Problems running Windows Explorer, My computer, control panel etc

Hello and

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
• Do not install/uninstall anything on your computer unless advised.
• Do not run any other scanning tools other than those instructed for you to use.
• Follow the instructions on the order they are given.
• Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
• If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
• If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
• And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

Let's dig a little deeper.

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:

• Under the reply panel is the Attachments Panel.
  
• Browse for the attachment file you want to upload, then click the green Upload button.
  
• Once it has uploaded, click the Manage Current Attachments drop down box.
  
• Click on to insert the attachment into your post

Please post both DDS logs in your next reply.

–Next–

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

[external image: Posted Image]
Click the image to enlarge it

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

• Double click GMER.exe.
  [external image: Posted Image]
• If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
• In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
    [external image: Posted Image]
    Click the image to enlarge it
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
• Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

To post in your next reply:
1. DDS logs.
2. GMER log.

Hi Julie,

It seems that your pc is infected with a polymorphic file infector. I strongly suggest you backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (softwares) and screensavers (*.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable.

Also, avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them.

Recent variants also modify htm, html, asp and php files.

Do not back up to another machine, as it may become compromised. Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups.

This infection may have come from your use of BitTorrent.

P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realize. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

This article from InfoWorld illustrates the dangers of a poorly configured P2P program.
http://www.infoworld.com/d/security-centra…-p-id-theft-103

When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.

I would recommend that you uninstall BitTorrent, via Control Panel -> Add or Remove Programs.

However, if you do not wish to remove this program please be advised not to use the said program during the course of cleaning your machine.

References for the risk of these programs can be found in these links:
http://www.esecurityguy.com/p2p_file_sharing
http://www.microsoft.com/protect/data/down…ilesharing.aspx

–Next–

Please go to Virus Total

• Click on Browse.
• On the File Upload window, copy/paste the text below into the File name box:
  c:\windows\explorer.exe
  
• Click Send file. Allow the file to be scanned. If it says already scanned – click Reanalyze Now

Repeat the procedure with the following files:
c:\windows\system32\userinit.exe
c:\windows\system32\ctfmon.exe
c:\windows\system32\svchost.exe
c:\program files\common files\SM1updtr.dll

Please post the results in your next reply.

–Next–

Please download MBRCheck.exe to your desktop.

• Be sure to disable your security programs
• Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
• A window similar to this should open on your desktop:
  
  🖼Click to load external image (Posted Image)
  
  
• If you are prompted with options, enter N at the prompt and press Enter
• Press Enter again
• A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your deskop. Please post the contents of that file.

–Next–

🖼Click to load external image (Posted Image) Please download Rootkit Unhooker and save it on your desktop.

• Disable your security programs
• Double click RKUnhookerLE.exe to run it
• Click the Report tab, then click Scan
• Check Drivers, Stealth Code, Files, and Code Hooks
• Uncheck the rest, then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished then go File > Save Report
• Save the report somewhere you can find it. Click Close
• Copy the entire contents of the report and paste it in your next reply.

Note - You may get this warning it is ok, just ignore it:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

To post in your next reply:
1. VirusTotal logs.
2. MBRCheck log.
3. RKUnhookerLE log.

