What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google redirecting me + other problems. [Solved]

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
ClementZ] [/b– I'm going to move your Topic over to our Virus, Spyware, and Malware Removal Forum.

Please be patient as you wait for your turn to be assisted.

Best Regards,
Doug

My problem began Thursday of last week.

A message appeared on my computer.

It was something about a program trying to make changes to my computer (if it should be allowed, or not)
I don't recall the exact name of what it was, just that it started with "c."
Now, I had meant to deny the changes, but I must've been distracted or something, and allowed the changes.

Soon after, I get several dozen messages appearing on my screen telling me about system 32, and system registry has failed. My computer then restarts.
It restarts, I log back in, and I see that all my programs, with the exception of MapleStory, and Internet Explorer are gone from my taskbar, as well as the start menu.
Thinking this was odd, I decided to do a system restore.
I commenced the system restore, and my screen turned black, with several dozen of these system 32/system registry failing or w/e messages appearing on the screen. My computer began to shut down, however it seems the system restore was going normally.

I logged back in again, and everything seems to be running normally, albeit a lot more slowly. Except for the fact that Mozilla FireFox no longer oppened.
I uninstalled and reinstalled Mozilla Firefox, and it currently works.

I've done a full scan with Microsoft Security Essentials in safe mode. It found 7 threats, all of which were eliminated.
I then did a full scan with MalwareBytes, again in safe mode. It found 21 threats, all of which were eliminated.

The day after, Windows Explorer crashed a few times (which has never happened before, and I've had this computer for 2-3 years), and Internet Explorer opened on its own twice (both times, with the Blank Page [about:blank:]).

Windows Explorer seemed to crash and restart itself without provocation. I'm listening to a song on Windows Media Player for example, letting the computer idle, and Windows Explorer will just crash and restart itself, during which point, I was not able to switch between applications.

Internet Explorer crashing and restarting itself is simply baffling me. I don't even use Internet Explorer, however it's (iexplorer.exe*32, as well as iexplorer.exe) always running in Task Manager. Even after I end those two processes, they restart themselves.
Occasionally, I'll get a message telling me that Internet Explorer is restarting itself, and then an IE tab will appear, and link me to a random site (such as Twitter, or CNN) despite the fact that I was never using IE to begin with.

*Windows Explorer and Internet Explorer have both stopped crashing only a few days ago. iexplorer.exe*32 and iexplorer.exe are still constantly open as processes.

Now, I am having problems in regards with Google.
Whenever I search something, and click on the first non-video link, I get redirected to a site like http://area9.ziphip.com , or YellowPages.
Also, when I search something in Google images (a Wallpaper for example), not all images load. Just the first 20 or so.

This problem occurs with all of my browsers (Chrome, FF, and IE), and only with Google.

Other problems I am having with the comp are:
I am unable to edit my HOSTS file
'sfc / scannow' doesn't work
I am unable to install any anti-virus/anti-malware/anti-spyware attachments on FF
The computer is taking longer than normal to shut down.
IE is still always open as a process (although it no longer opens itself)

Hewlett-Packard

Windows 7 Home Premium 64-Bit

Intel Core i3 530 @2.93 GHz
8192 MB RAM
NVIDIA GeFore GT 220 GPU
1TB HDD
model is p6334f

Below is a HijackThis log.
Any help would be appreciated. Thanks.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:09:30 PM, on 20/11/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\rps.exe
C:\Program Files (x86)\WhatPulse\WhatPulse.exe
C:\Program Files (x86)\Rokario\Bandwidth Monitor\bandmon.exe
C:\Windows\V0650Mon.exe
C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgentComHandler.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\AVG\Identity Protection\agent\Bin\AVGIDSMonitor.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Last.fm\LastFM.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Owner\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON/4
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON/4
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON/4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Norton Safe Web Lite BHO - {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\coIEPlg.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
O3 - Toolbar: Norton Safe Web Lite - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\coIEPlg.dll
O4 - HKLM\..\Run: [V0650Mon.exe] C:\Windows\V0650Mon.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [RogersServicepointAgent.exe] "C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [WhatPulse] C:\Program Files (x86)\WhatPulse\WhatPulse.exe
O4 - HKCU\..\Run: [EPSON NX510 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFIA.EXE /FU "C:\Users\Owner\AppData\Local\Temp\E_SB6F1.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [bandmon] C:\Program Files (x86)\Rokario\Bandwidth Monitor\bandmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Download Video - {3B54DEAB-C6D4-48a8-8C32-A70558643400} - C:\Program Files (x86)\FinalVideoDownloader\fvdRunner.html
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Safe Web Lite (NSL) - Symantec Corporation - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Rogers Online Protection (Radialpoint Security Services) - Rogers - C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\RpsSecurityAwareR.exe
O23 - Service: RadialpointIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe
O23 - Service: Rogers SHS Service (RogersSelfHelpService) - Rogers Cable Communications - C:\Program Files (x86)\Rogers\SelfHealing\RogersSelfHelpService.exe
O23 - Service: Rogers Update Manager (RogersUpdateManager) - Rogers Cable Communications - C:\Program Files (x86)\Rogers\Update Manager\RogersUpdateManager.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Rogers Online Protection Firewall (RP_FWS) - Rogers - C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\Fws.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Rogers Backup Manager Service (VaultClientSRV) - Radialpoint SafeCare Inc. - C:\Program Files (x86)\Rogers Backup Manager\VaultClientSRV.exe
O23 - Service: Rogers Backup Manager Upgrade Service (VaultClientUpgrade) - Radialpoint SafeCare Inc. - C:\Program Files (x86)\Rogers Backup Manager\VaultClientUpgrade.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 15505 bytes
Post #2
Hi ClementZ and welcome to WhatTheTech forums!
I'm Sunyata and I will be helping you with your computer problems.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts before I post them. This is to ensure that I am giving you the best possible advice. This may cause a delay, but I will do my very best to keep it as short as possible.

Please read the following guidelines which will help to make cleaning your machine easier:

  • Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
  • The fixes I will give you are specific to your problem and should only be used for this issue on this machine.
  • Please make sure to carefully read any instructions posted. If you're not sure, please stop and ask!
  • Please stay with this thread until I tell you your machine appears to be clean. Absence of symptoms does not necessarily mean that all malware is gone.
  • PLEASE DO NOT install/uninstall any programs unless asked to.
  • PLEASE DO NOT run any malware scans other than those requested.
  • Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
  • I will reply back shortly with instructions

Note to Vista and Windows 7 users:
  • These tools MUST be run from the executable. (.exe) every time you run them
  • These tools MUST be run With Admin Rights (Right click, choose "Run as Administrator")

First,

Please download DDS by sUBs to your desktop.
Your antivirus software might question the file. If it does, turn it off please :)

  • Double click DDS.scr to run it and wait for the scan to finish
  • When finished DDS.txt will open
  • A small while later, a prompt will open. Answer Yes
  • DDS will continue scanning
  • When done, Attach.txt will open
  • Post DDS.txt and attach Attach.txt


Next,

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.

    Vista and Windows 7 users right click the icon and choose "Run as administrator".

