XP 2011 Antivirus Virus

shelly89 · May 25, 2011

Hello-

Heres a timeline of what happened.

EVENING 1: Powered on computer and Windows XP did not open normally. Instead, DOS message saying something like "WINDOWS.CMD missing. Please run WIndows install disk repair program and hit R when requested...." (I'm paraphrasing here.) I did have to run my Windows XP install disk and repair (did not reformat).

After getting into Windows finally, my AVG antivirus popped on and said it couldn't find my license key and was shutting down. Immediately I got popups for the rogue "XP 2011 Antivirus" which I knew was malware. I kind of knew how to handle it and immediately wanted to repair my AVG. I changed to an unaffected user profile and was able to get my AVG repaired, and in turn, able to install Spybot S&D and run scans on AVG and also Spybot S&D. I found 10 trojans on AVG and 100 malware on Spybot S&D. I then went to bed while running a second scan on AVG.

DAY 2: I woke to find that on my user profile (the affected one) I had no desktop, no "my documents", indeed, nothing except a "cookies" folder and a recycle bin. The other unaffected user profile still worked. I ran alternating scans all day long of AVG and Spybot S&D and kept finding different trojans and malware. While watching the scans, I saw that my old files from my desktop and "my documents" are still, indeed, in the computer somewhere, presumably being held hostage by the malware, but I cannot find them.

DAY 3: I continued to run alternating scans of AVG and Spybot S&D but make little progress. I attempt to log into forums for help like this but my browser is also hijacked and shuts down when I go to sites like this. I finally manage to install Malwarebytes and run a scan, which finds a crop of 12 Malware that I don't think Spybot S&D had found. Afterward, my computer runs a "little" better but still, my files are missing and browser hijacked. I attempt to use self-help instructions from "bleepingcomputer" for taking care of the original malware XP 2011 antivirus. This calls for running a series of things, including eXplorer, Malwarebytes and something else at the beginning (I apologize, I don't remember) but it doesn't take care of the problem. At the end of the day, we uninstall AVG and install an alternate antivirus, partly because we are losing confidence in AVG since it did let all this into our computer in the first place even though it was running all the time. When the new antivirus seems to cause more problems than anything we uninstall it and then attempt to reinstall AVG, and cannot now.

I need help removing all bits of the old installation of AVG and the other antivirus so that I can reinstall AVG, in addition to help with the rogues, malware, trojans, etc. I doubt I have a functional antivirus on my computer at present, though my computer is not warning me about that right now.

I am unable to run a malwarebytes scan right now. It gave me two error messages and told me to tell you these errors. So here they are:

From MalwareBytes

ERROR: 702 (0, 453)

ERROR: 723 (3, 0)

Below is my DDS log pasted in. I have attached my GMER and DDS attach logs. Thank you so much for your patience with my story and I hope someone can help me.

.

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23

Run by Rich at 9:57:39 on 2011-05-25

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.516 [GMT -4:00]

.

AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Documents and Settings\Shelly\Local Settings\Application Data\CrossLoop\CrossLoopService.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\msiexec.exe

C:\Documents and Settings\Rich\Application Data\Dropbox\bin\Dropbox.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Documents and Settings\Rich\Desktop\dds.scr

C:\WINDOWS\system32\MsiExec.exe

C:\WINDOWS\system32\WSCRIPT.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = hxxp://click.marshallsonline.com/r/U0LKM/95WTN/IQBTH0/0DOLP/GE3JO/6V/h?a=M_EM600

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: ViewerHelper Class: {78104a01-8e71-4f30-9a36-3793799615b4} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll

BHO: CPrintEnhancer Object: {ae84a6aa-a333-4b92-b276-c11e2212e4fe} - c:\program files\hp\smart web printing\SmartWebPrinting.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"

uRun: [iSUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden

uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [bDAgent] "c:\program files\defender pro\defender pro 15-in-1\bdagent.exe"

mRun: [Defender Pro Antiphishing Helper] "c:\program files\defender pro\defender pro 15-in-1\ieshow.exe"

mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVIMlctM1NYM0UtR0hHWDktQUZISjMtUFcyUU4tWjlLSDQ"&"inst=NzctNTEwMzU1NjA4LUZQOSs2LUJBUjlHKzEtVEI5KzItRkwrOS1RSVgxKzQtWDIwMTArMi1GMTBNMTBEKzItTElDKzItRkwxMCsxLVNQMSsxLVNQMVRCKzEtU1VQKzMtU1AxUzIrMQ"&"prod=90"&"ver=10.0.1375

