spyware.spyeyes

I'm helping a friend with his computer, he has Vista, and it was infected with the spyware.spyeyes and spyware.password malware. I removed his hard drive, and connected to my computer, running full malwarebytes scan,(licensed version), removed 35 infections of these. Put back into his computer, but still problems, finally just reformatted, reinstalled OS, programs, etc.. Computer ran well for a couple of hours, then still same infections, and computer now running glacially slow. Last scan said Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.SpyEyes) -> Data: c:\program files\microsoft\desktoplayer.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe) Good: (userinit.exe), and Files Infected: C:\Program Files\Microsoft\DesktopLayer.exe (Spyware.SpyEyes) C:\Windows\System32\spoolsvSrv.exe (Spyware.SpyEyes) I quarantined all for now, and am thinking of replacing the registry items with the same files from another computer, same version of Vista, but otherwise, at my wits end as to how to get rid of this. Please help. Thank you.

Hello there, lthsinc



I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

• Read the entire procedure
• It is important to perform ALL actions in sequence.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with me till you're given the all clear.
• Remember, absence of symptoms does not mean the infection is all gone.
• Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

**In any case where you happen to be busy or unable to give us a reply, we would be more than grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days.

Hello,

I would need to gather more information on the machine.

1. All tools MUST be run from the executable. (.exe)
With Admin Rights (Right click, choose "Run as Administrator")

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Minimal Output at the top
• Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
• Double click inside the Custom Scan box at the bottom
• A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
• Click the OK button and navigate to the file scan.txt which we just saved to your desktop
• Select scan.txt and click Open. Writing will now appear under the Custom Scan box
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

===================================================

Scan With RootKitUnHooker

• Please Download Rootkit Unhooker and save it to your desktop.
• Now double-click on RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan.
• Check (Tick) Drivers and Stealth
• Uncheck the rest. then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished and then click File > Save Report.
• Save the report somewhere where you can find it. Click Close.
• Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"
===================================================

Please download MBRCheck.exe to your desktop.

• Be sure to disable your security programs
• Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
• A window will open on your desktop
• if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
• If nothing unusual is found just press Enter
• A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
• Please post the contents of that file.

===================================================

On your next reply please post :
OTL log
RKU log
MBRCheck log

Good Day!

Keep trying to post logs, even from different computers, and it's not working. Any options?

Here's the RKUnhookerLE log: RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows Vista Version 6.0.6001 (Service Pack 1) Number of processors #2 ============================================== >Drivers ============================================== 0x8B002000 C:\Windows\system32\DRIVERS\igdkmd32.sys 7221248 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver) 0x81C15000 C:\Windows\system32\ntkrnlpa.exe 3907584 bytes (Microsoft Corporation, NT Kernel & System) 0x81C15000 PnpManager 3907584 bytes 0x81C15000 RAW 3907584 bytes 0x81C15000 WMIxWDM 3907584 bytes 0x946D0000 Win32k 2109440 bytes 0x946D0000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xB2000000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101028.041\NAVEX15.SYS 1368064 bytes (Symantec Corporation, AV Engine) 0x8B802000 C:\Windows\system32\DRIVERS\bcmwl6.sys 1216512 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver) 0x82A0A000 C:\Windows\System32\Drivers\Ntfs.sys 1110016 bytes (Microsoft Corporation, NT File System Driver) 0x822E2000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver) 0x8BE86000 C:\Windows\system32\DRIVERS\HSX_DPV.sys 1056768 bytes (Conexant Systems, Inc., HSF_DP driver) 0x82866000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver) 0x804C5000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module) 0xA866B000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver) 0x8C004000 C:\Windows\system32\DRIVERS\HSX_CNXT.sys 741376 bytes (Conexant Systems, Inc., HSF_CNXT driver) 0xA7809000 C:\Windows\system32\drivers\spsys.sys 716800 bytes (Microsoft Corporation, security processor) 0x8B6E5000 C:\Windows\System32\drivers\dxgkrnl.sys 651264 bytes (Microsoft Corporation, DirectX Graphics Kernel) 0x80609000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic) 0x8CE08000 C:\Windows\System32\Drivers\NIS\1008000.029\ccHPx86.sys 503808 bytes (Symantec Corporation, Common Client Hash Provider Driver) 0x82271000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xA790F000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack) 0x8040B000 C:\Windows\system32\mcupdate_GenuineIntel.dll 393216 bytes (Microsoft Corporation, Intel Microcode Update Library) 0x8C944000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver) 0x8C8E9000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20101028.001\IDSvix86.sys 372736 bytes (Symantec Corporation, IDS Core Driver) 0xA8767000 C:\Windows\System32\Drivers\NIS\1008000.029\SRTSP.SYS 339968 bytes (Symantec Corporation, Symantec AutoProtect) 0x82201000 C:\Windows\system32\drivers\NIS\1008000.029\SYMEFA.SYS 323584 bytes (Symantec Corporation, Symantec Extended File Attributes) 0xA8601000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver) 0x94920000 C:\Windows\System32\ATMFD.DLL 311296 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0x80745000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver) 0x8BFB1000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x80692000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT) 0x8CE83000 C:\Windows\System32\Drivers\NIS\1008000.029\BHDrvx86.sys 270336 bytes (Symantec Corporation, BASH Driver) 0x80484000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver) 0x8BA02000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver) 0x8B7A1000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x8BE49000 C:\Windows\system32\DRIVERS\HSXHWAZL.sys 249856 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver) 0x8C8A1000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0x8BE0F000 C:\Windows\system32\drivers\CHDRT32.sys 237568 bytes (Conexant Systems Inc., High Definition Audio Function Driver) 0x8282C000 C:\Windows\system32\drivers\NETIO.SYS 237568 bytes (Microsoft Corporation, Network I/O Subsystem) 0x8CFA9000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr) 0x82B19000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0x8C199000 C:\Windows\System32\Drivers\NIS\1008000.029\SYMTDI.SYS 212992 bytes (Symantec Corporation, Network Dispatch Driver) 0x8BB4E000 C:\Windows\system32\DRIVERS\usbhub.sys 212992 bytes (Microsoft Corporation, Default Hub Driver for USB) 0x81FCF000 ACPI_HAL 208896 bytes 0x81FCF000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0x805A5000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0x8C80B000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver) 0x8B92B000 C:\Windows\system32\DRIVERS\b57nd60x.sys 200704 bytes (Broadcom Corporation, Broadcom NetXtreme Gigabit Ethernet NDIS6.0 Driver.) 0x829A9000 C:\Windows\system32\DRIVERS\msiscsi.sys 188416 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver) 0x8B973000 C:\Windows\system32\DRIVERS\Apfiltr.sys 184320 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver) 0x8BBB4000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0x82801000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider) 0x8BB0D000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library) 0xA78C8000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver) 0x8C9D6000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver) 0x82B69000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache) 0x806E9000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0x82983000 C:\Windows\system32\DRIVERS\SCSIPORT.SYS 155648 bytes (Microsoft Corporation, SCSI Port Driver) 0x829D7000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0x8C1CD000 C:\Windows\system32\Drivers\SYMEVENT.SYS 151552 bytes (Symantec Corporation, Symantec Event Library) 0x8BA85000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x82BA1000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll) 0x8BB93000 C:\Windows\system32\drivers\IntcHdmi.sys 135168 bytes (Intel® Corporation, Intel® High Definition Audio HDMI) 0x8C0D2000 C:\Windows\System32\Drivers\usbvideo.sys 135168 bytes (Microsoft Corporation, USB Video Class Driver) 0x8C12B000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver) 0xA79C7000 C:\Windows\system32\drivers\mrxdav.sys 131072 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0x8CF8A000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0x807A7000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension) 0x8C9A2000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver) 0xA797C000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver) 0x82950000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API) 0x8CF00000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver) 0xA7999000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver) 0x8B9B8000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0x8CF30000 C:\Windows\System32\DLA\DLAIFS_M.SYS 98304 bytes (Roxio, Drive Letter Access Component) 0x8296B000 C:\Windows\system32\DRIVERS\jmcr.sys 98304 bytes (JMicron Technology Corporation, JMicron JMB38X Flash Media Controller Driver) 0xA79E7000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector) 0x8C9BF000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver) 0x8CF73000 C:\Windows\System32\DLA\DLAUDF_M.SYS 94208 bytes (Roxio, Drive Letter Access Component) 0x82250000 C:\Windows\System32\Drivers\DRVMCDB.SYS 94208 bytes (Sonic Solutions, Device Driver) 0x8BA63000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0x8C0B9000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xB2170000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver) 0x8CF5D000 C:\Windows\System32\DLA\DLAUDFAM.SYS 90112 bytes (Roxio, Drive Letter Access Component) 0x8C846000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler) 0x8C17E000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver) 0xA79B2000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver) 0x8BACB000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager) 0x8BF88000 C:\Windows\System32\Drivers\NIS\1008000.029\SYMFW.SYS 86016 bytes (Symantec Corporation, Firewall Filter Driver) 0xB214E000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101028.041\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine) 0x8BAB7000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0x8BF9D000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver) 0x8B960000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver) 0xA78FC000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6) 0x8C884000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0x8B7EE000 C:\Windows\system32\DRIVERS\HDAudBus.sys 73728 bytes (Microsoft Corporation, High Definition Audio Bus Driver) 0x82B90000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver) 0x8C873000 C:\Windows\System32\Drivers\funfrm.SYS 69632 bytes (-, -) 0x8BB82000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy) 0x8046B000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver) 0x807DD000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver) 0xA78B8000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver) 0x8078F000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager) 0x8BAED000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver) 0x8B9D0000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver) 0x8CEF1000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver) 0x82B5A000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0x8071A000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver) 0x8BAA8000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x8B7DF000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0x80736000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver) 0x94910000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver) 0x8C865000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver) 0x8C167000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver) 0x807CF000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0x8C1F2000 C:\Windows\System32\Drivers\NIS\1008000.029\SYMNDISV.SYS 57344 bytes (Symantec Corporation, NDIS Filter Driver) 0x8CEC5000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver) 0x8BA56000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver) 0x8BB41000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator) 0x8B784000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver) 0x80685000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR) 0xA8753000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver) 0x8C11F000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0x8CF24000 