  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]


In your next reply please include:
  • DDS.txt
  • Attach.txt
  • aswMBR.log

Post #3 last edited
DDS.txt DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_21 Run by [removed] at 15:46:16 on 2011-11-21 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.8119.6001 [GMT -5:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} AV: Rogers Online Protection Anti-Virus *Enabled/Updated* {A61154FD-4365-E00F-9A33-13A09AD54B56} SP: Rogers Online Protection Anti-Spyware *Enabled/Updated* {1D70B519-655F-EF81-A083-28D2E15201EB} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Rogers Online Protection Firewall *Enabled* {9E2AD5D8-090A-E157-B16C-BA9564060C2D} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\servicing\TrustedInstaller.exe C:\Windows\system32\svchost.exe -k LocalService C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\Fws.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\RpsSecurityAwareR.exe C:\Program Files (x86)\Rogers\SelfHealing\RogersSelfHelpService.exe C:\Program Files (x86)\Rogers\Update Manager\RogersUpdateManager.exe C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Rogers Backup Manager\VaultClientSRV.exe C:\Program Files (x86)\Rogers Backup Manager\VaultClientUpgrade.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\svchost.exe -k bdx c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\nvvsvc.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\rps.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgentComHandler.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\taskeng.exe c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files (x86)\WhatPulse\WhatPulse.exe C:\Program Files (x86)\Rokario\Bandwidth Monitor\bandmon.exe C:\Windows\V0650Mon.exe C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Windows\system32\sppsvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\REGSVR32.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.ca/ uInternet Settings,ProxyOverride = *.local mWinlogon: Userinit=userinit.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: Norton Safe Web Lite BHO: {f0da78e9-6b60-42fb-bc26-ef2cfb8c8ff3} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\coIEPlg.dll TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll TB: Norton Safe Web Lite: {30ceeea2-3742-40e4-85dd-812bf1cbb83d} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\coIEPlg.dll uRun: [WhatPulse] C:\Program Files (x86)\WhatPulse\WhatPulse.exe uRun: [EPSON NX510 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFIA.EXE /FU "C:\Users\Owner\AppData\Local\Temp\E_SB6F1.tmp" /EF "HKCU" uRun: [bandmon] C:\Program Files (x86)\Rokario\Bandwidth Monitor\bandmon.exe uRun: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c mRun: [] mRun: [V0650Mon.exe] C:\Windows\V0650Mon.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [RogersServicepointAgent.exe] "C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe" /AUTORUN mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1) uPolicies-explorer: NoResolveTrack = 1 (0x1) uPolicies-explorer: NoSMBalloonTip = 1 (0x1) mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) mPolicies-system: SynchronousMachineGroupPolicy = 0 (0x0) mPolicies-system: SynchronousUserGroupPolicy = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 IE: Free YouTube to iPod Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm IE: Free YouTube to Mp3 Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 IE: {3B54DEAB-C6D4-48a8-8C32-A70558643400} - C:\Program Files (x86)\FinalVideoDownloader\fvdRunner.html IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab TCP: DhcpNameServer = [removed] TCP: Interfaces\{EF5ABC5E-3819-46FA-B907-6644B8D77739} : DhcpNameServer = [removed] TCP: Interfaces\{F14C9C70-7912-4006-82E7-648CDC421877} : DhcpNameServer = [removed] Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll BHO-X64: Search Helper - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File BHO-X64: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: Norton Safe Web Lite BHO: {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\coIEPlg.dll BHO-X64: Norton Safe Web Lite BHO - No File TB-X64: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll TB-X64: Norton Safe Web Lite: {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\coIEPlg.dll mRun-x64: [(Default)] mRun-x64: [V0650Mon.exe] C:\Windows\V0650Mon.exe mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [RogersServicepointAgent.exe] "C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe" /AUTORUN mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" IE-X64: {3B54DEAB-C6D4-48a8-8C32-A70558643400} - C:\Program Files (x86)\FinalVideoDownloader\fvdRunner.html . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\w30wc1oy.default\ FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\nprpspa.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll FF - plugin: C:\Users\Owner\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Windows\system32\Wat\npWatWeb.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys –> C:\Windows\system32\DRIVERS\MpFilter.sys [?] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-12-18 13336] R2 NSL;Norton Safe Web Lite;C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe [2011-7-5 130000] R2 Radialpoint Security Services;Rogers Online Protection;C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\RpsSecurityAwareR.exe [2010-6-7 166944] R2 RogersSelfHelpService;Rogers SHS Service;C:\Program Files (x86)\Rogers\SelfHealing\RogersSelfHelpService.exe [2010-6-3 139264] R2 RogersUpdateManager;Rogers Update Manager;C:\Program Files (x86)\Rogers\Update Manager\RogersUpdateManager.exe [2010-6-3 163840] R2 ServicepointService;ServicepointService;C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe [2011-8-4 689464] R2 VaultClientSRV;Rogers Backup Manager Service;C:\Program Files (x86)\Rogers Backup Manager\VaultClientSRV.exe [2010-6-7 1053936] R2 VaultClientUpgrade;Rogers Backup Manager Upgrade Service;C:\Program Files (x86)\Rogers Backup Manager\VaultClientUpgrade.exe [2010-6-7 120048] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys –> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?] R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys –> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys –> C:\Windows\system32\drivers\nvhda64v.sys [?] R3 RadialpointIDSDriver;RadialpointIDSDriver;C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys [2011-8-4 132616] R3 RadialpointIDSFilter;RadialpointIDSFilter;C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\AVG\Identity Protection\agent\drivers\AVGIDSfilter.sys [2011-8-4 35848] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 V0650Vid;Rocketfish HD Webcam Driver;C:\Windows\system32\DRIVERS\V0650Vid.sys –> C:\Windows\system32\DRIVERS\V0650Vid.sys [?] S2 RadialpointIDSAgent;RadialpointIDSAgent;C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\AVG\Identity Protection\agent\bin\AVGIDSAgent.exe [2011-8-4 5832712] S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys –> C:\Windows\system32\DRIVERS\fssfltr.sys [?] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840] S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys –> C:\Windows\system32\DRIVERS\MpNWMon.sys [?] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0;PCDSRVC{F36B3A4C-F95654BD-06000000}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\PC-Doctor for Windows\pcdsrvc_x64.pkms [2009-9-17 23536] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam64.sys –> C:\Windows\system32\DRIVERS\wdcsam64.sys [?] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2011-11-21 20:40:42 69000 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2B4D8FD4-35B1-46A2-ABC7-70A1BE08A9E3}\offreg.dll 2011-11-21 20:31:15 ——– d—–w- C:\ProgramData\NVIDIA Corporation 2011-11-20 21:04:39 8570192 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2B4D8FD4-35B1-46A2-ABC7-70A1BE08A9E3}\mpengine.dll 2011-11-20 18:25:22 ——– d—–w- C:\Users\Owner\AppData\Local\{6EEA1A87-8A0E-4501-9010-01F075D3CDBC} 2011-11-20 18:25:11 ——– d—–w- C:\Users\Owner\AppData\Local\{D307C17D-F546-4ADD-9AE8-9F772A229CDA} 2011-11-19 21:15:48 ——– d—–w- C:\Users\Owner\AppData\Local\{D0444E85-DE17-4894-97DD-CC42D48F515B} 2011-11-19 21:15:27 ——– d—–w- C:\Users\Owner\AppData\Local\{E4037117-CFBF-4DE3-8EA1-0A729746644F} 2011-11-18 20:29:27 ——– d—–w- C:\Users\Owner\AppData\Local\{AAD73463-076A-40CB-873B-90B477B5951E} 2011-11-18 20:29:14 ——– d—–w- C:\Users\Owner\AppData\Local\{5A373632-9D2D-409D-800A-16D622268B79} 2011-11-17 17:52:38 ——– d—–w- C:\Users\Owner\AppData\Local\{97DF8FD5-C2CE-4F7A-86E2-C75CD05DB75A} 2011-11-17 17:52:16 ——– d—–w- C:\Users\Owner\AppData\Local\{78B9A9DE-5F40-4BA9-926E-93703F16F572} 2011-11-16 20:44:07 ——– d—–w- C:\Users\Owner\AppData\Local\{4A09E1B6-79B3-409C-9CDF-7971EAA1B776} 2011-11-16 20:43:52 ——– d—–w- C:\Users\Owner\AppData\Local\{69D77095-2683-4034-AFB9-AA56E0D547D9} 2011-11-15 20:50:42 ——– d—–w- C:\Users\Owner\AppData\Local\{BDCA6907-DCF5-44BE-8631-1B7914AC9824} 2011-11-15 20:50:26 ——– d—–w- C:\Users\Owner\AppData\Local\{14A75A70-55EB-450D-97DB-9356BDEB46BE} 2011-11-14 20:23:35 ——– d—–w- C:\Users\Owner\AppData\Local\{E4164FD4-DE00-4425-A0D0-E56D236416FC} 2011-11-14 20:23:24 ——– d—–w- C:\Users\Owner\AppData\Local\{CC2AEDEB-B1E5-4DC7-A59A-5FBAF9796A48} 2011-11-13 19:22:59 ——– d—–w- C:\Users\Owner\AppData\Local\{968CD2CF-B4BA-4822-A335-8DFDAF4CAA55} 2011-11-13 19:22:37 ——– d—–w- C:\Users\Owner\AppData\Local\{B5C075D1-2ECB-46CD-BE5C-5D36B78E5136} 2011-11-12 21:54:32 ——– d—–w- C:\Users\Owner\AppData\Local\{A7B76261-612D-4473-9243-D85712D1A845} 2011-11-12 21:54:21 ——– d—–w- C:\Users\Owner\AppData\Local\{6EF37251-1427-4C99-90AA-F5AEDE8A6D72} 2011-11-11 21:43:16 8570192 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-11-11 21:18:51 ——– d—–w- C:\Users\Owner\AppData\Local\{FB92C0AA-318D-497A-AB06-27018C6FCE5E} 2011-11-11 21:18:29 ——– d—–w- C:\Users\Owner\AppData\Local\{6A456E28-7E83-4531-948D-EBDA88FD1C45} 2011-11-10 21:37:31 917840 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{47C1482E-6C78-425D-B573-F8242DA71913}\gapaengine.dll 2011-11-10 21:35:59 ——– d—–w- C:\Program Files (x86)\Microsoft Security Client 2011-11-10 21:35:55 ——– d—–w- C:\Program Files\Microsoft Security Client 2011-11-10 20:51:47 ——– d—–w- C:\Users\Owner\AppData\Local\{F449E489-C73A-4E6A-AE19-857A5C6A2A35} 2011-11-10 20:51:35 ——– d—–w- C:\Users\Owner\AppData\Local\{E76F13C4-C124-4B6B-A5CB-5F1A366136FE} 2011-11-10 02:01:02 708608 —-a-w- C:\Program Files (x86)\Common Files\System\wab32.dll 2011-11-10 02:01:01 886784 —-a-w- C:\Program Files\Common Files\System\wab32.dll 2011-11-10 02:00:50 1923952 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-11-10 02:00:31 3144704 —-a-w- C:\Windows\System32\win32k.sys 2011-11-10 01:57:22 ——– d—–w- C:\Users\Owner\AppData\Local\{A4DCB714-FA3E-4A6B-82F6-91E9BA277466} 2011-11-10 01:56:53 ——– d—–w- C:\Users\Owner\AppData\Local\{63CC545D-8260-4AA3-A0E3-A9EC93D0BBFB} 2011-11-10 01:44:46 8570192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D37D8922-81CE-4A23-908D-B49E12EDAA56}\mpengine.dll 2011-11-09 20:25:42 ——– d—–w- C:\Users\Owner\AppData\Local\{58019084-ABC4-4EE6-9655-8A13B4E8AB30} 2011-11-09 20:25:19 ——– d—–w- C:\Users\Owner\AppData\Local\{B6A166AD-DDC3-4AB4-B513-07661D368BDF} 2011-11-08 20:44:05 ——– d—–w- C:\Users\Owner\AppData\Local\{CCA101C4-ECC2-4A85-A254-41906779718C} 2011-11-08 20:43:49 ——– d—–w- C:\Users\Owner\AppData\Local\{195BF2D5-6D37-47A4-A505-70028D900538} 2011-11-07 20:29:49 ——– d—–w- C:\Users\Owner\AppData\Local\{CCF7DEE2-D596-4DC1-9D77-9BE47349DB96} 2011-11-07 20:29:39 ——– d—–w- C:\Users\Owner\AppData\Local\{1BF12443-E763-4244-9784-B8F630EFA60D} 2011-11-06 19:32:40 ——– d—–w- C:\Users\Owner\AppData\Local\{C6E5ABB4-82FF-4023-BAC6-64C8EE6BD0E4} 2011-11-06 19:32:18 ——– d—–w- C:\Users\Owner\AppData\Local\{3F69E7BD-8D4D-4536-B02C-7FFAF35B8FC7} 2011-11-05 20:01:22 ——– d—–w- C:\Users\Owner\AppData\Local\{11D6AE38-E03F-4BC3-AA05-6FAF86139E67} 2011-11-05 20:01:02 ——– d—–w- C:\Users\Owner\AppData\Local\{10ABBD41-82EF-4CFA-A181-FF6D45C8CA4F} 2011-11-05 03:15:27 ——– d—–w- C:\Users\Owner\AppData\Local\{CB2EBAB4-861C-460A-9698-414EEDE7886A} 2011-11-05 03:15:05 ——– d—–w- C:\Users\Owner\AppData\Local\{4495CA94-B293-453D-ACD4-F7F9E83BDC52} 2011-11-04 15:14:48 ——– d—–w- C:\Users\Owner\AppData\Local\{7BC02BA9-DEEA-4387-B3CC-3CDF502C8B30} 2011-11-04 15:14:34 ——– d—–w- C:\Users\Owner\AppData\Local\{FDF49A03-CE2C-47AB-BEF0-C4CBBA8A0F4F} 2011-11-03 19:52:22 ——– d—–w- C:\Users\Owner\AppData\Local\{3E62040F-6A25-4096-9ABC-5696865D3DB7} 2011-11-03 19:52:00 ——– d—–w- C:\Users\Owner\AppData\Local\{4B2EA468-F192-4BD7-AC8F-A9C6A32EA054} 2011-11-02 19:42:12 ——– d—–w- C:\Users\Owner\AppData\Local\{DA008DF9-86DB-4559-99E7-5A1A7CEB834C} 2011-11-02 19:42:01 ——– d—–w- C:\Users\Owner\AppData\Local\{0AE76BBF-D6D9-4A1D-9802-E8CE86C4FEB2} 2011-11-01 19:35:20 ——– d—–w- C:\Users\Owner\AppData\Local\{90A78DE0-E769-48BB-A397-83447BE0FB42} 2011-11-01 19:35:06 ——– d—–w- C:\Users\Owner\AppData\Local\{E4D73456-CD48-482F-B6D4-333F01ABB9BE} 2011-10-31 19:31:04 ——– d—–w- C:\Users\Owner\AppData\Local\{88966CE6-CBB1-4854-9919-5CA8A30286EE} 2011-10-31 19:30:42 ——– d—–w- C:\Users\Owner\AppData\Local\{EDF29D43-2027-4444-B9CD-FCB3671B12CF} 2011-10-30 15:03:01 ——– d—–w- C:\Users\Owner\AppData\Local\{F092F200-485F-4293-90BA-AC3899C42C62} 2011-10-30 15:02:38 ——– d—–w- C:\Users\Owner\AppData\Local\{A7601A95-0565-4FB5-8157-3CCEAA3E3A4C} 2011-10-29 20:48:29 ——– d—–w- C:\Users\Owner\AppData\Local\{CA1ADB63-7641-445A-BDD0-A6F5D59A09F0} 2011-10-29 20:48:15 ——– d—–w- C:\Users\Owner\AppData\Local\{69279ABD-323B-477A-A5FC-62BBB7E8D666} 2011-10-28 19:56:42 ——– d—–w- C:\Users\Owner\AppData\Local\{5984AD01-0C48-478F-9D77-5CE11C8450CD} 2011-10-28 19:56:20 ——– d—–w- C:\Users\Owner\AppData\Local\{B1A16EB5-ED47-43FB-9401-784AB53007EB} 2011-10-27 20:47:38 ——– d—–w- C:\Users\Owner\AppData\Local\{CD0951B3-CFA6-4A2D-9DAD-67818A58C6A0} 2011-10-27 20:47:16 ——– d—–w- C:\Users\Owner\AppData\Local\{60DF64FD-3B53-4C67-8EC5-333EED61C315} 2011-10-26 20:14:43 ——– d—–w- C:\Users\Owner\AppData\Local\{543D3DE7-6903-43DA-A72D-11C7C17BAB0F} 2011-10-26 20:14:21 ——– d—–w- C:\Users\Owner\AppData\Local\{52BC8F0B-3CFB-43D7-BAEE-9CF1C5EED639} 2011-10-25 19:20:38 ——– d—–w- C:\Users\Owner\AppData\Local\{ACD8C888-180F-4B5C-A2CF-1632D1A23C3C} 2011-10-25 19:20:13 ——– d—–w- C:\Users\Owner\AppData\Local\{392A0769-CAC1-46B3-807B-18608A17E9DC} 2011-10-24 19:39:46 ——– d—–w- C:\Users\Owner\AppData\Local\{3F0DCBF4-E83B-48AC-8651-E87F242B65BF} 2011-10-24 19:39:34 ——– d—–w- C:\Users\Owner\AppData\Local\{788B05A4-EBE8-4ABE-B2ED-8A3F321D7603} 2011-10-23 20:22:08 ——– d—–w- C:\Users\Owner\AppData\Local\{E3C4E148-6679-4615-813F-9C235817DB96} 2011-10-23 20:21:54 ——– d—–w- C:\Users\Owner\AppData\Local\{CB122E6E-208C-4EF2-B95D-019CC831E504} . ==================== Find3M ==================== . 2011-10-06 19:22:15 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-09-01 05:24:07 2309120 —-a-w- C:\Windows\System32\jscript9.dll 2011-09-01 05:17:57 1389056 —-a-w- C:\Windows\System32\wininet.dll 2011-09-01 05:12:04 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2011-09-01 02:35:59 1798144 —-a-w- C:\Windows\SysWow64\jscript9.dll 2011-09-01 02:28:15 1126912 —-a-w- C:\Windows\SysWow64\wininet.dll 2011-09-01 02:22:54 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-08-31 03:05:32 96104 —-a-w- C:\Windows\System32\dns-sd.exe 2011-08-31 03:05:32 85864 —-a-w- C:\Windows\System32\dnssd.dll 2011-08-31 03:05:32 61288 —-a-w- C:\Windows\System32\jdns_sd.dll 2011-08-31 03:05:32 212840 —-a-w- C:\Windows\System32\dnssdX.dll 2011-08-31 03:05:04 83816 —-a-w- C:\Windows\SysWow64\dns-sd.exe 2011-08-31 03:05:04 73064 —-a-w- C:\Windows\SysWow64\dnssd.dll 2011-08-31 03:05:04 50536 —-a-w- C:\Windows\SysWow64\jdns_sd.dll 2011-08-31 03:05:04 178536 —-a-w- C:\Windows\SysWow64\dnssdX.dll 2011-08-27 05:37:49 861696 —-a-w- C:\Windows\System32\oleaut32.dll 2011-08-27 05:37:48 331776 —-a-w- C:\Windows\System32\oleacc.dll 2011-08-27 04:26:27 571904 —-a-w- C:\Windows\SysWow64\oleaut32.dll 2011-08-27 04:26:27 233472 —-a-w- C:\Windows\SysWow64\oleacc.dll . ============= FINISH: 15:55:35.38 =============== aswMBR.txt aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-11-21 16:01:58 —————————– 16:01:58.193 OS Version: Windows x64 6.1.7601 Service Pack 1 16:01:58.194 Number of processors: 4 586 0x2502 16:01:58.195 ComputerName: OWNER-PC UserName: Owner 16:01:59.583 Initialize success 16:02:55.161 AVAST engine defs: 11112101 16:03:57.552 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 16:03:57.556 Disk 0 Vendor: WDC_WD10 01.0 Size: 953869MB BusType: 8 16:03:57.567 Disk 0 MBR read successfully 16:03:57.571 Disk 0 MBR scan 16:03:57.579 Disk 0 unknown MBR code 16:03:57.584 Service scanning 16:03:57.970 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32 16:03:58.549 Modules scanning 16:03:58.555 Disk 0 trace - called modules: 16:03:58.561 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xfffffa8007b84334]<< 16:03:58.566 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007b6d060] 16:03:58.573 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800787e050] 16:03:58.578 \Driver\iaStor[0xfffffa8007850880] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa8007b84334 16:03:59.820 AVAST engine scan C:\Windows 16:04:03.306 AVAST engine scan C:\Windows\system32 16:06:38.557 AVAST engine scan C:\Windows\system32\drivers 16:06:55.066 AVAST engine scan C:\Users\Owner 16:19:10.687 AVAST engine scan C:\ProgramData 16:21:32.503 Scan finished successfully 16:23:04.439 Disk 0 MBR has been saved successfully to "C:\Users\Owner\Documents\MBR.dat" 16:23:04.546 The log file has been saved successfully to "C:\Users\Owner\Documents\aswMBR.txt" Sorry it took long, I was at school.