Hi again - thanks for the quick reply and for the advice which I have taken on board - I have deleted BitTorrent - it was only used for my son to get something - obviously we got more than we bargained for! But when you explained the perils of using it, it makes you realise how foolish it is to do so - after all I wouldn't load an upknown software disk onto my machine .. but you live and learn. I have gone through the list of things to do and the results are listed below as requested. Thank you again for your help Julie Virus Total Logs File name: explorer.exe Submission date: 2010-09-08 17:16:14 (UTC) Current status: finished Result: 0/ 43 (0.0%) File name: userinit.exe Submission date: 2010-09-08 17:20:09 (UTC) Current status: finished Result: 0/ 42 (0.0%) File name: ctfmon.exe Submission date: 2010-09-08 17:22:25 (UTC) Current status: finished Result: 1/ 43 (2.3%) eSafe 7.0.17.0 2010.09.07 Win32.Banker File name: svchost.exe Submission date: 2010-09-08 17:24:52 (UTC) Current status: finished Result: 0/ 42 (0.0%) File name: SM1updtr.dll Submission date: 2010-09-08 17:27:06 (UTC) Current status: finished Result: 0/ 42 (0.0%) MBR Check log (in addition to scanning C drive, it has also picked up the J drive which is an external hard drive which is used for storing pictures): MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Home Edition Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x000003fc Kernel Drivers (total 172): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806E4000 \WINDOWS\system32\hal.dll 0xBA5A8000 \WINDOWS\system32\KDCOM.DLL 0xBA4B8000 \WINDOWS\system32\BOOTVID.dll 0xB9F79000 ACPI.sys 0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xB9F68000 pci.sys 0xBA0A8000 isapnp.sys 0xBA670000 pciide.sys 0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xBA5AC000 aliide.sys 0xBA5AE000 cmdide.sys 0xBA5B0000 toside.sys 0xBA5B2000 viaide.sys 0xBA5B4000 intelide.sys 0xBA0B8000 MountMgr.sys 0xB9F49000 ftdisk.sys 0xBA330000 PartMgr.sys 0xBA0C8000 VolSnap.sys 0xBA4BC000 cpqarray.sys 0xB9F31000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS 0xB9F19000 atapi.sys 0xBA4C0000 aha154x.sys 0xBA338000 sparrow.sys 0xBA4C4000 symc810.sys 0xBA0D8000 aic78xx.sys 0xBA4C8000 dac960nt.sys 0xBA0E8000 ql10wnt.sys 0xBA4CC000 amsint.sys 0xBA340000 asc.sys 0xBA4D0000 asc3550.sys 0xBA348000 mraid35x.sys 0xBA350000 i2omp.sys 0xBA4D4000 ini910u.sys 0xBA0F8000 ql1240.sys 0xBA108000 aic78u2.sys 0xBA358000 symc8xx.sys 0xBA360000 sym_hi.sys 0xBA368000 sym_u3.sys 0xBA370000 ABP480N5.SYS 0xBA378000 asc3350p.sys 0xBA5B6000 cd20xrnt.sys 0xBA118000 ultra.sys 0xB9F00000 adpu160m.sys 0xBA380000 dpti2o.sys 0xBA128000 ql1080.sys 0xBA138000 ql1280.sys 0xBA148000 ql12160.sys 0xBA388000 perc2.sys 0xBA5B8000 perc2hib.sys 0xBA390000 hpn.sys 0xBA4D8000 cbidf2k.sys 0xB9ED4000 dac2w2k.sys 0xBA158000 disk.sys 0xBA168000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xB9EB4000 fltmgr.sys 0xB9EA2000 sr.sys 0xB9E8B000 KSecDD.sys 0xB9E78000 WudfPf.sys 0xB9DEB000 Ntfs.sys 0xB9DBE000 NDIS.sys 0xBA178000 sisagp.sys 0xBA188000 viaagp.sys 0xBA198000 ohci1394.sys 0xBA1A8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xB9DA4000 Mup.sys 0xBA398000 BTHidMgr.sys 0xBA1B8000 alim1541.sys 0xBA1C8000 amdagp.sys 0xBA1D8000 agp440.sys 0xBA1E8000 agpCPQ.sys 0xBA218000 \SystemRoot\system32\DRIVERS\nic1394.sys 0xB947B000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xB92AC000 \SystemRoot\system32\DRIVERS\ati2mtag.sys 0xB9298000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xB9270000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xBA4A0000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xB924C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xBA4A8000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xB922C000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys 0xB946B000 \SystemRoot\system32\DRIVERS\fetnd5b.sys 0xBA4B0000 \SystemRoot\system32\DRIVERS\fdc.sys 0xB945B000 \SystemRoot\system32\DRIVERS\serial.sys 0xBA58C000 \SystemRoot\system32\DRIVERS\serenum.sys 0xB9218000 \SystemRoot\system32\DRIVERS\parport.sys 0xB944B000 \SystemRoot\system32\DRIVERS\imapi.sys 0xB943B000 \SystemRoot\System32\Drivers\Cdr4_xp.SYS 0xBA3A8000 \SystemRoot\System32\Drivers\MxlW2k.SYS 0xB942B000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xB941B000 \SystemRoot\system32\DRIVERS\redbook.sys 0xB91F5000 \SystemRoot\system32\DRIVERS\ks.sys 0xBA3D0000 \SystemRoot\System32\Drivers\Cdralw2k.SYS 0xBA3D8000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0xBA74C000 \SystemRoot\system32\DRIVERS\lmimirr.sys 0xBA74D000 \SystemRoot\system32\DRIVERS\audstub.sys 0xB940B000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xBA59C000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xB91DE000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xB93FB000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xB93EB000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xBA3E0000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xB91CD000 \SystemRoot\system32\DRIVERS\psched.sys 0xBA238000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xBA3E8000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xBA3F0000 \SystemRoot\system32\DRIVERS\raspti.sys 0xBA248000 \SystemRoot\system32\DRIVERS\termdd.sys 