StartupFolder: c:\docume~1\rich\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\rich\application data\dropbox\bin\Dropbox.exe

IE: &Search - ?s=100000341&p=GRfox000&si=&a=PjcYrHBHYYfTbL.vq8uJJA&n=2010082211

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll

IE: {685ec120-f786-4498-a8f0-794d47916161} - {C733FB84-6DB3-4363-8AA7-678F9B5E828E} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

IE: {aede78a6-42b6-4c3c-96eb-5ae6dbec4859} - {78104A01-8E71-4F30-9A36-3793799615B4} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

Filter: application/msword - {DFF82902-0B96-3B98-6F62-D655E146A23A} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

Filter: application/vnd.ms-excel - {DFF82902-0B96-3B98-6F62-D655E146A23A} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

Filter: application/vnd.ms-powerpoint - {DFF82902-0B96-3B98-6F62-D655E146A23A} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

Filter: application/x-microsoft-rpmsg-message - {DFF82902-0B96-3B98-6F62-D655E146A23A} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: rmh - {23C585BB-48FF-4865-8934-185F0A7EB84C} - c:\program files\microsoft\rights management add-on\RMAFilt.dll

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\rich\application data\mozilla\firefox\profiles\in5o33rt.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - www.google.com

FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll

FF - plugin: c:\documents and settings\all users\application data\zylom\zylomgamesplayer\npzylomgamesplayer.dll

FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R2 CrossLoopService;CrossLoop Service;c:\documents and settings\shelly\local settings\application data\crossloop\CrossLoopService.exe [2011-3-10 560848]

R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [2006-11-21 203264]

S3 LGDDCDevice;LGDDCDevice;c:\program files\lg soft india\fortemanager\bin\I2CDriver.sys [2011-3-8 14336]

S3 LGII2CDevice;LGII2CDevice;c:\program files\lg soft india\fortemanager\bin\PII2CDriver.sys [2011-3-8 18432]

S3 NUVision;NUVision II Video Service;c:\windows\system32\drivers\nuvvid2.sys [2010-6-1 153760]

S3 tvnserver;TightVNC Server;c:\documents and settings\shelly\local settings\application data\crossloop\tvnserver.exe [2011-3-10 814080]

.

=============== Created Last 30 ================

.

2011-05-25 13:13:26 -------- d-----w- c:\documents and settings\all users\application data\bdch

2011-05-25 11:57:04 -------- d-sh--w- c:\documents and settings\rich\PrivacIE

2011-05-25 11:53:11 -------- d-sh--w- c:\documents and settings\rich\IETldCache

2011-05-25 11:33:16 -------- dc-h--w- c:\windows\ie8

2011-05-25 11:24:59 -------- d-----w- C:\c90852e77b64318d9926

2011-05-25 04:44:01 -------- d-----w- c:\documents and settings\all users\application data\BitDefender

2011-05-25 04:41:48 -------- d-----w- c:\documents and settings\rich\application data\Defender Pro

2011-05-25 04:39:22 -------- d-----w- c:\program files\Defender Pro

2011-05-25 04:06:41 -------- d-----w- c:\documents and settings\rich\application data\QuickScan

2011-05-25 03:24:51 -------- d-----w- c:\documents and settings\all users\application data\Defender Pro

2011-05-25 03:19:37 100723 ----a-w- c:\documents and settings\all users\application data\bdinstall.bin

2011-05-24 19:30:08 388096 ----a-r- c:\documents and settings\rich\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

2011-05-24 19:30:07 -------- d-----w- c:\program files\Trend Micro

2011-05-24 15:37:40 -------- d-----w- c:\documents and settings\rich\application data\Malwarebytes

2011-05-24 15:37:33 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-24 15:37:32 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-05-24 15:37:28 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-05-24 15:37:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-05-23 22:00:01 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2011-05-23 22:00:00 711672 ----a-w- c:\program files\mozilla firefox\uninstall\helper.exe

2011-05-23 18:29:44 135168 ----a-w- c:\windows\system32\igfxres.dll

2011-05-23 06:12:06 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-05-23 06:12:06 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-05-23 03:22:42 -------- d-----w- c:\documents and settings\rich\local settings\application data\{BAA8212F-E423-4A81-ABCE-E12CD64784BE}

2011-05-23 03:10:57 79872 -c--a-w- c:\windows\system32\dllcache\rwia330.dll

2011-05-23 03:09:59 7680 -c--a-w- c:\windows\system32\dllcache\kbdnecnt.dll

2011-05-23 03:08:56 480256 -c--a-w- c:\windows\system32\dllcache\cintsetp.exe

2011-05-23 03:05:45 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe

2011-05-23 03:05:45 16384 ----a-w- c:\program files\internet explorer\connection wizard\isignup.exe

2011-05-23 02:52:36 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll

2011-05-23 02:52:36 24661 ----a-w- c:\windows\system32\spxcoins.dll

2011-05-23 02:52:36 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll

2011-05-23 02:52:36 13312 ----a-w- c:\windows\system32\irclass.dll

2011-05-23 02:52:05 13753 ----a-r- c:\windows\SETFB.tmp

2011-05-23 02:52:02 1086058 ----a-r- c:\windows\SETEF.tmp

2011-05-23 02:52:00 1042903 ----a-r- c:\windows\SETEC.tmp

2011-05-22 21:01:01 0 ----a-w- c:\windows\Tnisisequp.bin

2011-05-20 02:54:04 -------- d-----w- c:\documents and settings\rich\local settings\application data\ArcSoft

2011-05-19 13:14:38 -------- d-----w- c:\documents and settings\all users\application data\ArcSoft

2011-05-19 13:13:32 18688 ----a-w- c:\windows\system32\drivers\afc.sys

2011-05-04 17:10:58 -------- d-----w- c:\windows\LMI9.tmp

2011-05-03 01:21:32 -------- d-----w- c:\windows\ASTULogTemp

.

==================== Find3M ====================

.

2011-03-07 02:08:13 93552 ----a-w- c:\windows\system32\ElbyCDIO.dll

2011-03-07 00:52:09 134512 ----a-w- c:\windows\system32\ElbyVCD.dll

2010-07-08 14:37:14 101544 ----a-w- c:\program files\common files\LinkInstaller.exe

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: ST340014A rev.3.06 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86E814D0]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x86e877f0]; MOV EAX, [0x86e8786c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 nt!IofCallDriver[0x804E3D45] -> \Device\Harddisk0\DR0[0x86D22AB8]

3 CLASSPNP[0xF77F705B] -> nt!IofCallDriver[0x804E3D45] -> \Device\0000005c[0x86FAC030]

5 ACPI[0xF774D620] -> nt!IofCallDriver[0x804E3D45] -> [0x86F60940]

\Driver\atapi[0x86F92C78] -> IRP_MJ_CREATE -> 0x86E814D0

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x86E8131B

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 10:02:37.35 ===============

attach.txt

ark.txt

screen317 · May 26, 2011

Hi and welcome to Malwarebytes.

Download the file TDSSKiller.zip and extract it into a folder on the infected PC.
Execute the file TDSSKiller.exe by double-clicking on it.
Wait for the scan and disinfection process to be over.
When its work is over, the utility prompts for a reboot to complete the disinfection.

By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).

The log is like UtilityName.Version_Date_Time_log.txt.

for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.

Please post that log here.

Next, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt in your reply.

shelly89 · May 26, 2011

Hi and welcome to Malwarebytes.
Download the file TDSSKiller.zip and extract it into a folder on the infected PC.
Execute the file TDSSKiller.exe by double-clicking on it.
Wait for the scan and disinfection process to be over.
When its work is over, the utility prompts for a reboot to complete the disinfection.
By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).
The log is like UtilityName.Version_Date_Time_log.txt.
for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.
Please post that log here.
Next, please update MBAM, run a Quick Scan, and post its log.
Next, run DDS again and post DDS.txt in your reply.

Thank you for your assistance.

I ran the TDSS as you asked and posted that log below.

I then attempted to update/run the MBAM and got the same errors I got the last time I tried to run it. I was wondering if I should uninstall it and do a fresh re-install of it but wanted to ask you first before doing that.

I didn't do the DDS yet since I was not able to do MBAM yet. Please advise about how to handle the fact that MBAM still won't let me run it. Thanks-

Here's the TDSS log:

2011/05/26 16:53:51.0156 2300 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24

2011/05/26 16:53:51.0484 2300 ================================================================================

2011/05/26 16:53:51.0484 2300 SystemInfo:

2011/05/26 16:53:51.0484 2300

2011/05/26 16:53:51.0484 2300 OS Version: 5.1.2600 ServicePack: 2.0

2011/05/26 16:53:51.0484 2300 Product type: Workstation

2011/05/26 16:53:51.0484 2300 ComputerName: OFFICECOMPUTER

2011/05/26 16:53:51.0484 2300 UserName: Rich

2011/05/26 16:53:51.0484 2300 Windows directory: C:\WINDOWS

2011/05/26 16:53:51.0484 2300 System windows directory: C:\WINDOWS

2011/05/26 16:53:51.0484 2300 Processor architecture: Intel x86

2011/05/26 16:53:51.0484 2300 Number of processors: 1

2011/05/26 16:53:51.0484 2300 Page size: 0x1000

2011/05/26 16:53:51.0484 2300 Boot type: Normal boot

2011/05/26 16:53:51.0484 2300 ================================================================================

2011/05/26 16:53:53.0062 2300 Initialize success

2011/05/26 16:53:57.0328 2516 ================================================================================

2011/05/26 16:53:57.0328 2516 Scan started

2011/05/26 16:53:57.0328 2516 Mode: Manual;

2011/05/26 16:53:57.0328 2516 ================================================================================

2011/05/26 16:54:02.0609 2516 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/26 16:54:03.0093 2516 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/05/26 16:54:03.0859 2516 aeaudio (e696e749bedcda8b23757b8b5ea93780) C:\WINDOWS\system32\drivers\aeaudio.sys

2011/05/26 16:54:04.0359 2516 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys

2011/05/26 16:54:04.0765 2516 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\WINDOWS\system32\drivers\Afc.sys

2011/05/26 16:54:05.0640 2516 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys

2011/05/26 16:54:07.0484 2516 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/05/26 16:54:08.0703 2516 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/26 16:54:09.0078 2516 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/26 16:54:09.0687 2516 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/26 16:54:10.0078 2516 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/26 16:54:10.0625 2516 b57w2k (2fa609c3411ec5f77f42d0b04d304ae5) C:\WINDOWS\system32\DRIVERS\b57xp32.sys

2011/05/26 16:54:11.0156 2516 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/26 16:54:11.0781 2516 BENDER (fc6d0c2f327a5f716fdfdc24a305aceb) C:\WINDOWS\system32\drivers\bender.sys

2011/05/26 16:54:12.0187 2516 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/26 16:54:12.0531 2516 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/05/26 16:54:13.0156 2516 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/26 16:54:13.0500 2516 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/26 16:54:13.0828 2516 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/26 16:54:15.0609 2516 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/26 16:54:16.0265 2516 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/26 16:54:16.0984 2516 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys

2011/05/26 16:54:17.0390 2516 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/26 16:54:17.0765 2516 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/26 16:54:18.0359 2516 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/26 16:54:18.0703 2516 ElbyCDIO (d71233d7ccc2e64f8715a20428d5a33b) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys

2011/05/26 16:54:19.0125 2516 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/26 16:54:19.0531 2516 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys

2011/05/26 16:54:19.0953 2516 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/26 16:54:20.0343 2516 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