C:\Windows\System32\Drivers\DRVNDDM.SYS 45056 bytes (Roxio, Device Driver Manager) 0x8CED2000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes 0x8B9AB000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver) 0x8B9A0000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver) 0x8C15C000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver) 0x8BA7A000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0x8BA43000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper) 0x82BEF000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x8B796000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0x8072C000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver) 0x8CEDD000 C:\Windows\System32\Drivers\dump_msahci.sys 40960 bytes 0x8CEE7000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver) 0x80710000 C:\Windows\system32\DRIVERS\LPCFilter.sys 40960 bytes (COMPAL ELECTRONIC INC., LPCFilter) 0x807C5000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver) 0x8BB37000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver) 0xA78F2000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver) 0x8C8DD000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy) 0x82267000 C:\Windows\System32\Drivers\PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xA8749000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver) 0x8C897000 C:\Windows\system32\drivers\NIS\1008000.029\SRTSPX.SYS 40960 bytes (Symantec Corporation, Symantec AutoProtect) 0x82BC2000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver) 0x8C102000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver) 0xB2162000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0x8C175000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0x8C85C000 C:\Windows\system32\DRIVERS\SymIMv.sys 36864 bytes (Symantec Corporation, NDIS 6.0 Filter Driver for Windows Vista) 0x948F0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver) 0x82A00000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x8CF1B000 C:\Windows\system32\DRIVERS\tvtfilter.sys 36864 bytes (Lenovo, Rescue and Recovery filter driver) 0x806D8000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x8C83D000 C:\Windows\system32\drivers\ws2ifsl.sys 36864 bytes (Microsoft Corporation, Winsock2 IFS Layer) 0x8079F000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver) 0x8047C000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver) 0x80403000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0x806E1000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver) 0x8C14C000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8C154000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8BA4E000 C:\Windows\System32\Drivers\RootMdm.sys 32768 bytes (Microsoft Corporation, Legacy Non-Pnp Modem Device Driver) 0x82B52000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor) 0x8BB03000 C:\Windows\system32\DRIVERS\Tvti2c.sys 32768 bytes (Lenovo (United States) Inc., SMBUS Driver) 0xA875F000 C:\Windows\system32\DRIVERS\xaudio.sys 32768 bytes (Conexant Systems, Inc., Modem Audio Device Driver) 0x8C112000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver) 0x8CF4F000 C:\Windows\System32\DLA\DLABMFSM.SYS 28672 bytes (Roxio, Drive Letter Access Component) 0x8CF56000 C:\Windows\System32\DLA\DLABOIOM.SYS 28672 bytes (Roxio, Drive Letter Access Component) 0x8C10B000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver) 0x8BAE6000 C:\Windows\system32\DRIVERS\RimSerial.sys 28672 bytes (Research in Motion Ltd, RIM Virtual Serial Driver) 0x8C119000 C:\Windows\System32\Drivers\DLARTL_M.SYS 24576 bytes (Roxio, Shared Driver Component) 0x8BAFD000 C:\Windows\system32\DRIVERS\psadd.sys 24576 bytes (Lenovo (United States) Inc., SMBIOS Driver) 0x8BAE0000 C:\Windows\system32\DRIVERS\wanatw4.sys 24576 bytes (America Online, Inc., Wan Miniport (ATW)) 0x8CF48000 C:\Windows\System32\DLA\DLAOPIOM.SYS 20480 bytes (Roxio, Drive Letter Access Component) 0x8B791000 C:\Windows\System32\drivers\swmsflt.sys 20480 bytes (-, Sierra Wireless USB Mass Storage Filter Driver) 0x8C194000 C:\Windows\system32\drivers\tcpipBM.sys 20480 bytes (Bytemobile, Inc., Bytemobile Kernel Network Provider) 0x8B95C000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0xA8667000 C:\Windows\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface x86 Driver) 0x80729000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0x82BCB000 C:\Windows\system32\drivers\BMLoad.sys 8192 bytes (Bytemobile, Inc., Bytemobile Kernel Driver Loader) 0x8B9B6000 C:\Windows\System32\Drivers\DLACDBHM.SYS 8192 bytes (Roxio, Shared Driver Component) 0x8CF4D000 C:\Windows\System32\DLA\DLAPoolM.SYS 8192 bytes (Roxio, Drive Letter Access Component) 0x8C8E7000 C:\Windows\system32\DRIVERS\smiif32.sys 8192 bytes (Lenovo Group Limited, SMI Driver for Lenovo system) 0x8BB0B000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0x8C0D0000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0x8CF2F000 C:\Windows\System32\DLA\DLADResM.SYS 4096 bytes (Roxio, Drive Letter Access Component) ============================================== >Stealth ==============================================

Here's the MBR Check log: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows Vista Home Basic Edition Windows Information: Service Pack 1 (build 6001), 32-bit Base Board Manufacturer: LENOVO BIOS Manufacturer: LENOVO System Manufacturer: LENOVO System Product Name: 444623U Logical Drives Mask: 0x00050014 Kernel Drivers (total 119): 0x81C00000 \SystemRoot\system32\ntkrnlpa.exe 0x81FBA000 \SystemRoot\system32\hal.dll 0x80406000 \SystemRoot\system32\kdcom.dll 0x8040E000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x8046E000 \SystemRoot\system32\PSHED.dll 0x8047F000 \SystemRoot\system32\BOOTVID.dll 0x80487000 \SystemRoot\system32\CLFS.SYS 0x804C8000 \SystemRoot\system32\CI.dll 0x80600000 \SystemRoot\system32\drivers\Wdf01000.sys 0x8067C000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x80689000 \SystemRoot\system32\drivers\acpi.sys 0x806CF000 \SystemRoot\system32\drivers\WMILIB.SYS 0x806D8000 \SystemRoot\system32\drivers\msisadrv.sys 0x806E0000 \SystemRoot\system32\drivers\pci.sys 0x80707000 \SystemRoot\system32\DRIVERS\LPCFilter.sys 0x80711000 \SystemRoot\System32\drivers\partmgr.sys 0x80720000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x80723000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x8072D000 \SystemRoot\system32\drivers\volmgr.sys 0x8073C000 \SystemRoot\System32\drivers\volmgrx.sys 0x80786000 \SystemRoot\System32\drivers\mountmgr.sys 0x80796000 \SystemRoot\system32\drivers\atapi.sys 0x8079E000 \SystemRoot\system32\drivers\ataport.SYS 0x807BC000 \SystemRoot\system32\drivers\msahci.sys 0x807C6000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x805A8000 \SystemRoot\system32\drivers\fltmgr.sys 0x807D4000 \SystemRoot\system32\drivers\fileinfo.sys 0x8220F000 \SystemRoot\system32\drivers\NIS\1008000.029\SYMEFA.SYS 0x8225E000 \SystemRoot\System32\Drivers\DRVMCDB.SYS 0x82275000 \SystemRoot\System32\Drivers\PxHelp20.sys 0x8227F000 \SystemRoot\System32\Drivers\ksecdd.sys 0x822F0000 \SystemRoot\system32\drivers\ndis.sys 0x8280F000 \SystemRoot\system32\drivers\msrpc.sys 0x8283A000 \SystemRoot\system32\drivers\NETIO.SYS 0x82874000 \SystemRoot\System32\drivers\tcpip.sys 0x8295E000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x82A0A000 \SystemRoot\System32\Drivers\Ntfs.sys 0x82B19000 \SystemRoot\system32\drivers\volsnap.sys 0x82B5A000 \SystemRoot\System32\Drivers\mup.sys 0x82B69000 \SystemRoot\System32\drivers\ecache.sys 0x82B90000 \SystemRoot\system32\drivers\disk.sys 0x82BA1000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x82BC2000 \SystemRoot\system32\drivers\crcdisk.sys 0x82BCB000 \SystemRoot\system32\drivers\BMLoad.sys 0x82BEF000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x82A00000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x82B52000 \SystemRoot\System32\drivers\swmsflt.sys 0x82979000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x82984000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x829C2000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x829D1000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8B602000 \SystemRoot\system32\DRIVERS\bcmwl6.sys 0x8B72B000 \SystemRoot\system32\DRIVERS\b57nd60x.sys 0x8B75C000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x8B76F000 \SystemRoot\system32\DRIVERS\Apfiltr.sys 0x8B79C000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x8B7A7000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x8B7B2000 \SystemRoot\System32\Drivers\DLACDBHM.SYS 0x8B7B4000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x8B7CC000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x8BA02000 \SystemRoot\system32\DRIVERS\storport.sys 0x8BA43000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8BA4E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x8BA65000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8BA70000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8BA93000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8BAA2000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8BAB6000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x8BACB000 \SystemRoot\system32\DRIVERS\wanatw4.sys 0x8BAD1000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8BAE1000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8BAE3000 \SystemRoot\system32\DRIVERS\ks.sys 0x8BB0D000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8BB17000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8BB24000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x8BB58000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x8BB69000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x8BB72000 \SystemRoot\System32\Drivers\Null.SYS 0x8BB79000 \SystemRoot\System32\Drivers\Beep.SYS 0x8BB80000 \SystemRoot\System32\Drivers\DLARTL_M.SYS 0x8BB86000 \SystemRoot\System32\drivers\vga.sys 0x8BB92000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8BBB3000 \SystemRoot\System32\drivers\watchdog.sys 0x8BBC0000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8BBC8000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8BBD3000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8BBE1000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x8BBEA000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8B7FA000 \??\C:\Windows\system32\drivers\tcpipBM.sys 0x829E3000 \SystemRoot\system32\DRIVERS\smb.sys 0x8BC0B000 \SystemRoot\system32\drivers\afd.sys 0x8BC53000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8BC85000 \SystemRoot\system32\drivers\ws2ifsl.sys 0x8BC8E000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8BCA4000 \SystemRoot\system32\DRIVERS\SymIMv.sys 0x8BCAD000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8BCBB000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8BCF7000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8BD01000 \SystemRoot\System32\Drivers\dfsc.sys 0x8BD18000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x8BD2F000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x8BD31000 \SystemRoot\System32\Drivers\crashdmp.sys 0x8BD3E000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x8BD49000 \SystemRoot\System32\Drivers\dump_msahci.sys 0x92E60000 \SystemRoot\System32\win32k.sys 0x8BD53000 \SystemRoot\System32\drivers\Dxapi.sys 0x93070000 \SystemRoot\System32\drivers\dxg.sys 0x930A0000 \SystemRoot\System32\TSDDD.dll 0x93120000 \SystemRoot\System32\framebuf.dll 0x93130000 \SystemRoot\System32\ATMFD.DLL 0x8BD5D000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x8BD87000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x8BD91000 \SystemRoot\system32\DRIVERS\bowser.sys 0x8BDAA000 \SystemRoot\System32\drivers\mpsdrv.sys 0x8BDBF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x95000000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x95039000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x95051000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x775E0000 \Windows\System32\ntdll.dll Processes (total 23): 0 System Idle Process 4 System 324 C:\Windows\System32\smss.exe 384 csrss.exe 424 csrss.exe 432 C:\Windows\System32\wininit.exe 468 C:\Windows\System32\winlogon.exe 508 C:\Windows\System32\services.exe 520 C:\Windows\System32\lsass.exe 528 C:\Windows\System32\lsm.exe 664 C:\Windows\System32\svchost.exe 720 C:\Windows\System32\svchost.exe 872 C:\Windows\System32\svchost.exe 904 C:\Windows\System32\svchost.exe 944 C:\Windows\System32\svchost.exe 964 C:\Windows\System32\svchost.exe 980 C:\Windows\System32\svchost.exe 1168 C:\Windows\System32\svchost.exe 1264 C:\Windows\System32\svchost.exe 1680 C:\Windows\explorer.exe 1072 C:\Program Files\Safari\Safari.exe 1784 C:\Users\Clarence\Desktop\OTL.exe 1672 C:\Users\Clarence\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`5dc00000 (NTFS) \\.\Q: –> \\.\PhysicalDrive0 at offset 0x00000022`d2200000 (NTFS) \\.\S: –> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS) PhysicalDrive0 Model Number: HITACHIHTS543216L9SA00, Rev: FB2ZC4EC Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: DE49F2D91E2B210E0F9D0C37BD45EBEEF2ABD7CE Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!

Since the OTL log won't post, will try to run again. Your notes says it won't take long, I did follow your instructions exactly, but it does take quite a while, will try to upload again shortly.

I have the OTL log that was run while in safe mode, but that won't post, I think it's too large. (txt file is 26 MB) Have been running another OTL scan in regular mode, but it's been running for more than 2 hours and hasn't finished, so I don't think it will be any smaller. Any ideas on how I can upload the original scan log? Or can you help with the other logs already posted? I really needed to have this computer by tomorrow, so any help would be appreciated. Also, may be completely unrelated, but all of a sudden, the curser will jump around while in the middle of typing. Anyway, thanks so much, hope to hear from you as soon as possible.

Hi,

I'm sorry for the late reply, can you upload the OTL file to http://megaupload.com/?

Uploaded two files, in case it makes any difference, or helps…one was the OTL log that was run in safe mode, the other was run in normal mode. Thanks, hope to hear back soon.

Good. I shall be waiting for the link.

Sorry, what do you mean 'waiting for the link'? Was i supposed to do anything besides upload?

You should be provided with a link for me to download the OTL file.

I didn't see anything, wish I'd known to look for it…I'll do it again right now.