0xBA3F8000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xBA400000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xBA5D8000 \SystemRoot\system32\DRIVERS\swenum.sys 0xB911F000 \SystemRoot\system32\DRIVERS\update.sys 0xB9CE0000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xBA278000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xA8F67000 \SystemRoot\system32\drivers\cmudax.sys 0xA8F43000 \SystemRoot\system32\drivers\portcls.sys 0xBA288000 \SystemRoot\system32\drivers\drmk.sys 0xBA298000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xBA5DC000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xB9B56000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xBA5DE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xBA700000 \SystemRoot\System32\Drivers\Null.SYS 0xBA5E0000 \SystemRoot\System32\Drivers\Beep.SYS 0xBA410000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xBA418000 \SystemRoot\System32\drivers\vga.sys 0xBA5E2000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xBA5E4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xBA420000 \SystemRoot\System32\Drivers\Msfs.SYS 0xBA428000 \SystemRoot\System32\Drivers\Npfs.SYS 0xB9B4A000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xA8E48000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xA8DEF000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xA8DB5000 \SystemRoot\System32\Drivers\avgtdix.sys 0xA8D8F000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xBA430000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xBA2C8000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xBA2D8000 \SystemRoot\system32\DRIVERS\arp1394.sys 0xB9B3A000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xBA2E8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xA8D67000 \SystemRoot\system32\DRIVERS\netbt.sys 0xA8D45000 \SystemRoot\System32\drivers\afd.sys 0xBA2F8000 \SystemRoot\system32\DRIVERS\netbios.sys 0xA8D1A000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xA8CAA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xBA308000 \SystemRoot\System32\Drivers\Fips.SYS 0xBA438000 \SystemRoot\System32\Drivers\avgmfx86.sys 0xA8C76000 \SystemRoot\System32\Drivers\avgldx86.sys 0xBA440000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0xBA55C000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xBA564000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xB9D84000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xA8C36000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xBA5EE000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xA90C2000 \SystemRoot\System32\drivers\Dxapi.sys 0xBA450000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xBA7E0000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\ati2dvag.dll 0xBF04F000 \SystemRoot\System32\ati2cqag.dll 0xBF082000 \SystemRoot\System32\atikvmag.dll 0xBF0B6000 \SystemRoot\System32\ati3duag.dll 0xBF2F7000 \SystemRoot\System32\ativvaxx.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xA6B5E000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xA6631000 \SystemRoot\system32\drivers\wdmaud.sys 0xA672E000 \SystemRoot\system32\drivers\sysaudio.sys 0xA619E000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xA5EB5000 \SystemRoot\System32\Drivers\HTTP.sys 0xA5D1E000 \SystemRoot\system32\DRIVERS\srv.sys 0xBA61E000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys 0xA6463000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 0xA4CD2000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 62): 0 System Idle Process 4 System 752 C:\WINDOWS\system32\smss.exe 808 csrss.exe 832 C:\WINDOWS\system32\winlogon.exe 876 C:\WINDOWS\system32\services.exe 888 C:\WINDOWS\system32\lsass.exe 1056 C:\WINDOWS\system32\ati2evxx.exe 1072 C:\WINDOWS\system32\svchost.exe 1196 svchost.exe 1340 C:\WINDOWS\system32\svchost.exe 1376 C:\WINDOWS\system32\svchost.exe 1416 C:\Program Files\AVG\AVG9\avgchsvx.exe 1424 C:\Program Files\AVG\AVG9\avgrsx.exe 1624 C:\Program Files\AVG\AVG9\avgcsrvx.exe 1640 svchost.exe 1812 svchost.exe 148 C:\WINDOWS\system32\spoolsv.exe 156 C:\WINDOWS\system32\ati2evxx.exe 324 C:\WINDOWS\explorer.exe 396 C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe 416 scardsvr.exe 784 C:\WINDOWS\system32\rundll32.exe 788 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 960 C:\WINDOWS\AGRSMMSG.exe 1096 C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe 1232 C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe 1260 C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe 1284 C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe 1296 C:\Program Files\LogMeIn\x86\LogMeInSystray.exe 1320 C:\PROGRA~1\AVG\AVG9\avgtray.exe 1160 C:\Program Files\iTunes\iTunesHelper.exe 1560 C:\Program Files\Common Files\Real\Update_OB\realsched.exe 1612 C:\WINDOWS\system32\ctfmon.exe 1664 C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe 1672 C:\Program Files\Road Angel\RoadAngelClient.exe 180 C:\Program Files\LogMeIn\x86\LMIGuardian.exe 1572 svchost.exe 2092 C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe 2116 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 2136 C:\Program Files\AVG\AVG9\avgwdsvc.exe 2212 C:\Program Files\Bonjour\mDNSResponder.exe 2712 C:\WINDOWS\system32\svchost.exe 2708 C:\Program Files\AVG\AVG9\avgnsx.exe 2848 C:\Program Files\Common Files\LightScribe\LSSrvc.exe 3032 C:\Program Files\LogMeIn\x86\ramaint.exe 3112 C:\Program Files\LogMeIn\x86\LogMeIn.exe 3200 C:\Program Files\LogMeIn\x86\LMIGuardian.exe 3248 C:\WINDOWS\system32\svchost.exe 3368 C:\Program Files\AVG\AVG9\avgemc.exe 3644 C:\Program Files\AVG\AVG9\avgcsrvx.exe 3736 wmpnetwk.exe 500 C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe 632 wmiprvse.exe 3128 C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe 3844 C:\Program Files\iPod\bin\iPodService.exe 956 alg.exe 728 C:\WINDOWS\system32\wscntfy.exe 1716 C:\Program Files\Internet Explorer\iexplore.exe 2620 C:\Program Files\Internet Explorer\iexplore.exe 2800 C:\Program Files\Internet Explorer\iexplore.exe 2368 C:\Documents and Settings\Les\Local Settings\Temporary Internet Files\Content.IE5\58PZRO95\MBRCheck[1].exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`fcfa0800 (NTFS) \\.\J: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: Maxtor6B200M0, Rev: BANC1B70 PhysicalDrive1 Model Number: MaxtorBasics Desktop, Rev: 0122 Size Device Name MBR Status ——————————————– 189 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: 5695AAF95A32284894D71211499743BB702112B6 698 GB \\.\PhysicalDrive1 RE: Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done! RKUnhookerLE Log: RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #2 ============================================== >Drivers ============================================== 0xBF0B6000 C:\WINDOWS\System32\ati3duag.dll 2363392 bytes (ATI Technologies Inc. , ati3duag.dll) 0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2150400 bytes 0x804D7000 RAW 2150400 bytes 0x804D7000 WMIxWDM 2150400 bytes 0xBF800000 Win32k 1855488 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xB92AC000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 1306624 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver) 0xA8F67000 C:\WINDOWS\system32\drivers\cmudax.sys 1290240 bytes (C-Media Inc., C-Media Audio WDM Driver) 0xBF2F7000 C:\WINDOWS\System32\ativvaxx.dll 651264 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver) 0xB9DEB000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xA8CAA000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xB911F000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xA8DEF000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xA5D1E000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver) 0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xA5EB5000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 249856 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver) 0xA8DB5000 C:\WINDOWS\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher) 0xBF082000 C:\WINDOWS\System32\atikvmag.dll 212992 bytes (ATI Technologies Inc., Virtual Command And Memory Manager) 0xA8C76000 C:\WINDOWS\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver) 0xBF04F000 C:\WINDOWS\System32\ati2cqag.dll 208896 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module) 0xB9F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xA619E000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xB9DBE000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xB9ED4000 dac2w2k.sys 180224 bytes (Mylex Corporation, Mylex Disk Array Controller Driver) 0xA4CD2000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xA8D1A000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xB9270000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xA8D67000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xA8D8F000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xA8F43000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xB924C000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xB91F5000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xA8D45000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x806E4000 ACPI_HAL 134400 bytes 0x806E4000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xB9EB4000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xB922C000 C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys 131072 bytes (Realtek Semiconductor Corporation , Realtek 10/100/1000 NDIS 5.1 Driver ) 0xB9F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xB9DA4000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xB9F00000 adpu160m.sys 102400 bytes (Microsoft Corporation, Adaptec Ultra160 SCSI miniport) 0xB9F19000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xA8C36000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xB9F31000 C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver) 0xB9E8B000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xB91DE000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xA6631000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xB9218000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver) 0xB9298000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xA8E48000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xB9E78000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver) 0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xB9EA2000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xB9F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xB91CD000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xB9D84000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xB942B000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xBA218000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager) 0xBA198000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0xB945B000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xBA2D8000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client) 0xBA288000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xB941B000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xA672E000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xBA298000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xBA1A8000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0xBA108000 aic78u2.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra2 SCSI miniport) 0xBA0D8000 aic78xx.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra SCSI miniport) 0xBA168000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xB940B000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xBA0C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xBA148000 ql12160.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters) 0xBA138000 ql1280.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters) 0xB93EB000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xBA1D8000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter) 0xBA1E8000 agpCPQ.sys 45056 bytes (Microsoft Corporation, CompatNT AGP Filter) 0xBA1B8000 alim1541.sys 45056 bytes (Microsoft Corporation, ALi M1541 NT AGP Filter) 0xBA1C8000 amdagp.sys 45056 bytes (Advanced Micro Devices, Inc., AMD Win2000 AGP Filter) 0xB943B000 C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS 45056 bytes (Roxio, CDR4 CD and DVD Burning Helper Driver) 0xB946B000 C:\WINDOWS\system32\DRIVERS\fetnd5b.sys 45056 bytes (VIA Technologies, Inc. , NDIS 5.0 miniport driver) 0xBA308000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xB944B000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xBA0B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xB93FB000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xBA188000 viaagp.sys 45056 bytes (Microsoft Corporation, VIA NT AGP Filter) 0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xA6463000 C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 40960 bytes (LogMeIn, Inc., LogMeIn Rfs Drivemap Driver) 0xBA278000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xBA128000 ql1080.sys 40960 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters) 0xBA0F8000 ql1240.sys 40960 bytes (Microsoft Corporation, QLogic ISP PCI Adapters) 0xBA178000 sisagp.sys 40960 bytes (Silicon Integrated Systems Corporation, SiS NT AGP Filter) 0xBA248000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xBA158000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xBA2E8000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library) 0xB947B000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xBA238000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xBA2F8000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xA4B52000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xBA0E8000 ql10wnt.sys 36864 bytes (Microsoft Corporation, Miniport Driver for QLogic ISP PCI Adapters) 0xBA118000 ultra.sys 36864 bytes (Promise Technology, Inc., Promise Ultra66 Miniport Driver) 0xBA2C8000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xBA428000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xBA358000 symc8xx.sys 32768 bytes (LSI Logic, Symbios 8XX SCSI Miniport Driver) 0xBA368000 sym_u3.sys 32768 bytes (LSI Logic, Symbios Ultra3 SCSI Miniport Driver) 0xBA430000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xBA4A8000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xBA340000 asc.sys 28672 bytes (Advanced System Products, Inc., AdvanSys SCSI Controller Driver) 0xBA398000 BTHidMgr.sys 28672 bytes (IVT Corporation, Bluetooth HID Manager driver) 0xBA4B0000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver) 0xBA410000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xBA390000 hpn.sys 28672 bytes (Microsoft Corporation, NetRAID-4M Miniport Driver) 0xBA3A8000 C:\WINDOWS\System32\Drivers\MxlW2k.SYS 28672 bytes (MusicMatch, Inc., MusicMatch Access Layer KMD) 0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xBA388000 perc2.sys 28672 bytes (Microsoft Corporation, PERC 2 Miniport Driver) 0xBA360000 sym_hi.sys 28672 bytes (LSI Logic, Symbios Hi-Perf SCSI Miniport Driver) 0xBA440000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver) 0xBA370000 ABP480N5.SYS 24576 bytes (Microsoft Corporation, AdvanSys SCSI Controller Driver) 0xBA378000 asc3350p.sys 24576 bytes (Microsoft Corporation, AdvanSys SCSI Card Driver) 0xBA438000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver) 0xBA3D0000 C:\WINDOWS\System32\Drivers\Cdralw2k.SYS 24576 bytes (Roxio, CDRAL for Windows 2000 Kernel Driver) 0xBA3D8000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter) 0xBA3F8000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xBA400000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xBA4A0000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xBA418000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xBA380000 dpti2o.sys 20480 bytes (Microsoft Corporation, DPT SmartRAID miniport) 0xBA350000 i2omp.sys 20480 bytes (Microsoft Corporation, I2O Miniport Driver) 0xBA348000 mraid35x.sys 20480 bytes (American Megatrends Inc., MegaRAID RAID Controller Driver for Windows Whistler 32) 0xBA420000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xBA3E8000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xBA3F0000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xBA338000 sparrow.sys 20480 bytes (Adaptec, Inc., Adaptec AIC-6x60 series SCSI miniport) 0xBA3E0000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xBA450000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xBA4C0000 aha154x.sys 16384 bytes (Microsoft Corporation, Adaptec AHA-154x series SCSI miniport) 0xBA4D0000 asc3550.sys 16384 bytes (Advanced System Products, Inc., AdvanSys Ultra-Wide PCI SCSI Driver) 0xBA4D8000 cbidf2k.sys 16384 bytes (Microsoft Corporation, CardBus/PCMCIA IDE Miniport Driver) 0xBA4BC000 cpqarray.sys 16384 bytes (Microsoft Corporation, Compaq Drive Array Controllers SCSI Miniport Driver) 0xBA4C8000 dac960nt.sys 16384 bytes (Microsoft Corporation, Mylex Disk Array Controller Driver) 0xBA4D4000 ini910u.sys 16384 bytes (Microsoft Corporation, INITIO ini910u SCSI miniport) 0xBA564000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xB9CE0000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xA6B5E000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xBA58C000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xBA4C4000 symc810.sys 16384 bytes (Symbios Logic Inc., Symbios Logic Inc. SCSI Miniport Driver) 0xBA4CC000 amsint.sys 12288 bytes (Microsoft Corporation, AMD SCSI/NET Controller) 0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xA90C2000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xB9B3A000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0xB9B56000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter) 0xBA55C000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xBA59C000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xB9B4A000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xBA5AC000 aliide.sys 8192 bytes (Acer Laboratories Inc., ALi mini IDE Driver) 0xBA5E0000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xBA5B6000 cd20xrnt.sys 8192 bytes (Microsoft Corporation, IBM Portable CD-ROM Drive Miniport) 0xBA5AE000 cmdide.sys 8192 bytes (CMD Technology, Inc., CMD PCI IDE Bus Driver) 0xBA5EE000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xBA5DE000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xBA5B4000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xBA5E2000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xBA5B8000 perc2hib.sys 8192 bytes (Microsoft Corporation, PERC 2 Hibernate Driver) 0xBA61E000 C:\Program Files\LogMeIn\x86\RaInfo.sys 8192 bytes (LogMeIn, Inc., RemotelyAnywhere Kernel Information Provider) 0xBA5E4000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xBA5D8000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xBA5B0000 toside.sys 8192 bytes (Microsoft Corporation, Toshiba PCI IDE Controller) 0xBA5DC000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xBA5B2000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) 0xBA5AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xBA74D000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xBA7E0000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xBA74C000 C:\WINDOWS\system32\DRIVERS\lmimirr.sys 4096 bytes (LogMeIn, Inc., LogMeIn Mirror Miniport Driver) 0xBA700000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) ============================================== >Stealth ============================================== ============================================== >Files ============================================== !–>[Hidden] C:\Documents and Settings\All Users\Application Data\Real\setup\config.ini::$DATA ============================================== >Hooks ============================================== ntkrnlpa.exe+0x0006ECBE, Type: Inline - RelativeJump 0x80545CBE–>80545CC5 [ntkrnlpa.exe] [1716]iexplore.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [1716]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77DD1214–>00000000 [aclayers.dll] [1716]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77DD105C–>00000000 [aclayers.dll] [1716]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77DD11E0–>00000000 [aclayers.dll] [1716]iexplore.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [1716]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77F11084–>00000000 [aclayers.dll] [1716]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77F11078–>00000000 [aclayers.dll] [1716]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77F110B8–>00000000 [aclayers.dll] [1716]iexplore.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0040106C–>00000000 [shimeng.dll] [1716]iexplore.exe–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x00401098–>00000000 [aclayers.dll] [1716]iexplore.exe–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x004010E8–>00000000 [aclayers.dll] [1716]iexplore.exe–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x004010C0–>00000000 [aclayers.dll] [1716]iexplore.exe–>mswsock.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71A51178–>00000000 [shimeng.dll] [1716]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71A51184–>00000000 [aclayers.dll] [1716]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x71A511A0–>00000000 [aclayers.dll] [1716]iexplore.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [1716]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7C9C13E8–>00000000 [aclayers.dll] [1716]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExA, Type: IAT modification 0x7C9C163C–>00000000 [aclayers.dll] [1716]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7C9C161C–>00000000 [aclayers.dll] [1716]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7C9C15A0–>00000000 [aclayers.dll] [1716]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [1716]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7E4112F4–>00000000 [aclayers.dll] [1716]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7E411208–>00000000 [aclayers.dll] [1716]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7E411340–>00000000 [aclayers.dll] [1716]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7E450838–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082–>00000000 [ieframe.dll] [1716]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5–>00000000 [ieframe.dll] [1716]iexplore.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x3D9314B0–>00000000 [shimeng.dll] [1716]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x3D9314B4–>00000000 [aclayers.dll] [1716]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x3D931450–>00000000 [aclayers.dll] [1716]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x3D931350–>00000000 [aclayers.dll] [1716]iexplore.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll] [1716]iexplore.exe–>ws2_32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71AB10A8–>00000000 [aclayers.dll] [2620]iexplore.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [2620]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77DD1214–>00000000 [aclayers.dll] [2620]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77DD105C–>00000000 [aclayers.dll] [2620]iexplore.exe–>advapi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77DD11E0–>00000000 [aclayers.dll] [2620]iexplore.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [2620]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77F11084–>00000000 [aclayers.dll] [2620]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77F11078–>00000000 [aclayers.dll] [2620]iexplore.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77F110B8–>00000000 [aclayers.dll] [2620]iexplore.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0040106C–>00000000 [shimeng.dll] [2620]iexplore.exe–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x00401098–>00000000 [aclayers.dll] [2620]iexplore.exe–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x004010E8–>00000000 [aclayers.dll] [2620]iexplore.exe–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x004010C0–>00000000 [aclayers.dll] [2620]iexplore.exe–>mswsock.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71A51178–>00000000 [shimeng.dll] [2620]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71A51184–>00000000 [aclayers.dll] [2620]iexplore.exe–>mswsock.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x71A511A0–>00000000 [aclayers.dll] [2620]iexplore.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [2620]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7C9C13E8–>00000000 [aclayers.dll] [2620]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExA, Type: IAT modification 0x7C9C163C–>00000000 [aclayers.dll] [2620]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7C9C161C–>00000000 [aclayers.dll] [2620]iexplore.exe–>shell32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7C9C15A0–>00000000 [aclayers.dll] [2620]iexplore.exe–>user32.dll–>CallNextHookEx, Type: Inline - RelativeJump 0x7E42B3C6–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [2620]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x7E4112F4–>00000000 [aclayers.dll] [2620]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x7E411208–>00000000 [aclayers.dll] [2620]iexplore.exe–>user32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x7E411340–>00000000 [aclayers.dll] [2620]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7E450838–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F–>00000000 [ieframe.dll] [2620]iexplore.exe–>user32.dll–>UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3–>00000000 [ieframe.dll] [2620]iexplore.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x3D9314B0–>00000000 [shimeng.dll] [2620]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x3D9314B4–>00000000 [aclayers.dll] [2620]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x3D931450–>00000000 [aclayers.dll] [2620]iexplore.exe–>wininet.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x3D931350–>00000000 [aclayers.dll] [2620]iexplore.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll] [2620]iexplore.exe–>ws2_32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x71AB10A8–>00000000 [aclayers.dll] [324]explorer.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [324]explorer.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [324]explorer.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x01001268–>00000000 [shimeng.dll] [324]explorer.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [324]explorer.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [324]explorer.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x3D9314B0–>00000000 [shimeng.dll] [324]explorer.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll]

Hi Julie

Please do the following:

Please read through these instructions to familiarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–

• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.

ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.

Hi,

It was temporarily disabled due to security reasons. We will be re-enabling it but for now please tell me are there any error messages when you open Windows Explorer?

What happens when you do?

Please do the following:

• Please open your MalwareBytes AntiMalware Program
• Click the Update Tab and search for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Hi there Initially when trying to open Windows Explorer, it comes up with a Data Execution Prevention window and said to help protect the computer Windows was closing the program. It then comes up with the Windows Explorer has encountered a problem and needs to close error window If I change the settings for DEP to exclude Windows Explorer it just brings up the second error window (encountered a problem one). It brings up the same reports if I try to open control panel, my computer. I have ran the MBAM scan as per your instructions, it did it's checks but found no infected files! Report is as follows Many thanks Julie Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4586 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 10/09/2010 07:54:40 mbam-log-2010-09-10 (07-54-40).txt Scan type: Quick scan Objects scanned: 144852 Time elapsed: 7 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Hi Julie,

Are there any video files such as movies in your hard drive? How big are those files?

Try doing the following:

Download TFC to your desktop

• Close any open windows.
• Double click the TFC icon to run the program
• TFC will close all open programs itself in order to run,
• Click the Start button to begin the process.
• Allow TFC to run uninterrupted.
• The program should not take long to finish it's job
• Once its finished it should automatically reboot your machine,
• if it doesn't, manually reboot to ensure a complete clean

It's normal after running TFC cleaner that the PC will be slower to boot the first time.

–Next–

If you can't open Explorer, press on the windows button on your key board and "E" simultaneously to bring up Windows explorer.
Then move all your video files to another hard disk or to DVD. Don't open the folder containing it as it might crash your explorer.

Try explorer again.

Hiya I ran TFC - I then tried to open Wndows Explorer but it came up with the same message. Tried using the Windows key and E but still coming up with the same message. I know there are some jpgs on the C: drive and there could be 2 or 3 movie files but they were not downloaded from the internet, just movies taken on a bike ride from a head cam - if they are on C: drive could they be the problem? I did think they were on the removable hard drive, but not sure now. I'm at work now so unable to try anything else until I get home tonight. I can still get into Nero to burn a DVD so will try to find the movie files if they are on C: drive and put them onto DVD - I can dump files into the Recycle bin through Nero so will try to get rid of them that way if I can find them. I'll let you know how I get on later or if you can offer any other advice how to get round it, it would be much appreciated. Many thanks Julie

Just a quick update - I found some movie files off my mobile on the C: drive - which I have copied to DVD and now deleted off the computer - still can't open Windows explorer though either through the usual route or through Windows button and E. Thanks Julie

Hi again I need to be able to read from the card reader built into my computer today to download some pictures to send for work, and also get access to my external hard drive - please can you advise what I need to do to re-enable them, even if it is only in the short-term, as the computer does not seem to be picking them up? Thanks Julie

Hi Julie,

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
  
  [external image: Posted Image]
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

–Next–

To re-enable auto run please do the following:

Please download ERUNT from one of the following links:

• • Server 1
  • Server 2
  • Server 3
• ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
• Double click erunt-setup.
• Choose a language then press Enter or click OK to continue.
• Click Next on the Welcome window.
• Install it using the default settings and choose No when asked to add ERUNT to the start up folder.
• Make sure a check mark is placed beside Launch ERUNT and uncheck Show documentation.
• Click Finish.
• Once installed, open ERUNT.exe if it hasn't opened yet then create a registry back up.

How to create ERUNT back up:

• Open ERUNT.exe, if it hasn't opened yet.
• Click OK on the welcome screen.
• Choose the default settings for the back up.
• Make sure a check mark is placed beside System registry and Current user registry.
• Click OK.
• If the destination folder does not exist, ERUNT will prompt you and just click on Yes.
• A confirmation window will popup when complete.
• Click OK to close.

Note: To restore your registry, go to %WINDIR%\ERDNT (ex. C:\WINDOWS\ERDNT) and choose the folder which you want to restore and open ERDNT.exe

–Next–

Open a new Notepad session

• Click the Start button, click Run.
• In the run box type notepad.
• click OK.
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
• Copy and paste all of the text in the code box below into Notepad. Do not copy the word code.
  

  Windows Registry Editor Version 5.00
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "NoDriveTypeAutoRun"=dword:00000091

• Click File, Save as…, and set the Save in to your Desktop.
• In the File name box, type fix.reg
• In the Save as type: box, choose All Files
• Choose a location to save. Preferably on your desktop.
• Click Save.

Double click on fix.reg & allow it to run, it should only take less than a second.

Restart you computer for the changes to take effect.

To post in your next reply:
1. Kaspersky log.
2. Is auto run enabled?

Hi there log report as below - it didn't come up with anything. I have done all the other things but autorun is still not working. Thanks Julie ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, September 11, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Saturday, September 11, 2010 06:21:23 Records in database: 4207659 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ M:\ N:\ Scan statistics: Objects scanned: 109268 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 01:51:52 No threats found. Scanned area is clean. Selected area has been scanned.