2011/05/26 16:54:20.0906 2516 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/05/26 16:54:21.0500 2516 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/26 16:54:21.0890 2516 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/26 16:54:22.0265 2516 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

2011/05/26 16:54:22.0593 2516 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/26 16:54:22.0953 2516 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/05/26 16:54:23.0625 2516 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys

2011/05/26 16:54:24.0000 2516 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

2011/05/26 16:54:24.0515 2516 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys

2011/05/26 16:54:25.0171 2516 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/26 16:54:26.0250 2516 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/05/26 16:54:27.0093 2516 ialm (9a883c3c4d91292c0d09de7c728e781c) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

2011/05/26 16:54:27.0906 2516 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/26 16:54:28.0656 2516 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys

2011/05/26 16:54:28.0984 2516 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/26 16:54:29.0390 2516 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/05/26 16:54:29.0843 2516 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/26 16:54:30.0281 2516 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/26 16:54:30.0671 2516 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/26 16:54:31.0078 2516 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/26 16:54:31.0453 2516 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/26 16:54:31.0968 2516 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/26 16:54:32.0500 2516 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/26 16:54:32.0890 2516 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/26 16:54:33.0421 2516 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/26 16:54:33.0906 2516 LGDDCDevice (87d6731f70d017590e12735ecc746cde) C:\Program Files\LG Soft India\forteManager\bin\I2CDriver.sys

2011/05/26 16:54:34.0031 2516 LGII2CDevice (089010666d9ea3bd17afede301950b09) C:\Program Files\LG Soft India\forteManager\bin\PII2CDriver.sys

2011/05/26 16:54:34.0468 2516 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/26 16:54:34.0828 2516 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/26 16:54:35.0281 2516 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/26 16:54:35.0671 2516 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/05/26 16:54:36.0250 2516 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/26 16:54:37.0000 2516 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/26 16:54:37.0593 2516 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/26 16:54:38.0140 2516 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/26 16:54:38.0531 2516 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/26 16:54:38.0875 2516 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/26 16:54:39.0265 2516 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/26 16:54:39.0609 2516 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/26 16:54:39.0984 2516 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/05/26 16:54:40.0421 2516 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/26 16:54:40.0781 2516 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/05/26 16:54:41.0203 2516 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/26 16:54:41.0609 2516 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/05/26 16:54:41.0937 2516 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/26 16:54:42.0296 2516 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/26 16:54:42.0687 2516 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/26 16:54:43.0062 2516 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/26 16:54:43.0484 2516 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/26 16:54:43.0890 2516 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/26 16:54:44.0406 2516 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys

2011/05/26 16:54:44.0781 2516 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/26 16:54:45.0390 2516 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/26 16:54:45.0921 2516 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/26 16:54:46.0328 2516 nuvaud2 (363be28dda6160610d7361ed368f1813) C:\WINDOWS\system32\DRIVERS\nuvaud2.sys

2011/05/26 16:54:46.0734 2516 NUVision (45c4a903426c96b5a824f69c859f9ca1) C:\WINDOWS\system32\DRIVERS\nuvvid2.sys

2011/05/26 16:54:47.0156 2516 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/26 16:54:47.0578 2516 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/26 16:54:47.0953 2516 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2011/05/26 16:54:48.0468 2516 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/05/26 16:54:48.0875 2516 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/26 16:54:49.0234 2516 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/26 16:54:49.0703 2516 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/26 16:54:50.0578 2516 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys

2011/05/26 16:54:51.0000 2516 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/05/26 16:54:53.0593 2516 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/26 16:54:53.0968 2516 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/26 16:54:54.0468 2516 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/26 16:54:56.0359 2516 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/26 16:54:56.0718 2516 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/26 16:54:57.0140 2516 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/26 16:54:57.0531 2516 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/26 16:54:57.0921 2516 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/26 16:54:58.0343 2516 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/26 16:54:58.0812 2516 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/26 16:54:59.0265 2516 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/26 16:54:59.0671 2516 RimUsb (92d33f76769a028ddc54a863eb7de4a2) C:\WINDOWS\system32\Drivers\RimUsb.sys

2011/05/26 16:55:00.0125 2516 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys

2011/05/26 16:55:00.0484 2516 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys

2011/05/26 16:55:00.0890 2516 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/26 16:55:01.0250 2516 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/05/26 16:55:01.0703 2516 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/05/26 16:55:02.0093 2516 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/26 16:55:02.0828 2516 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/05/26 16:55:03.0562 2516 smwdm (fa3368a7039f5abaa4b933703ac34763) C:\WINDOWS\system32\drivers\smwdm.sys

2011/05/26 16:55:04.0546 2516 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/26 16:55:04.0937 2516 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/26 16:55:05.0437 2516 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/26 16:55:05.0968 2516 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/05/26 16:55:06.0296 2516 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/26 16:55:06.0828 2516 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/26 16:55:08.0406 2516 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/26 16:55:08.0937 2516 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/26 16:55:09.0453 2516 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/26 16:55:09.0828 2516 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/26 16:55:10.0203 2516 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/26 16:55:10.0984 2516 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/26 16:55:11.0781 2516 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/26 16:55:12.0234 2516 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\WINDOWS\system32\Drivers\usbaapl.sys

2011/05/26 16:55:12.0562 2516 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/05/26 16:55:12.0906 2516 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/26 16:55:13.0281 2516 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/26 16:55:13.0687 2516 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/05/26 16:55:14.0015 2516 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/05/26 16:55:14.0359 2516 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/26 16:55:14.0750 2516 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/05/26 16:55:15.0093 2516 VClone (fce98c43b5c5db8e0da8ea0e2b45e044) C:\WINDOWS\system32\DRIVERS\VClone.sys

2011/05/26 16:55:15.0453 2516 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys

2011/05/26 16:55:16.0062 2516 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/26 16:55:16.0421 2516 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/26 16:55:16.0843 2516 wceusbsh (4a954a20a4c73d6db13c0fe25f3f1b0c) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys

2011/05/26 16:55:17.0343 2516 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys

2011/05/26 16:55:18.0140 2516 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/26 16:55:18.0578 2516 WpdUsb (1385e5aa9c9821790d33a9563b8d2dd0) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

2011/05/26 16:55:19.0000 2516 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/05/26 16:55:19.0375 2516 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/05/26 16:55:19.0796 2516 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2011/05/26 16:55:19.0921 2516 MBR (0x1B8) (2839639fa37b8353e792a2a30a12ced3) \Device\Harddisk0\DR0

2011/05/26 16:55:19.0937 2516 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)

2011/05/26 16:55:19.0937 2516 ================================================================================

2011/05/26 16:55:19.0937 2516 Scan finished

2011/05/26 16:55:19.0937 2516 ================================================================================

2011/05/26 16:55:19.0968 0356 Detected object count: 1

2011/05/26 16:55:19.0968 0356 Actual detected object count: 1

2011/05/26 16:55:28.0578 0356 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot

2011/05/26 16:55:28.0687 0356 \Device\Harddisk0\DR0 - ok

2011/05/26 16:55:28.0687 0356 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure

2011/05/26 16:55:38.0109 2416 Deinitialize success

shelly89 · May 26, 2011

I answered my own question. I decided to uninstall MBAM and reinstall it. I was never going to get anywhere with it the way it was installed before.

Having said that, here are my current MBAM logs and my DDS logs, and attached the DDS log that it creates for that purpose also. Thanks again-

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6686

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

5/26/2011 6:10:18 PM

mbam-log-2011-05-26 (18-10-18).txt

Scan type: Quick scan

Objects scanned: 214049

Time elapsed: 30 minute(s), 54 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\Rich\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

.

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23

Run by Rich at 18:13:57 on 2011-05-26

.

============== Running Processes ===============

.

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Documents and Settings\Shelly\Local Settings\Application Data\CrossLoop\CrossLoopService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Documents and Settings\Rich\Application Data\Dropbox\bin\Dropbox.exe

C:\WINDOWS\System32\alg.exe

C:\Documents and Settings\Rich\Desktop\dds.scr

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\MsiExec.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService