[Resolved] Google search results sometimes redirect to ads

Hello,

I've actually got several problems but the topic title field wasn't long enough for all of them so I just used the Google search results one as the title.

My problems are:

1) Google search results sometimes (but not always) redirect to ads in both Firefox and IE. This only affects Google. Other search engines work fine.

2) Every few days my computer will take a long time to login and only get as far as showing my desktop (but no icons and no taskbar). In order to get it working properly again I have to use MSCONFIG to disable all of the startup programs and then restart. After this I can re-enable the startup programs and the machine will be fine again for a few days. When this problem happens I cannot boot in safe mode, it just goes into a reboot loop if I attempt safe mode.

3) This problem has only just come to light when I was preparing to post my thread on these forums but when I run a GMER scan the PC crashes and restarts. If I'm scanning files it happens at about the same point in the file scan every time and if I untick the files box then it seems to reboot a few minutes after I start the scan, even if I've long since saved the log and exited GMER.

For this reason, my GMER log (below) is not complete, because I could not get it to run without the machine rebooting when I had "Files" ticked, so I ran a scan with Files unticked because I presumed you guys would prefer to have something rather than nothing at all.

That's my description of the problem, now here are my logs. I've removed all of the stuff that MBAM found but I'm afraid it hasn't fixed the problems:

MBAM Log:

Malwarebytes' Anti-Malware 1.43
Database version: 3481
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

02/01/2010 19:25:36
mbam-log-2010-01-02 (19-25-36).txt

Scan type: Quick Scan
Objects scanned: 129096
Time elapsed: 4 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 7
Registry Values Infected: 1
Registry Data Items Infected: 4
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\lmep.bqo (Backdoor.Bot) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\idid (Trojan.Sasfix) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe rundll32.exe lmep.bqo gjdmos) Good: (Explorer.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Folders Infected:
C:\Documents and Settings\Bex\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\lmep.bqo (Backdoor.Bot) -> Delete on reboot.
C:\Documents and Settings\Bex\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Bex\Application Data\wsnpoem\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.


GMER Log (incomplete - see description above):

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-02 21:06:34
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Jamey\LOCALS~1\Temp\fwliqpow.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwAssignProcessToJobObject [0xA054EA60]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwClose [0xA0533BF0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwConnectPort [0xA0550920]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateFile [0xA052FF60]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwCreateKey [0xB9EAE3E6]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateProcess [0xA05472B0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateProcessEx [0xA0547BB0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateSection [0xA052ED10]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateSymbolicLinkObject [0xA053AE40]
SSDT BA67E68C ZwCreateThread
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwDebugActiveProcess [0xA0553F30]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwDeleteFile [0xA0539B20]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwDeleteKey [0xB9EAF0F2]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwDeleteValueKey [0xB9EAEB06]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwLoadDriver [0xA0544BB0]
SSDT BA67E6AA ZwLoadKey
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwMakeTemporaryObject [0xA053A6B0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwOpenFile [0xA0532C10]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwOpenKey [0xB9EAE684]
SSDT BA67E678 ZwOpenProcess
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwOpenSection [0xA052F580]
SSDT BA67E67D ZwOpenThread
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwProtectVirtualMemory [0xA054FDA0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueryDirectoryFile [0xA05348A0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueryKey [0xA053E750]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwQueryValueKey [0xB9EAE90A]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueueApcThread [0xA054DED0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRenameKey [0xA0542590]
SSDT BA67E6B4 ZwReplaceKey
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRequestPort [0xA0552A50]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRequestWaitReplyPort [0xA0552D70]
SSDT BA67E6AF ZwRestoreKey
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSaveKey [0xA0540C80]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSaveKeyEx [0xA05414D0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSecureConnectPort [0xA0551480]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetContextThread [0xA054D440]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetInformationDebugObject [0xA0554520]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetInformationFile [0xA0535BF0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetSystemInformation [0xA05441C0]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwSetValueKey [0xB9EAEE82]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSuspendProcess [0xA054C190]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSuspendThread [0xA054CAC0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSystemDebugControl [0xA0553770]
SSDT BA67E687 ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwTerminateThread [0xA054B620]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwUnloadDriver [0xA0545530]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwWriteVirtualMemory [0xA054F2B0]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.)

Device \FileSystem\Udfs \UdfsCdRom BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Udfs \UdfsDisk BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \Driver\Tcpip \Device\Ip afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\Tcp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\Udp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\RawIp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\IPMULTICAST afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Cdfs \Cdfs BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)

—- EOF - GMER 1.0.15 —-


DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 20:08:57.34 on 02/01/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2585 [GMT 0:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\dds.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\msxgdn32.exe,c:\documents and settings\bex\application data\msntcn32.exe,c:\documents and settings\bex\application data\msspcf32.exe,c:\documents and settings\bex\application data\msopcj32.exe,c:\windows\system32\msvrwy32.exe,c:\windows\system32\mspivq32.exe,c:\windows\system32\msuxnz32.exe,c:\windows\system32\msytrj32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
{9292c2ad-d36e-4051-af6d-0c6d2aee0c10}
{cfc14adc-bb49-4010-91a7-c8f2cb004704}
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [OutpostMonitor] c:\progra~1\agnitum\outpos~1\op_mon.exe /tray /noservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
Notify: opnlllkj - opnlllkj.dll
AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll
{9292c2ad-d36e-4051-af6d-0c6d2aee0c10}
LSA: Authentication Packages = msv1_0 c:\windows\system32\cbxxywtu

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-27 11608]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [2009-12-27 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\agnitum\outpos~1\acs.exe [2009-12-27 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-27 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-27 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2009-12-27 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2009-12-27 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S1 kbd;kbd;\??\c:\windows\system32\drivers\kbd.sys –> c:\windows\system32\drivers\kbd.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-02 19:43 –d—– C:\spoolerlogs
2010-01-02 19:18 –d—– c:\docume~1\jamey\applic~1\Malwarebytes
2010-01-02 19:18 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-01 03:24 –d—– c:\program files\Trend Micro
2010-01-01 03:22 8 a——- c:\windows\crpf.bin
2010-01-01 03:22 4 a——- c:\windows\crpf_sdum.bin
2010-01-01 02:49 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 –d—– c:\program files\Lavasoft
2009-12-31 16:34 –d—– c:\program files\Spybot - Search & Destroy
2009-12-27 15:03 0 a——- c:\windows\%IniPath%
2009-12-27 11:06 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-27 11:06 –d—– c:\program files\Avira
2009-12-27 11:06 –d—– c:\docume~1\alluse~1\applic~1\Avira
2009-12-27 10:58 704,384 a——- c:\windows\system32\drivers\SandBox.sys
2009-12-27 10:58 257,432 a——- c:\windows\system32\drivers\afwcore.sys
2009-12-27 10:56 49 a——- c:\windows\transp.gif
2009-12-27 10:56 31,128 a——- c:\windows\system32\drivers\afw.sys
2009-12-27 10:56 –d—– c:\program files\Agnitum
2009-12-27 10:56 –d—– c:\docume~1\alluse~1\applic~1\Agnitum
2009-12-18 13:10 727,303 a——- c:\windows\cscmondump.bin
2009-12-18 12:59 134,173 a——- c:\windows\cscmon.bin
2009-12-18 12:58 132,424 a——- c:\windows\system32\drivers\CFRMD.sys
2009-12-18 12:58 13,824 a——- c:\windows\system32\cnat.exe
2009-12-12 23:47 –d—– c:\docume~1\jamey\applic~1\eMusic
2009-12-12 23:47 –d—– c:\program files\eMusic Download Manager
2009-12-12 19:43 –d—– c:\program files\Synchronization Technologies Inc
2009-12-08 23:16 –d—– c:\docume~1\jamey\applic~1\SyncMyCal

==================== Find3M ====================

2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe
2009-10-27 09:53 8,192 a——- c:\windows\system32\CSC.exe
2009-10-24 15:15 108,144 a——- c:\windows\system32\CmdLineExt.dll

============= FINISH: 20:10:00.31 ===============

Hi JP, thank you for helping me.

If it's ok with you I'd like for us to have a go at cleaning the system first and if we run into trouble then I'll decide whether to reformat as a last resort.

Is that ok?

I ran ComboFix and the log is below, but I did get one error message right at the beginning - it told me Comodo AV was still running but I uninstalled this weeks ago when I changed to using Avira Antivir and I was very careful to make sure I removed all of the Comodo stuff before I began to install Avira so I'm not sure how this happened but anyway, ComboFix still seemed to run ok so here's the output:

ComboFix 10-01-02.01 - Jamey 02/01/2010 22:56:48.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2557 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\1.tmp
C:\10.tmp
C:\11.tmp
C:\13.tmp
C:\14.tmp
C:\15.tmp
C:\16.tmp
C:\3.tmp
C:\8.tmp
C:\9.tmp
C:\A.tmp
C:\B.tmp
C:\D.tmp
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\E.tmp
C:\F.tmp
c:\windows\run.log
c:\windows\system32\stu2.exe

—– BITS: Possible infected sites —–

hxxp://opt3.biz
.
((((((((((((((((((((((((( Files Created from 2009-12-02 to 2010-01-02 )))))))))))))))))))))))))))))))
.

2010-01-02 19:43 . 2010-01-02 19:43 ——– d—–w- C:\spoolerlogs
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2009-12-30 14:55 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:18 . 2009-12-30 14:54 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:15 . 2010-01-02 19:16 ——– d—–w- c:\program files\ERUNT
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:49 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 . 2010-01-01 02:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-01 02:24 . 2010-01-01 02:24 ——– d—–w- c:\program files\Lavasoft
2009-12-31 16:34 . 2009-12-31 16:35 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-27 11:06 . 2009-12-28 13:40 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-27 11:06 . 2009-03-30 09:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-27 11:06 . 2009-02-13 11:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-27 11:06 . 2009-02-13 11:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\program files\Avira
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2009-12-27 10:58 . 2009-04-06 11:37 704384 —-a-w- c:\windows\system32\drivers\SandBox.sys
2009-12-27 10:58 . 2009-02-10 16:15 257432 —-a-w- c:\windows\system32\drivers\afwcore.sys
2009-12-27 10:56 . 2009-02-18 17:30 31128 —-a-w- c:\windows\system32\drivers\afw.sys
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\program files\Agnitum
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Agnitum
2009-12-18 13:10 . 2010-01-02 23:05 763115 —-a-w- c:\windows\cscmondump.bin
2009-12-18 12:59 . 2009-12-27 12:59 134173 —-a-w- c:\windows\cscmon.bin
2009-12-18 12:58 . 2009-10-27 15:46 132424 —-a-w- c:\windows\system32\drivers\CFRMD.sys
2009-12-18 12:58 . 2009-10-19 06:47 13824 —-a-w- c:\windows\system32\cnat.exe
2009-12-12 23:47 . 2009-12-13 00:59 ——– d—–w- c:\documents and settings\Jamey\Application Data\eMusic
2009-12-12 23:47 . 2009-12-12 23:47 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\eMusic
2009-12-12 23:47 . 2009-12-13 00:59 ——– d—–w- c:\program files\eMusic Download Manager
2009-12-12 19:43 . 2009-12-12 19:43 ——– d—–w- c:\program files\Synchronization Technologies Inc
2009-12-09 22:52 . 2009-12-09 22:52 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Google
2009-12-09 22:52 . 2009-12-09 23:05 ——– d—–w- c:\program files\Google
2009-12-09 07:58 . 2009-12-09 07:58 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Microsoft_Corporation
2009-12-09 07:57 . 2009-12-09 07:57 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\assembly
2009-12-08 23:17 . 2009-12-08 23:17 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Xenocode
2009-12-08 23:16 . 2009-12-08 23:20 ——– d—–w- c:\documents and settings\Jamey\Application Data\SyncMyCal

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-02 21:49 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2009-12-31 17:05 . 2007-09-16 17:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-24 15:32 . 2009-06-22 20:54 ——– d—–w- c:\program files\COMODO
2009-12-24 13:53 . 2009-06-22 20:56 1474832 —-a-w- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 . 2009-05-23 12:35 1984 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-07 14:10 . 2010-01-01 02:24 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2009-12-03 19:10 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\Jamey\Application Data\Tyre
2009-11-30 18:49 . 2009-11-30 18:49 ——– d—–w- c:\program files\AGEIA Technologies
2009-11-30 18:47 . 2007-05-26 00:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-11-30 18:39 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:58 . 2009-11-27 19:57 ——– d—–w- c:\program files\iTunes
2009-11-27 19:57 . 2009-11-27 19:57 ——– d—–w- c:\program files\iPod
2009-11-27 19:57 . 2009-04-02 21:43 ——– d—–w- c:\program files\Common Files\Apple
2009-11-27 19:55 . 2009-10-19 19:57 ——– d—–w- c:\program files\QuickTime
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-10 23:09 . 2009-11-10 23:09 ——– d—–w- c:\program files\Tyre
2009-11-10 23:09 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Tyre
2009-11-09 18:58 . 2009-11-09 16:32 ——– d—–w- c:\documents and settings\Jamey\Application Data\Bioshock
2009-11-09 16:25 . 2009-11-09 16:25 ——– d–h–r- c:\documents and settings\Jamey\Application Data\SecuROM
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
2009-10-27 09:53 . 2009-10-27 09:53 8192 —-a-w- c:\windows\system32\CSC.exe
2009-10-25 10:29 . 2007-08-19 13:10 60848 —-a-w- c:\documents and settings\Bex\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-24 15:15 . 2009-10-24 15:15 108144 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-10-24 13:31 . 2009-10-24 13:31 9158 —-a-r- c:\documents and settings\Jamey\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\msqxjd32.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
2009-04-28 10:04 428032 —-a-w- c:\program files\Agnitum\Outpost Firewall\feedback.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostMonitor]
2009-04-28 11:33 2374464 —-a-w- c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-03-14 02:43 83608 —-a-w- c:\program files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [18/12/2009 12:58 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [27/12/2009 10:58 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [27/12/2009 10:56 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [27/12/2009 11:06 108289]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [27/12/2009 10:56 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [27/12/2009 10:58 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S1 kbd;kbd;\??\c:\windows\system32\drivers\kbd.sys –> c:\windows\system32\drivers\kbd.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
Contents of the 'Scheduled Tasks' folder

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-02 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2009-12-27 c:\windows\Tasks\COMODO System Cleaner Update.job
- c:\program files\COMODO\COMODO System-Cleaner\UpdateApplications.exe [2009-10-27 18:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
.
- - - - ORPHANS REMOVED - - - -

BHO-{CFC14ADC-BB49-4010-91A7-C8F2CB004704} - (no file)
Notify-opnlllkj - opnlllkj.dll
MSConfigStartUp-Advanced DHTML Enable - c:\windows\System32\ychbim.exe
MSConfigStartUp-ATIPTA - c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
MSConfigStartUp-COMODO Internet Security - c:\program files\COMODO\COMODO Internet Security\cfp.exe
MSConfigStartUp-lsdefrag - c:\docume~1\Jamey\LOCALS~1\Temp\statb.tmp
MSConfigStartUp-Sony Ericsson PC Suite - c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-02 23:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1028)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\wdfmgr.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-02 23:16:04 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-02 23:15

Pre-Run: 39,570,501,632 bytes free
Post-Run: 39,657,783,296 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - E67A04F2F064DDF985F6E5180A5AFBC0

Avira did tell me the name of the trojan but stupidly I forgot to make a note of it, really sorry… However I think it might have been in response to the Google redirect I got after I tested the machine following the deletion of C:\WINDOWS\system32\msqxjd32.exe because it popped up pretty soon after I closed Firefox when I saw the little dialog boxes popping up with false "you are infected" messages.

Here are the four logs you asked for, I'm probably gonna go to bed now (might be online for another 30 mins or so) so it might be tomorrow before my next reply but I'd just like to say a big thank you for all the help so far, I really, really appreciate you taking the time to do this, thank you.:

Kenco Log:

Kenco by jpshortstuff (31.12.09.1)
Log created at 01:46 on 03/01/2010 (Jamey)

========== Task Unlocker ==========

========== KencoScan ==========

========== C:\WINDOWS\Tasks ==========
Ad-Aware Update (Daily 1).job -> [02:26 01/01/2010] 472 bytes
Ad-Aware Update (Daily 2).job -> [02:26 01/01/2010] 472 bytes
Ad-Aware Update (Daily 3).job -> [02:26 01/01/2010] 472 bytes
Ad-Aware Update (Daily 4).job -> [02:26 01/01/2010] 472 bytes
Ad-Aware Update (Weekly).job -> [02:26 01/01/2010] 472 bytes
COMODO System Cleaner Update.job -> [12:58 18/12/2009] 444 bytes

-=E.O.F=-


LockSearch Log:

LockSearch by jpshortstuff (05.11.09.1)
Log created at 01:46 on 03/01/2010 (Jamey)
Scanning C:\WINDOWS\

No locked files found.

-=E.O.F=-


DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 1:49:48.54 on 03/01/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2460 [GMT 0:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Outpost Firewall *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\msqxjd32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [OutpostMonitor] c:\progra~1\agnitum\outpos~1\op_mon.exe /tray /noservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-27 11608]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [2009-12-27 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\agnitum\outpos~1\acs.exe [2009-12-27 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-27 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-27 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2009-12-27 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2009-12-27 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S1 kbd;kbd;\??\c:\windows\system32\drivers\kbd.sys –> c:\windows\system32\drivers\kbd.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-02 22:53 a-dshr– C:\cmdcons
2010-01-02 22:52 261,632 a——- c:\windows\PEV.exe
2010-01-02 22:52 161,792 a——- c:\windows\SWREG.exe
2010-01-02 22:52 98,816 a——- c:\windows\sed.exe
2010-01-02 22:52 77,312 a——- c:\windows\MBR.exe
2010-01-02 19:43 –d—– C:\spoolerlogs
2010-01-02 19:18 –d—– c:\docume~1\jamey\applic~1\Malwarebytes
2010-01-02 19:18 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:18 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-01 03:24 –d—– c:\program files\Trend Micro
2010-01-01 03:22 8 a——- c:\windows\crpf.bin
2010-01-01 03:22 4 a——- c:\windows\crpf_sdum.bin
2010-01-01 02:49 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-01 02:25 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-01-01 02:24 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 –d—– c:\program files\Lavasoft
2009-12-31 16:34 –d—– c:\program files\Spybot - Search & Destroy
2009-12-27 15:03 0 a——- c:\windows\%IniPath%
2009-12-27 11:06 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-27 11:06 –d—– c:\program files\Avira
2009-12-27 11:06 –d—– c:\docume~1\alluse~1\applic~1\Avira
2009-12-27 10:58 704,384 a——- c:\windows\system32\drivers\SandBox.sys
2009-12-27 10:58 257,432 a——- c:\windows\system32\drivers\afwcore.sys
2009-12-27 10:56 49 a——- c:\windows\transp.gif
2009-12-27 10:56 31,128 a——- c:\windows\system32\drivers\afw.sys
2009-12-27 10:56 –d—– c:\program files\Agnitum
2009-12-27 10:56 –d—– c:\docume~1\alluse~1\applic~1\Agnitum
2009-12-18 13:10 829,811 a——- c:\windows\cscmondump.bin
2009-12-18 12:59 134,173 a——- c:\windows\cscmon.bin
2009-12-18 12:58 132,424 a——- c:\windows\system32\drivers\CFRMD.sys
2009-12-18 12:58 13,824 a——- c:\windows\system32\cnat.exe
2009-12-12 23:47 –d—– c:\docume~1\jamey\applic~1\eMusic
2009-12-12 23:47 –d—– c:\program files\eMusic Download Manager
2009-12-12 19:43 –d—– c:\program files\Synchronization Technologies Inc
2009-12-08 23:16 –d—– c:\docume~1\jamey\applic~1\SyncMyCal

==================== Find3M ====================

2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe
2009-10-27 09:53 8,192 a——- c:\windows\system32\CSC.exe
2009-10-24 15:15 108,144 a——- c:\windows\system32\CmdLineExt.dll

============= FINISH: 1:50:27.54 ===============



RootRepeal Log:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2010/01/03 01:51
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
——————-
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0x9D77A000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
——————-
Path: c:\documents and settings\jamey\local settings\temp\etilqs_b7dfgkr4cuaeuldrpl51
Status: Allocation size mismatch (API: 65536, Raw: 0)

SSDT
——————-
#: 019 Function Name: NtAssignProcessToJobObject
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046ca60

#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0451bf0

#: 031 Function Name: NtConnectPort
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046e920

#: 037 Function Name: NtCreateFile
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa044df60

#: 041 Function Name: NtCreateKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9c3e6

#: 047 Function Name: NtCreateProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa04652b0

#: 048 Function Name: NtCreateProcessEx
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0465bb0

#: 050 Function Name: NtCreateSection
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa044cd10

#: 052 Function Name: NtCreateSymbolicLinkObject
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0458e40

#: 053 Function Name: NtCreateThread
Status: Hooked by "" at address 0xba727e84

#: 057 Function Name: NtDebugActiveProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0471f30

#: 062 Function Name: NtDeleteFile
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0457b20

#: 063 Function Name: NtDeleteKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9d0f2

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9cb06

#: 097 Function Name: NtLoadDriver
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0462bb0

#: 098 Function Name: NtLoadKey
Status: Hooked by "" at address 0xba727ea2

#: 105 Function Name: NtMakeTemporaryObject
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa04586b0

#: 116 Function Name: NtOpenFile
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0450c10

#: 119 Function Name: NtOpenKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9c684

#: 122 Function Name: NtOpenProcess
Status: Hooked by "" at address 0xba727e70

#: 125 Function Name: NtOpenSection
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa044d580

#: 128 Function Name: NtOpenThread
Status: Hooked by "" at address 0xba727e75

#: 137 Function Name: NtProtectVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046dda0

#: 145 Function Name: NtQueryDirectoryFile
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa04528a0

#: 160 Function Name: NtQueryKey
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa045c750

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9c90a

#: 180 Function Name: NtQueueApcThread
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046bed0

#: 192 Function Name: NtRenameKey
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0460590

#: 193 Function Name: NtReplaceKey
Status: Hooked by "" at address 0xba727eac

#: 199 Function Name: NtRequestPort
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0470a50

#: 200 Function Name: NtRequestWaitReplyPort
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0470d70

#: 204 Function Name: NtRestoreKey
Status: Hooked by "" at address 0xba727ea7

#: 207 Function Name: NtSaveKey
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa045ec80

#: 208 Function Name: NtSaveKeyEx
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa045f4d0

#: 210 Function Name: NtSecureConnectPort
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046f480

#: 213 Function Name: NtSetContextThread
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046b440

#: 223 Function Name: NtSetInformationDebugObject
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0472520

#: 224 Function Name: NtSetInformationFile
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0453bf0

#: 240 Function Name: NtSetSystemInformation
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa04621c0

#: 247 Function Name: NtSetValueKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9ce82

#: 253 Function Name: NtSuspendProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046a190

#: 254 Function Name: NtSuspendThread
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046aac0

#: 255 Function Name: NtSystemDebugControl
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0471770

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "" at address 0xba727e7f

#: 258 Function Name: NtTerminateThread
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0469620

#: 262 Function Name: NtUnloadDriver
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0463530

#: 277 Function Name: NtWriteVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa046d2b0

Shadow SSDT
——————-
#: 307 Function Name: NtUserAttachThreadInput
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa04761a0

#: 383 Function Name: NtUserGetAsyncKeyState
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0475db0

#: 416 Function Name: NtUserGetKeyState
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa04756b0

#: 460 Function Name: NtUserMessageCall
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0473ed0

#: 475 Function Name: NtUserPostMessage
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa04733d0

#: 476 Function Name: NtUserPostThreadMessage
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0473760

#: 491 Function Name: NtUserRegisterRawInputDevices
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0476600

#: 502 Function Name: NtUserSendInput
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0475380

#: 549 Function Name: NtUserSetWindowsHookEx
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0474290

#: 552 Function Name: NtUserSetWinEventHook
Status: Hooked by "C:\WINDOWS\system32\drivers\SandBox.sys" at address 0xa0474a60

==EOF==