 03:26:54 -------- d-----w- c:\program files\Lavasoft

2011-11-19 03:09:49 -------- d-----w- C:\TDSSKiller_Quarantine

2011-11-19 01:21:38 -------- d-----w- c:\windows\system32\SPReview

2011-11-19 01:03:59 93696 ----a-w- c:\windows\system32\fms.dll

2011-11-19 00:59:34 -------- d-----w- c:\windows\system32\EventProviders

2011-11-18 22:34:03 -------- d-----w- c:\program files\SystemRequirementsLab

2011-11-18 22:27:57 -------- d-----w- c:\program files\CCleaner

2011-11-18 22:00:01 -------- d-sh--w- C:\found.000

2011-11-18 21:55:26 -------- d-sh--w- C:\$RECYCLE.BIN

2011-11-18 21:41:36 -------- d-----w- C:\omgwtfbbq115099o

2011-11-18 14:50:59 53760 ----a-w- c:\windows\system32\drivers\intelppm.sys

2011-11-18 14:50:59 2506232 ----a-w- c:\windows\system32\drivers\bcmwl6.sys

2011-11-18 02:50:33 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-11-18 02:50:33 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-11-18 02:50:22 41184 ----a-w- c:\windows\avastSS.scr

2011-11-18 02:50:16 -------- d-----w- c:\programdata\AVAST Software

2011-11-18 02:50:16 -------- d-----w- c:\program files\AVAST Software

2011-11-18 02:49:01 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-18 01:30:10 445008 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2011-11-17 02:33:23 -------- d-----w- c:\users\takenaka\appdata\local\Diagnostics

2011-11-17 02:31:22 -------- d-----w- c:\users\takenaka\appdata\roaming\Malwarebytes

2011-11-17 02:20:29 -------- d-----w- c:\users\takenaka\appdata\local\ElevatedDiagnostics

2011-11-17 02:14:43 53248 ----a-w- c:\windows\system32\CSVer.dll

2011-11-17 02:14:33 -------- d-----w- C:\Drivers

2011-11-17 01:59:10 -------- d-----w- c:\programdata\Malwarebytes

2011-11-17 01:59:06 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-17 01:59:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-17 01:55:21 -------- d-----w- c:\users\takenaka\appdata\local\temp

2011-11-17 01:44:39 -------- d-----w- C:\omgwtfbbq1

2011-11-17 01:31:39 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-17 01:31:36 708608 ----a-w- c:\program files\common files\system\wab32.dll

2011-11-17 01:31:33 2341888 ----a-w- c:\windows\system32\win32k.sys

2011-11-16 19:58:51 15952 ----a-w- c:\windows\system32\kdcom.dll

2011-11-16 11:33:42 15952 ----a-w- C:\kdcom.dll

2011-11-16 01:00:33 260648 ----a-w- c:\windows\system32\drivers\b57nd60x.sys

2011-11-15 21:45:26 -------- d-----w- C:\$AVG

2011-11-15 16:04:52 -------- d-----w- C:\test

2011-11-10 21:12:05 -------- d-----w- c:\windows\Standalone System Sweeper

2011-11-06 17:56:58 -------- d-sh--w- c:\users\takenaka\appdata\local\b510471e

2011-10-26 16:59:28 6144 ----a-w- c:\program files\internet explorer\iecompat.dll

.

==================== Find3M ====================

.

2011-11-19 03:29:00 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-11-19 01:17:38 152576 ----a-w- c:\windows\system32\msclmd.dll

2011-10-13 22:15:34 8198936 ----a-w- c:\windows\system32\TVWSetup.exe

2011-10-13 22:15:30 138008 ----a-w- c:\windows\system32\igfxtray.exe

2011-10-13 22:15:24 268056 ----a-w- c:\windows\system32\igfxsrvc.exe

2011-10-13 22:15:22 172824 ----a-w- c:\windows\system32\igfxpers.exe

2011-10-13 22:15:20 179480 ----a-w- c:\windows\system32\igfxext.exe

2011-10-13 22:15:18 3157784 ----a-w- c:\windows\system32\GfxUI.exe

2011-10-13 22:15:18 171288 ----a-w- c:\windows\system32\hkcmd.exe

2011-10-13 22:09:06 81920 ----a-w- c:\windows\system32\igfxCoIn_v2555.dll

2011-10-13 22:01:28 4967424 ----a-w- c:\windows\system32\igdumd32.dll

2011-10-13 22:01:26 9037312 ----a-w- c:\windows\system32\drivers\igdkmd32.sys

2011-10-13 21:58:56 571904 ----a-w- c:\windows\system32\igdumdx32.dll

2011-10-13 21:55:16 4411392 ----a-w- c:\windows\system32\igd10umd32.dll

2011-10-13 21:42:40 11405312 ----a-w- c:\windows\system32\ig4icd32.dll

2011-10-13 21:32:40 261632 ----a-w- c:\windows\system32\igfxTMM.dll

2011-10-13 21:32:40 195584 ----a-w- c:\windows\system32\igfxpph.dll

2011-10-13 21:32:34 23552 ----a-w- c:\windows\system32\igfxexps.dll

2011-10-13 21:32:32 115200 ----a-w- c:\windows\system32\igfxcpl.cpl

2011-10-13 21:32:22 57856 ----a-w- c:\windows\system32\igfxsrvc.dll

2011-10-13 21:32:04 130048 ----a-w- c:\windows\system32\igfxdo.dll

2011-10-13 21:31:58 95232 ----a-w- c:\windows\system32\hccutils.dll

2011-10-13 21:31:50 120320 ----a-w- c:\windows\system32\gfxSrvc.dll

2011-10-13 21:31:48 4096 ----a-w- c:\windows\system32\IGFXDEVLib.dll

2011-10-13 21:31:48 228864 ----a-w- c:\windows\system32\igfxdev.dll

2011-10-13 21:31:30 85504 ----a-w- c:\windows\system32\igfxrenu.lrc

2011-10-13 21:31:30 828928 ----a-w- c:\windows\system32\igfxress.dll

2011-10-03 15:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-01 02:42:56 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-08-27 04:26:27 571904 ----a-w- c:\windows\system32\oleaut32.dll

2011-08-27 04:26:27 233472 ----a-w- c:\windows\system32\oleacc.dll

.

============= FINISH: 13:01:55.24 ===============

Mahalo!

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

[ZhaxRa]

Back from a long holiday. Ended up backing up her data and preformed a wipe and re-load of the OS.

Sorry about that, but thanks for the help.

[screen317]

Thanks for letting me know.

I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!