Attachments:

Post #5
Hello ClementZ

please let me know if I should remove the spoiler tags

Yes. Please edit your posts and remove those tags. Thanks.


You have two anti-virus programs installed. It is important to run only one. They have the potential to conflict, rendering both useless. Please uninstall one of the following:
  • Microsoft Security Essentials
  • Rogers Online Protection Anti-Virus


You have uTorrent installed, using File Sharing is one of the best ways to infect your system, your downloading that file from an unknown source and not all but the greater percentage of it contains malware, its the latest way that malware writers infect your system, I strongly urge you to uninstall it and stay away from any form of File Sharing.



Next,

Please download GetPartitions from the link bellow. You must right click on the link and choose Save as…. Save it as GetPartitions.bat on your desktop

getpartitions.bat

Double click it to run it.
It will produce DiskReport.txt log please post results from that log here to me.


Next,

Please read through these instructions to familarize yourself with what to expect when this tool runs

Please download ComboFix from one of the following locations:

  • LINK 1
  • LINK 2
**IMPORTANT! Save ComboFix to your Desktop. Read the following thoroughly
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link :How to Disable your Security Programs
  • Double click on 'ComboFix.exe' & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message box:



[external image: Posted Image]


Click on 'Yes', to continue scanning for malware.

When finished, it will produce a log for you.
Please include the contents of C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please let me know.
5. ComboFix disconnects your machine from the internet. The connection is automatically restored before ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

In your next reply please post the log created by ComboFix. :)



Next,

Please read carefully and follow these steps.

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

🖼Click to load external image (Posted Image)

  • If an infected file is detected, the default action will be Cure, click on Continue.

🖼Click to load external image (Posted Image)

  • If a suspicious file is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)

  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.

🖼Click to load external image (Posted Image)

  • If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt".
  • Please copy and paste the contents of that file here.


In your next post, please include the following logs:
  • DiskReport.txt
  • Combofix
  • TDSSKiller
Post #6
I've tried what must be several times, and I've followed the first set of instructions (the one with GetPartitions.bat) Every time it runs, I get a message saying that it was unable to read/script the file, and Disk report ends up being blank, and the program deletes itself. Should I continue with the other instructions if that is the case?
Post #7
Hello ClementZ

Please try the following. Regardless of whether or not you can get a screen shot, continue with the instructions for Combofix and TDSSKiller previously given:

  • Click on the Start button and then choose Control Panel.
  • Click on the System and Security link.

    Note: If you're viewing the Large icons or Small icons view of Control Panel, you won't see this link so just click on the Administrative Tools icon and skip to Step 4.
  • In the System and Security window, click on the Administrative Tools heading located near the bottom of the window.
  • In the Administrative Tools window, double-click on the Computer Management icon.
  • When Computer Management opens, click on Disk Management on the left side of the window, located under Storage.

    After a brief loading period, Disk Management should now appear on the right side of the Computer Management window.

    Note: If you don't see Disk Management listed, you may need to click on the |> icon to the left of the Storage icon.
Take a screen Shot of the Disk Management Window and attach the screen shot to your reply.
Post #8
Okay, another problem. Running ComboFix, I get a black screen with green writing. ComboFix then ended, and I got no log or anything of the sort. Currently downloading TDSSKiller
Post #9
TDSSKiller 16:03:04.0121 5336 TDSS rootkit removing tool [removed] Nov 22 2011 12:05:55 16:03:04.0406 5336 ============================================================ 16:03:04.0406 5336 Current date / time: 2011/11/23 16:03:04.0406 16:03:04.0406 5336 SystemInfo: 16:03:04.0406 5336 16:03:04.0406 5336 OS Version: 6.1.7601 ServicePack: 1.0 16:03:04.0406 5336 Product type: Workstation 16:03:04.0406 5336 ComputerName: OWNER-PC 16:03:04.0407 5336 UserName: Owner 16:03:04.0407 5336 Windows directory: C:\Windows 16:03:04.0407 5336 System windows directory: C:\Windows 16:03:04.0407 5336 Running under WOW64 16:03:04.0407 5336 Processor architecture: Intel x64 16:03:04.0407 5336 Number of processors: 4 16:03:04.0407 5336 Page size: 0x1000 16:03:04.0407 5336 Boot type: Normal boot 16:03:04.0407 5336 ============================================================ 16:03:04.0721 5336 Initialize success 16:03:13.0719 5476 ============================================================ 16:03:13.0719 5476 Scan started 16:03:13.0719 5476 Mode: Manual; 16:03:13.0719 5476 ============================================================ 16:03:14.0237 5476 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 16:03:14.0240 5476 1394ohci - ok 16:03:14.0268 5476 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 16:03:14.0272 5476 ACPI - ok 16:03:14.0301 5476 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 16:03:14.0302 5476 AcpiPmi - ok 16:03:14.0389 5476 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 16:03:14.0397 5476 adp94xx - ok 16:03:14.0444 5476 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 16:03:14.0449 5476 adpahci - ok 16:03:14.0466 5476 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 16:03:14.0469 5476 adpu320 - ok 16:03:14.0519 5476 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys 16:03:14.0525 5476 AFD - ok 16:03:14.0558 5476 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 16:03:14.0560 5476 agp440 - ok 16:03:14.0575 5476 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 16:03:14.0577 5476 aliide - ok 16:03:14.0595 5476 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 16:03:14.0597 5476 amdide - ok 16:03:14.0616 5476 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 16:03:14.0618 5476 AmdK8 - ok 16:03:14.0632 5476 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 16:03:14.0634 5476 AmdPPM - ok 16:03:14.0674 5476 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 16:03:14.0676 5476 amdsata - ok 16:03:14.0715 5476 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 16:03:14.0719 5476 amdsbs - ok 16:03:14.0737 5476 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 16:03:14.0738 5476 amdxata - ok 16:03:14.0781 5476 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 16:03:14.0783 5476 AppID - ok 16:03:14.0829 5476 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 16:03:14.0832 5476 arc - ok 16:03:14.0860 5476 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 16:03:14.0863 5476 arcsas - ok 16:03:14.0902 5476 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 16:03:14.0903 5476 AsyncMac - ok 16:03:14.0952 5476 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 16:03:14.0954 5476 atapi - ok 16:03:15.0037 5476 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 16:03:15.0043 5476 b06bdrv - ok 16:03:15.0082 5476 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 16:03:15.0087 5476 b57nd60a - ok 16:03:15.0147 5476 bdfsfltr (151390d51a96867f5142ba708d044b6b) C:\Windows\system32\drivers\bdfsfltr.sys 16:03:15.0151 5476 bdfsfltr - ok 16:03:15.0172 5476 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 16:03:15.0173 5476 Beep - ok 16:03:15.0233 5476 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 16:03:15.0234 5476 blbdrive - ok 16:03:15.0312 5476 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 16:03:15.0314 5476 bowser - ok 16:03:15.0344 5476 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 16:03:15.0346 5476 BrFiltLo - ok 16:03:15.0368 5476 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 16:03:15.0369 5476 BrFiltUp - ok 16:03:15.0397 5476 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 16:03:15.0402 5476 Brserid - ok 16:03:15.0419 5476 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 16:03:15.0420 5476 BrSerWdm - ok 16:03:15.0434 5476 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 16:03:15.0436 5476 BrUsbMdm - ok 16:03:15.0458 5476 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 16:03:15.0459 5476 BrUsbSer - ok 16:03:15.0473 5476 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 16:03:15.0476 5476 BTHMODEM - ok 16:03:15.0536 5476 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 16:03:15.0539 5476 cdfs - ok 16:03:15.0585 5476 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 16:03:15.0588 5476 cdrom - ok 16:03:15.0617 5476 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 16:03:15.0618 5476 circlass - ok 16:03:15.0649 5476 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 16:03:15.0654 5476 CLFS - ok 16:03:15.0726 5476 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 16:03:15.0728 5476 CmBatt - ok 16:03:15.0763 5476 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 16:03:15.0765 5476 cmdide - ok 16:03:15.0805 5476 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys 16:03:15.0812 5476 CNG - ok 16:03:15.0836 5476 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 16:03:15.0838 5476 Compbatt - ok 16:03:15.0881 5476 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 16:03:15.0882 5476 CompositeBus - ok 16:03:15.0916 5476 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 16:03:15.0917 5476 crcdisk - ok 16:03:15.0981 5476 CtClsFlt (6f2b3db93cbe80d2f3a53c8e64926f2f) C:\Windows\system32\DRIVERS\CtClsFlt.sys 16:03:15.0984 5476 CtClsFlt - ok 16:03:16.0033 5476 DefragFS (afaaa345fceb1ac24e0d63d85a7775fd) C:\Windows\system32\drivers\DefragFS.sys 16:03:16.0035 5476 DefragFS - ok 16:03:16.0071 5476 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 16:03:16.0073 5476 DfsC - ok 16:03:16.0108 5476 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 16:03:16.0109 5476 discache - ok 16:03:16.0130 5476 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 16:03:16.0132 5476 Disk - ok 16:03:16.0196 5476 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 16:03:16.0198 5476 drmkaud - ok 16:03:16.0246 5476 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 16:03:16.0254 5476 DXGKrnl - ok 16:03:16.0329 5476 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 16:03:16.0387 5476 ebdrv - ok 16:03:16.0418 5476 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 16:03:16.0424 5476 elxstor - ok 16:03:16.0491 5476 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 16:03:16.0492 5476 ErrDev - ok 16:03:16.0534 5476 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 16:03:16.0537 5476 exfat - ok 16:03:16.0555 5476 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 16:03:16.0558 5476 fastfat - ok 16:03:16.0592 5476 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 16:03:16.0594 5476 fdc - ok 16:03:16.0615 5476 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 16:03:16.0617 5476 FileInfo - ok 16:03:16.0634 5476 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 16:03:16.0636 5476 Filetrace - ok 16:03:16.0655 5476 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 16:03:16.0657 5476 flpydisk - ok 16:03:16.0713 5476 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 16:03:16.0718 5476 FltMgr - ok 16:03:16.0759 5476 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 16:03:16.0760 5476 FsDepends - ok 16:03:16.0809 5476 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys 16:03:16.0811 5476 fssfltr - ok 16:03:16.0834 5476 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 16:03:16.0835 5476 Fs_Rec - ok 16:03:16.0891 5476 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 16:03:16.0895 5476 fvevol - ok 16:03:16.0928 5476 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 16:03:16.0930 5476 gagp30kx - ok 16:03:16.0990 5476 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 16:03:16.0991 5476 GEARAspiWDM - ok 16:03:17.0032 5476 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 16:03:17.0034 5476 hcw85cir - ok 16:03:17.0083 5476 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 16:03:17.0085 5476 HDAudBus - ok 16:03:17.0099 5476 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys 16:03:17.0100 5476 HECIx64 - ok 16:03:17.0117 5476 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 16:03:17.0119 5476 HidBatt - ok 16:03:17.0146 5476 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 16:03:17.0148 5476 HidBth - ok 16:03:17.0165 5476 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 16:03:17.0166 5476 HidIr - ok 16:03:17.0186 5476 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys 16:03:17.0187 5476 HidUsb - ok 16:03:17.0242 5476 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 16:03:17.0245 5476 HpSAMD - ok 16:03:17.0301 5476 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 16:03:17.0311 5476 HTTP - ok 16:03:17.0354 5476 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 16:03:17.0355 5476 hwpolicy - ok 16:03:17.0401 5476 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 16:03:17.0404 5476 i8042prt - ok 16:03:17.0439 5476 iaStor (631fa8935163b01fc0c02966cb3adb92) C:\Windows\system32\DRIVERS\iaStor.sys 16:03:17.0442 5476 iaStor - ok 16:03:17.0515 5476 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 16:03:17.0522 5476 iaStorV - ok 16:03:17.0558 5476 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 16:03:17.0560 5476 iirsp - ok 16:03:17.0638 5476 IntcAzAudAddService (3c4b4ee54febb09f7e9f58776de96dca) C:\Windows\system32\drivers\RTKVHD64.sys 16:03:17.0654 5476 IntcAzAudAddService - ok 16:03:17.0674 5476 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 16:03:17.0675 5476 intelide - ok 16:03:17.0704 5476 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 16:03:17.0705 5476 intelppm - ok 16:03:17.0762 5476 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 16:03:17.0764 5476 IpFilterDriver - ok 16:03:17.0806 5476 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 16:03:17.0809 5476 IPMIDRV - ok 16:03:17.0848 5476 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 16:03:17.0851 5476 IPNAT - ok 16:03:17.0897 5476 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 16:03:17.0899 5476 IRENUM - ok 16:03:17.0933 5476 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 16:03:17.0935 5476 isapnp - ok 16:03:17.0973 5476 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 16:03:17.0979 5476 iScsiPrt - ok 16:03:18.0031 5476 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 16:03:18.0032 5476 kbdclass - ok 16:03:18.0082 5476 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 16:03:18.0083 5476 kbdhid - ok 16:03:18.0127 5476 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys 16:03:18.0128 5476 KSecDD - ok 16:03:18.0163 5476 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys 16:03:18.0166 5476 KSecPkg - ok 16:03:18.0187 5476 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 16:03:18.0189 5476 ksthunk - ok 16:03:18.0282 5476 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 16:03:18.0284 5476 lltdio - ok 16:03:18.0329 5476 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 16:03:18.0331 5476 LSI_FC - ok 16:03:18.0351 5476 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 16:03:18.0354 5476 LSI_SAS - ok 16:03:18.0376 5476 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 16:03:18.0379 5476 LSI_SAS2 - ok 16:03:18.0402 5476 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 16:03:18.0404 5476 LSI_SCSI - ok 16:03:18.0421 5476 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 16:03:18.0423 5476 luafv - ok 16:03:18.0468 5476 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 16:03:18.0469 5476 megasas - ok 16:03:18.0498 5476 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 16:03:18.0502 5476 MegaSR - ok 16:03:18.0535 5476 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 16:03:18.0537 5476 Modem - ok 16:03:18.0565 5476 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 16:03:18.0566 5476 monitor - ok 16:03:18.0620 5476 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 16:03:18.0621 5476 mouclass - ok 16:03:18.0638 5476 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 16:03:18.0639 5476 mouhid - ok 16:03:18.0677 5476 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 16:03:18.0679 5476 mountmgr - ok 16:03:18.0750 5476 MpFilter (c177a7ebf5e8a0b596f618870516cab8) C:\Windows\system32\DRIVERS\MpFilter.sys 16:03:18.0753 5476 MpFilter - ok 16:03:18.0794 5476 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 16:03:18.0798 5476 mpio - ok 16:03:18.0829 5476 MpNWMon (8fbf6b31fe8af1833d93c5913d5b4d55) C:\Windows\system32\DRIVERS\MpNWMon.sys 16:03:18.0830 5476 MpNWMon - ok 16:03:18.0850 5476 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 16:03:18.0852 5476 mpsdrv - ok 16:03:18.0895 5476 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 16:03:18.0898 5476 MRxDAV - ok 16:03:18.0929 5476 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 16:03:18.0932 5476 mrxsmb - ok 16:03:18.0977 5476 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 16:03:18.0982 5476 mrxsmb10 - ok 16:03:19.0010 5476 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 16:03:19.0013 5476 mrxsmb20 - ok 16:03:19.0048 5476 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 16:03:19.0049 5476 msahci - ok 16:03:19.0086 5476 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 16:03:19.0089 5476 msdsm - ok 16:03:19.0116 5476 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 16:03:19.0118 5476 Msfs - ok 16:03:19.0141 5476 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 16:03:19.0143 5476 mshidkmdf - ok 16:03:19.0184 5476 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 16:03:19.0184 5476 msisadrv - ok 16:03:19.0227 5476 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 16:03:19.0229 5476 MSKSSRV - ok 16:03:19.0278 5476 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 16:03:19.0280 5476 MSPCLOCK - ok 16:03:19.0299 5476 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 16:03:19.0300 5476 MSPQM - ok 16:03:19.0346 5476 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 16:03:19.0351 5476 MsRPC - ok 16:03:19.0368 5476 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 16:03:19.0369 5476 mssmbios - ok 16:03:19.0378 5476 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 16:03:19.0379 5476 MSTEE - ok 16:03:19.0412 5476 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 16:03:19.0413 5476 MTConfig - ok 16:03:19.0440 5476 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 16:03:19.0442 5476 Mup - ok 16:03:19.0480 5476 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 16:03:19.0485 5476 NativeWifiP - ok 16:03:19.0560 5476 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 16:03:19.0573 5476 NDIS - ok 16:03:19.0591 5476 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 16:03:19.0593 5476 NdisCap - ok 16:03:19.0615 5476 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 16:03:19.0616 5476 NdisTapi - ok 16:03:19.0652 5476 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 16:03:19.0654 5476 Ndisuio - ok 16:03:19.0694 5476 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 16:03:19.0697 5476 NdisWan - ok 16:03:19.0745 5476 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 16:03:19.0747 5476 NDProxy - ok 16:03:19.0767 5476 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 16:03:19.0769 5476 NetBIOS - ok 16:03:19.0816 5476 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 16:03:19.0820 5476 NetBT - ok 16:03:19.0871 5476 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 16:03:19.0873 5476 nfrd960 - ok 16:03:19.0936 5476 NisDrv (5f7d72cbcdd025af1f38fdeee5646968) C:\Windows\system32\DRIVERS\NisDrvWFP.sys 16:03:19.0937 5476 NisDrv - ok 16:03:19.0969 5476 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 16:03:19.0970 5476 Npfs - ok 16:03:19.0989 5476 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 16:03:19.0990 5476 nsiproxy - ok 16:03:20.0102 5476 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 16:03:20.0134 5476 Ntfs - ok 16:03:20.0177 5476 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 16:03:20.0179 5476 Null - ok 16:03:20.0224 5476 NVHDA (17a7e888e330c7dfe59c97be44ddcf16) C:\Windows\system32\drivers\nvhda64v.sys 16:03:20.0225 5476 NVHDA - ok 16:03:20.0494 5476 nvlddmkm (f0fbfe1e29ff233b0e000054c1fb968a) C:\Windows\system32\DRIVERS\nvlddmkm.sys 16:03:20.0544 5476 nvlddmkm - ok 16:03:20.0601 5476 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 16:03:20.0604 5476 nvraid - ok 16:03:20.0643 5476 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 16:03:20.0647 5476 nvstor - ok 16:03:20.0663 5476 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 16:03:20.0666 5476 nv_agp - ok 16:03:20.0701 5476 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 16:03:20.0703 5476 ohci1394 - ok 16:03:20.0737 5476 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 16:03:20.0739 5476 Parport - ok 16:03:20.0775 5476 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 16:03:20.0777 5476 partmgr - ok 16:03:20.0812 5476 PcdrNdisuio - ok 16:03:20.0896 5476 PCDSRVC{F36B3A4C-F95654BD-06000000}_0 (51209fbdb13a46e05c1b0077a9310264) c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms 16:03:21.0061 5476 PCDSRVC{F36B3A4C-F95654BD-06000000}_0 - ok 16:03:21.0078 5476 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 16:03:21.0081 5476 pci - ok 16:03:21.0103 5476 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 16:03:21.0104 5476 pciide - ok 16:03:21.0128 5476 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 16:03:21.0132 5476 pcmcia - ok 16:03:21.0171 5476 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 16:03:21.0173 5476 pcw - ok 16:03:21.0220 5476 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 16:03:21.0230 5476 PEAUTH - ok 16:03:21.0307 5476 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 16:03:21.0309 5476 PptpMiniport - ok 16:03:21.0340 5476 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 16:03:21.0342 5476 Processor - ok 16:03:21.0393 5476 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 16:03:21.0395 5476 Psched - ok 16:03:21.0453 5476 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 16:03:21.0474 5476 ql2300 - ok 16:03:21.0511 5476 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 16:03:21.0514 5476 ql40xx - ok 16:03:21.0527 5476 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 16:03:21.0528 5476 QWAVEdrv - ok 16:03:21.0676 5476 RadialpointIDSDriver (084e03dce90fedbb5cea32743a4a4ff6) C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys 16:03:21.0678 5476 RadialpointIDSDriver - ok 16:03:21.0683 5476 RadialpointIDSEH - ok 16:03:21.0697 5476 RadialpointIDSFilter (6be281483d6476606795bd1a5e4ba7df) C:\Program Files (x86)\Rogers Online Protection\Rogers Online Protection\AVG\Identity Protection\agent\drivers\AVGIDSFilter.sys 16:03:21.0698 5476 RadialpointIDSFilter - ok 16:03:21.0717 5476 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 16:03:21.0718 5476 RasAcd - ok 16:03:21.0749 5476 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 16:03:21.0751 5476 RasAgileVpn - ok 16:03:21.0793 5476 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 16:03:21.0796 5476 Rasl2tp - ok 16:03:21.0820 5476 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 16:03:21.0823 5476 RasPppoe - ok 16:03:21.0847 5476 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 16:03:21.0850 5476 RasSstp - ok 16:03:21.0868 5476 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 16:03:21.0873 5476 rdbss - ok 16:03:21.0914 5476 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 16:03:21.0916 5476 rdpbus - ok 16:03:21.0939 5476 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 16:03:21.0940 5476 RDPCDD - ok 16:03:21.0959 5476 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 16:03:21.0959 5476 RDPENCDD - ok 16:03:21.0989 5476 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 16:03:21.0989 5476 RDPREFMP - ok 16:03:22.0034 5476 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys 16:03:22.0038 5476 RDPWD - ok 16:03:22.0080 5476 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 16:03:22.0084 5476 rdyboost - ok 16:03:22.0130 5476 RimUsb (7b04c9843921ab1f695fb395422c5360) C:\Windows\system32\Drivers\RimUsb_AMD64.sys 16:03:22.0132 5476 RimUsb - ok 16:03:22.0203 5476 RPPKT (fe15c4c61b51159e8c826b64ff89b1ea) C:\Windows\system32\DRIVERS\rp_pkt64.sys 16:03:22.0204 5476 RPPKT - ok 16:03:22.0240 5476 RPSKT (98f7aa362690324afa5c328c48cec932) C:\Windows\system32\DRIVERS\rp_skt64.sys 16:03:22.0242 5476 RPSKT - ok 16:03:22.0282 5476 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 16:03:22.0284 5476 rspndr - ok 16:03:22.0329 5476 RTL8167 (3b01789ee4eaee97f5eb46b711387d5e) C:\Windows\system32\DRIVERS\Rt64win7.sys 16:03:22.0333 5476 RTL8167 - ok 16:03:22.0368 5476 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 16:03:22.0370 5476 sbp2port - ok 16:03:22.0432 5476 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 16:03:22.0434 5476 scfilter - ok 16:03:22.0501 5476 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 16:03:22.0502 5476 secdrv - ok 16:03:22.0553 5476 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 16:03:22.0554 5476 Serenum - ok 16:03:22.0571 5476 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 16:03:22.0573 5476 Serial - ok 16:03:22.0590 5476 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 16:03:22.0591 5476 sermouse - ok 16:03:22.0669 5476 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 16:03:22.0671 5476 sffdisk - ok 16:03:22.0685 5476 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 16:03:22.0687 5476 sffp_mmc - ok 16:03:22.0704 5476 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 16:03:22.0706 5476 sffp_sd - ok 16:03:22.0735 5476 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 16:03:22.0736 5476 sfloppy - ok 16:03:22.0783 5476 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 16:03:22.0785 5476 SiSRaid2 - ok 16:03:22.0806 5476 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 16:03:22.0808 5476 SiSRaid4 - ok 16:03:22.0825 5476 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 16:03:22.0828 5476 Smb - ok 16:03:22.0877 5476 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 16:03:22.0878 5476 spldr - ok 16:03:22.0920 5476 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 16:03:22.0927 5476 srv - ok 16:03:22.0963 5476 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 16:03:22.0970 5476 srv2 - ok 16:03:22.0986 5476 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 16:03:22.0989 5476 srvnet - ok 16:03:23.0023 5476 StarOpen - ok 16:03:23.0039 5476 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 16:03:23.0040 5476 stexstor - ok 16:03:23.0096 5476 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 16:03:23.0097 5476 swenum - ok 16:03:23.0176 5476 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys 16:03:23.0220 5476 Tcpip - ok 16:03:23.0257 5476 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys 16:03:23.0267 5476 TCPIP6 - ok 16:03:23.0315 5476 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 16:03:23.0316 5476 tcpipreg - ok 16:03:23.0340 5476 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 16:03:23.0342 5476 TDPIPE - ok 16:03:23.0360 5476 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 16:03:23.0361 5476 TDTCP - ok 16:03:23.0409 5476 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 16:03:23.0411 5476 tdx - ok 16:03:23.0423 5476 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 16:03:23.0424 5476 TermDD - ok 16:03:23.0473 5476 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 16:03:23.0475 5476 tssecsrv - ok 16:03:23.0541 5476 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 16:03:23.0543 5476 TsUsbFlt - ok 16:03:23.0592 5476 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 16:03:23.0594 5476 tunnel - ok 16:03:23.0631 5476 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 16:03:23.0633 5476 uagp35 - ok 16:03:23.0676 5476 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 16:03:23.0681 5476 udfs - ok 16:03:23.0714 5476 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 16:03:23.0716 5476 uliagpkx - ok 16:03:23.0749 5476 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 16:03:23.0750 5476 umbus - ok 16:03:23.0793 5476 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 16:03:23.0794 5476 UmPass - ok 16:03:23.0839 5476 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys 16:03:23.0841 5476 USBAAPL64 - ok 16:03:23.0867 5476 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys 16:03:23.0870 5476 usbaudio - ok 16:03:23.0893 5476 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 16:03:23.0895 5476 usbccgp - ok 16:03:23.0937 5476 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 16:03:23.0940 5476 usbcir - ok 16:03:23.0965 5476 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys 16:03:23.0967 5476 usbehci - ok 16:03:23.0987 5476 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 16:03:23.0992 5476 usbhub - ok 16:03:24.0019 5476 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys 16:03:24.0021 5476 usbohci - ok 16:03:24.0060 5476 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 16:03:24.0062 5476 usbprint - ok 16:03:24.0098 5476 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 16:03:24.0100 5476 usbscan - ok 16:03:24.0116 5476 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\drivers\USBSTOR.SYS 16:03:24.0118 5476 USBSTOR - ok 16:03:24.0135 5476 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys 16:03:24.0137 5476 usbuhci - ok 16:03:24.0186 5476 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys 16:03:24.0190 5476 usbvideo - ok 16:03:24.0222 5476 V0650Vid (7492bf5fd32126ff43436feb2f2f3d41) C:\Windows\system32\DRIVERS\V0650Vid.sys 16:03:24.0227 5476 V0650Vid - ok 16:03:24.0294 5476 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 16:03:24.0295 5476 vdrvroot - ok 16:03:24.0337 5476 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 16:03:24.0339 5476 vga - ok 16:03:24.0354 5476 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 16:03:24.0356 5476 VgaSave - ok 16:03:24.0386 5476 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 16:03:24.0390 5476 vhdmp - ok 16:03:24.0409 5476 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 16:03:24.0411 5476 viaide - ok 16:03:24.0437 5476 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 16:03:24.0439 5476 volmgr - ok 16:03:24.0480 5476 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 16:03:24.0485 5476 volmgrx - ok 16:03:24.0531 5476 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 16:03:24.0536 5476 volsnap - ok 16:03:24.0573 5476 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 16:03:24.0576 5476 vsmraid - ok 16:03:24.0604 5476 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 16:03:24.0605 5476 vwifibus - ok 16:03:24.0633 5476 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 16:03:24.0634 5476 WacomPen - ok 16:03:24.0663 5476 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 16:03:24.0665 5476 WANARP - ok 16:03:24.0668 5476 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 16:03:24.0669 5476 Wanarpv6 - ok 16:03:24.0713 5476 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 16:03:24.0714 5476 Wd - ok 16:03:24.0751 5476 WDC_SAM (a3d04ebf5227886029b4532f20d026f7) C:\Windows\system32\DRIVERS\wdcsam64.sys 16:03:24.0753 5476 WDC_SAM - ok 16:03:24.0783 5476 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 16:03:24.0792 5476 Wdf01000 - ok 16:03:24.0833 5476 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 16:03:24.0834 5476 WfpLwf - ok 16:03:24.0859 5476 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 16:03:24.0862 5476 WIMMount - ok 16:03:24.0935 5476 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 16:03:24.0937 5476 WinUsb - ok 16:03:24.0955 5476 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 16:03:24.0956 5476 WmiAcpi - ok 16:03:24.0988 5476 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 16:03:24.0989 5476 ws2ifsl - ok 16:03:25.0033 5476 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 16:03:25.0036 5476 WudfPf - ok 16:03:25.0064 5476 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 16:03:25.0068 5476 WUDFRd - ok 16:03:25.0104 5476 MBR (0x1B8) (346bdadb08944f93221b6b07c083cd28) \Device\Harddisk0\DR0 16:03:25.0314 5476 \Device\Harddisk0\DR0 - ok 16:03:25.0317 5476 Boot (0x1200) (03939373cdb640c0dceb3e2d31015d73) \Device\Harddisk0\DR0\Partition0 16:03:25.0318 5476 \Device\Harddisk0\DR0\Partition0 - ok 16:03:25.0337 5476 Boot (0x1200) (14bc643ef5a64fe4b9df7ac953f7c2f9) \Device\Harddisk0\DR0\Partition1 16:03:25.0339 5476 \Device\Harddisk0\DR0\Partition1 - ok 16:03:25.0375 5476 Boot (0x1200) (737b51ef873be7218c6b49c32c46bb48) \Device\Harddisk0\DR0\Partition2 16:03:25.0376 5476 \Device\Harddisk0\DR0\Partition2 - ok 16:03:25.0376 5476 ============================================================ 16:03:25.0376 5476 Scan finished 16:03:25.0376 5476 ============================================================ 16:03:25.0385 3376 Detected object count: 0 16:03:25.0385 3376 Actual detected object count: 0
Post #10
When I followed the instructions in your third post, (the one about Disk Management), I got prompted as to if I should allow "mmc.exe" to make changes to the computer. Is that supposed to happen? And sorry if I'm just dumping replies on you like this. ._.
Post #11
Hello ClementZ

Happy Thanksgiving :)

Please go ahead and follow the instructions in post #7 to bring up the Disk Management window and allow mmc to make those changes, as that will enable the plugin.

Before you take a snapshot of the Disk Management screen, make sure to enlarge the window enough so that we may see the capcacity column of the active partition. This will give us the information we need. Below is an example:

[external image: Posted Image]
Post #13
Hello ClementZ

Your screen shot shows that you have the latest variant of the very nasty ZeroAccess rootkit.

Please read through these instructions a few times before you start with them. There are a lot of steps to follow:

Preferably from a clean computer, I need you to download: gparted-live-0.10.0-3.iso (115.1 MB)
Windows 7 64-Bit (x64) Recovery Environment

Create a bootable CD, 1 for Gparted and 1 for the Windows 7 Recovery Enviroment, from the ISO images. You can use ImgBurn do this.

Now boot off of the newly created Gparted CD.

[external image: Posted Image]
You should be here…
Press ENTER

[external image: Posted Image]
By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.

[external image: Posted Image]
Choose your language and press ENTER. English is default [33]

[external image: Posted Image]
Once again, at this prompt, press ENTER

You will now be taken to the main GUI screen below
[external image: Posted Image]
According to your logs, the partition that you want to delete is 2 MB.
In GParted, it may not show exactly 2 MB, but it will be the smallest partition on your machine.
Click the trash can icon to delete and then click Apply.

You should now be here confirming your actions:
[external image: Posted Image]

Now you should be here:
[external image: Posted Image]

[external image: Posted Image]
Is "boot" next to your OS drive?

If "boot" is not next to your OS drive under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:
[external image: Posted Image]

Now double-click the [external image: Posted Image] button.

You should receive a small pop up like this:
[external image: Posted Image]
Choose reboot and then press OK.

Now reboot from the Windows 7 Recovery Environment CD and execute the following commands:

  • bootrec /FixMbr
  • bootrec /FixBoot
  • exit

Remove the CD and boot back into Normal Windows.
If you cannot boot into Normal Windows, start from the recovery CD and select Sartup Repair.
Then, again, remove the CD and boot back into Normal Windows.

Once back in Normal Windows…

Download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Attach that file.
Post #14
Preferably from a clean computer. What sort of problems may arise if I burned the CDs from this computer? If the problems are significant, it may be a while for me to get the CD's seeing as I have no other computers, aside from this one

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI