Please help, my computer hasbeen taken over [Solved]

See if you can run these programs.


Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]






Download DDS from one of the links below to your desktop

Link 1
Link 2

• Double click the tool to run it.
• A black Screen will open, just read the contents and do nothing.
• When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
• Copy/Paste the contents of 'DDS.txt' into your post.
• 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)

Hi,

Nothing really jumping out at me. When you say the computer has been taking over, what exactly do you mean, are you getting any browser redirects or unwanted pop up windows ??

Download TFC to your desktop

• Close any open windows.
• Double click the TFC icon to run the program
• TFC will close all open programs itself in order to run,
• Click the Start button to begin the process.
• Allow TFC to run uninterrupted.
• The program should not take long to finish it's job
• Once its finished it should automatically reboot your machine,
• if it doesn't, manually reboot to ensure a complete clean

Please download Malwarebytes from Here or Here

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the report please

Hello, Windows will not boot up on its own. when i let the computer turn on, the desktop shows up for a second and then it freezes. if i wait long enough after this freeze, then a blue screen pops up with a bunch of code in it and something to the effect that win32k.sys is either corrupt or failed… When i try to open up norton, it freezes up, when i tried to system restore, it freezes up. right now, my computer will only start in safe mode… i cant print anything and the computer is super slow in safe mode. that is all i know. Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8292 Windows 5.1.2600 Service Pack 3 (Safe Mode) Internet Explorer 8.0.6001.18702 12/6/2011 1:18:33 PM mbam-log-2011-12-06 (13-18-33).txt Scan type: Quick scan Objects scanned: 195657 Time elapsed: 3 minute(s), 59 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

win32k.sys is a legit windows file as long as its in the system32 folder, otherwise it could be a virus.


Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
   win32k.sys

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

This is my memory from last week. the specific name of the file might be slightly off of this. While running SystemLook: It tried to tell me that systemlook.exe is a corrupt file too… and to use the chkdsk utility… Also said C:/$Mft is corrupt and unreadable… and to use the chkdsk utility… SystemLook 30.07.11 by jpshortstuff Log created at 13:39 on 06/12/2011 by Sam G. Huszczo Administrator - Elevation successful ========== filefind ========== Searching for "win32k.sys" C:\i386\win32k.sys –a—- 1843584 bytes [16:42 02/04/2008] [13:47 08/03/2007] 5B5AD4F40BE00F56F51F286BE72C0376 C:\WINDOWS\$hf_mig$\KB2160329\SP3QFE\win32k.sys –a—- 1861120 bytes [02:14 24/06/2010] [02:14 24/06/2010] C0B2DA12C5CB448F9EA3AF16416745CB C:\WINDOWS\$hf_mig$\KB2436673\SP3QFE\win32k.sys –a—- 1862272 bytes [13:27 26/10/2010] [13:27 26/10/2010] ED970A04FDAEAB9D9A5FA9B25E9196A8 C:\WINDOWS\$hf_mig$\KB2479628\SP3QFE\win32k.sys –a—- 1864064 bytes [13:14 31/12/2010] [13:14 31/12/2010] 62FC2280FBEA1DCC64A276BCF71709D9 C:\WINDOWS\$hf_mig$\KB2506223\SP3QFE\win32k.sys –a—- 1866880 bytes [13:27 03/03/2011] [13:27 03/03/2011] D302C0D9ADC931B598405D2C953B334B C:\WINDOWS\$hf_mig$\KB2555917\SP3QFE\win32k.sys –a—- 1867904 bytes [14:07 02/06/2011] [14:07 02/06/2011] BE79F0A0273DEF353BA5D1F43CBAD858 C:\WINDOWS\$hf_mig$\KB2567053\SP3QFE\win32k.sys –a—- 1867904 bytes [13:25 06/09/2011] [13:25 06/09/2011] C30AAF3B63F3BE3B515B50FB7292EA9F C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\win32k.sys –a—- 1836160 bytes [01:11 02/03/2005] [01:11 02/03/2005] F92DA2BB088A56B3A5FB8151E58F2964 C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\win32k.sys –a—- 1843968 bytes [21:35 26/03/2008] [13:49 08/03/2007] B9D8F5E6D1A7AC9977CC50ECE7C7FF74 C:\WINDOWS\$hf_mig$\KB941693\SP2QFE\win32k.sys –a—- 1845888 bytes [09:40 19/03/2008] [09:40 19/03/2008] 86E966164A647BE68EC6941B84BEF123 C:\WINDOWS\$hf_mig$\KB954211\SP3QFE\win32k.sys –a—- 1846912 bytes [13:23 16/10/2008] [12:25 15/09/2008] 692E8FC363300FA7951594A1A7A1F193 C:\WINDOWS\$hf_mig$\KB958690\SP3QFE\win32k.sys –a—- 1847552 bytes [11:08 09/02/2009] [11:08 09/02/2009] 1D20198F208006C3BB5ACB50D32CFC66 C:\WINDOWS\$hf_mig$\KB968537\SP3QFE\win32k.sys –a—- 1847808 bytes [10:50 17/04/2009] [10:50 17/04/2009] 7CEDA3396DECF312144BC788D699EE48 C:\WINDOWS\$hf_mig$\KB969947\SP3QFE\win32k.sys –a—- 1859712 bytes [12:19 14/08/2009] [12:19 14/08/2009] F6B54A56F02D24BF43E72662D44A6B14 C:\WINDOWS\$hf_mig$\KB979559\SP3QFE\win32k.sys –a—- 1860352 bytes [06:34 02/05/2010] [06:34 02/05/2010] A3D4A7B714D4A74B7CD4296302F1A9FA C:\WINDOWS\$hf_mig$\KB981957\SP3QFE\win32k.sys –a—- 1861888 bytes [13:38 31/08/2010] [13:38 31/08/2010] 51420D569A883CC13D656783B2C86D8E C:\WINDOWS\$NtServicePackUninstall$\win32k.sys —–c- 1845248 bytes [12:58 23/09/2008] [09:47 19/03/2008] E0F718290D19531FD10328EFB09808EC C:\WINDOWS\$NtUninstallKB2160329$\win32k.sys —–c- 1851264 bytes [07:02 13/08/2010] [05:22 02/05/2010] B9D41312F6D9FFA8D1D80488D9FDE849 C:\WINDOWS\$NtUninstallKB2436673$\win32k.sys —–c- 1852800 bytes [08:03 16/12/2010] [13:42 31/08/2010] A77B5764CD2106D36148CB5E5DDF6BC6 C:\WINDOWS\$NtUninstallKB2479628$\win32k.sys —–c- 1853312 bytes [08:37 09/02/2011] [13:25 26/10/2010] E40E572FD5DA970921A893B05FB217D9 C:\WINDOWS\$NtUninstallKB2506223$\win32k.sys —–c- 1854976 bytes [07:08 14/04/2011] [13:10 31/12/2010] 4F404415E13DDC541CB34294D266B65C C:\WINDOWS\$NtUninstallKB2555917$\win32k.sys —–c- 1857920 bytes [07:00 13/07/2011] [13:21 03/03/2011] 4F97E6BAAA847EA90EBBCD90A3FFA8E5 C:\WINDOWS\$NtUninstallKB2567053$\win32k.sys —–c- 1858944 bytes [07:03 14/10/2011] [14:02 02/06/2011] E97153BE7D053976348554EFD71C53A8 C:\WINDOWS\$NtUninstallKB941693$\win32k.sys —–c- 1843584 bytes [21:41 09/04/2008] [13:47 08/03/2007] 5B5AD4F40BE00F56F51F286BE72C0376 C:\WINDOWS\$NtUninstallKB954211$\win32k.sys —–c- 1845632 bytes [13:29 16/10/2008] [19:30 13/04/2008] DE01D79A607C7B9AE7FF88E934D0FFB2 C:\WINDOWS\$NtUninstallKB958690$\win32k.sys —–c- 1846400 bytes [21:08 11/03/2009] [12:12 15/09/2008] D21A189185D3A74512CC8E68F16E3FCF C:\WINDOWS\$NtUninstallKB968537$\win32k.sys —–c- 1846784 bytes [07:00 11/06/2009] [11:13 09/02/2009] 16B961A0552BC09B9E3A338FC816FFE5 C:\WINDOWS\$NtUninstallKB969947$\win32k.sys —–c- 1847168 bytes [08:00 11/11/2009] [12:26 17/04/2009] B707EA8E261F47B51CAC6FB7AF7770F6 C:\WINDOWS\$NtUninstallKB979559$\win32k.sys —–c- 1850624 bytes [07:11 11/06/2010] [13:21 14/08/2009] 716ED09D8D9A9E1E4A03549B32B68186 C:\WINDOWS\$NtUninstallKB981957$\win32k.sys —–c- 1851904 bytes [07:01 14/10/2010] [13:44 23/06/2010] 2F2D6B7515363E855EE44D88199ADD5F C:\WINDOWS\ServicePackFiles\i386\win32k.sys ——- 1845632 bytes [17:33 03/09/2008] [19:30 13/04/2008] DE01D79A607C7B9AE7FF88E934D0FFB2 C:\WINDOWS\system32\win32k.sys –a—- 1858944 bytes [18:51 10/08/2004] [13:20 06/09/2011] BFE37C3B420D2CA00D83554182130D32 C:\WINDOWS\system32\dllcache\win32k.sys ——- 1858944 bytes [13:23 16/10/2008] [13:20 06/09/2011] BFE37C3B420D2CA00D83554182130D32 -= EOF =-

Again nothing out of the ordinary

You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see. If the site says this file has been checked before, have them check it again

C:\WINDOWS\system32\win32k.sys

If the site is busy you can try this one
http://virusscan.jotti.org/en

VirusTotal: 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: win32k.sys Submission date: 2011-12-06 21:26:58 (UTC) Current status: queued (#1) queued analysing finished Result: 0/ 43 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.12.06.01 2011.12.06 - AntiVir 7.11.19.2 2011.12.06 - Antiy-AVL 2.0.3.7 2011.12.06 - Avast 6.0.1289.0 2011.12.06 - AVG 10.0.0.1190 2011.12.06 - BitDefender 7.2 2011.12.06 - ByteHero 1.0.0.1 2011.11.29 - CAT-QuickHeal 12.00 2011.12.06 - ClamAV 0.97.3.0 2011.12.06 - Commtouch 5.3.2.6 2011.12.06 - Comodo 10859 2011.12.06 - DrWeb 5.0.2.03300 2011.12.06 - Emsisoft 5.1.0.11 2011.12.06 - eSafe 7.0.17.0 2011.12.06 - eTrust-Vet 37.0.9607 2011.12.06 - F-Prot 4.6.5.141 2011.11.29 - F-Secure 9.0.16440.0 2011.12.06 - Fortinet 4.3.388.0 2011.12.06 - GData 22 2011.12.06 - Ikarus T3.1.1.109.0 2011.12.06 - Jiangmin 13.0.900 2011.12.06 - K7AntiVirus 9.119.5608 2011.12.06 - Kaspersky 9.0.0.837 2011.12.06 - McAfee 5.400.0.1158 2011.12.06 - McAfee-GW-Edition 2010.1D 2011.12.06 - Microsoft 1.7903 2011.12.06 - NOD32 6681 2011.12.04 - Norman 6.07.13 2011.12.06 - nProtect 2011-12-06.01 2011.12.06 - Panda 10.0.3.5 2011.12.06 - PCTools 8.0.0.5 2011.12.06 - Prevx 3.0 2011.12.06 - Rising 23.87.01.02 2011.12.06 - Sophos 4.71.0 2011.12.06 - SUPERAntiSpyware 4.40.0.1006 2011.12.06 - Symantec 20111.2.0.82 2011.12.06 - TheHacker 6.7.0.1.352 2011.12.01 - TrendMicro 9.500.0.1008 2011.12.06 - TrendMicro-HouseCall 9.500.0.1008 2011.12.06 - VBA32 3.12.16.4 2011.12.06 - VIPRE 11212 2011.12.06 - ViRobot 2011.12.6.4811 2011.12.06 - VirusBuster 14.1.102.0 2011.12.06 - Additional informationShow all MD5 : bfe37c3b420d2ca00d83554182130d32 SHA1 : 0fddb915127172d40885b2c32f44aa998efa8677 SHA256: e810a8ebdd9bae00c30f8f4d5901bc2f88bb1a3f4c994ff3eb69f14ded208af8 ssdeep: 49152:f896PF2yMow0GpfMY8w7atWObVXa3EnZYu:f896PzMEGdn8vkObJciYu File size : 1858944 bytes First seen: 2011-10-11 18:26:19 Last seen : 2011-12-06 21:26:58 TrID: Win64 Executable Generic (87.2%) Win32 Executable Generic (8.6%) Generic Win/DOS Executable (2.0%) DOS Executable Generic (2.0%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) sigcheck: publisher….: Microsoft Corporation copyright….: © Microsoft Corporation. All rights reserved. product……: Microsoft_ Windows_ Operating System description..: Multi-User Win32 Driver original name: win32k.sys internal name: win32k.sys file version.: 5.1.2600.6149 (xpsp_sp3_gdr.110906-1620) comments…..: n/a signers……: - signing date.: - verified…..: Unsigned PEInfo: PE structure information [[ basic data ]] entrypointaddress: 0x1B2F7F timedatestamp….: 0x4E661E29 (Tue Sep 06 13:20:41 2011) machinetype……: 0x14c (I386) [[ 8 section(s) ]] name, viradd, virsiz, rawdsiz, ntropy, md5 .text, 0x380, 0x18F6C7, 0x18F700, 6.69, 009affc7d980d0693cfa48de5f103f29 .rdata, 0x18FA80, 0xD0A4, 0xD100, 5.73, d40b3ddfe737792c63fec715c9836643 .data, 0x19CB80, 0x128AC, 0x12900, 3.94, 9812f83b4d51d9eaae55f26f52c06099 .kbdfall, 0x1AF480, 0x63C, 0x680, 4.65, b8840bdf2ea50d3b1d3532e7704c65cd .edata, 0x1AFB00, 0x1AE3, 0x1B00, 5.92, 5671976ac83584dd02fccbf50a12a540 INIT, 0x1B1600, 0x5796, 0x5800, 6.69, 9b4e3f1b0030a9ab80ce4ddf34a0c433 .rsrc, 0x1B6E00, 0x2218, 0x2280, 3.51, cb144bba3079cc1b5ef908fcdb431281 .reloc, 0x1B9080, 0xCCB0, 0xCD00, 6.76, 48a9aaa62129060e61190c216d455c9a [[ 4 import(s) ]] Dxapi.sys: _DxApiGetVersion@0 HAL.dll: ExAcquireFastMutex, ExReleaseFastMutex, KeQueryPerformanceCounter ntoskrnl.exe: PsSetProcessWin32Process, PsGetProcessWin32Process, ExAcquireFastMutexUnsafe, KeEnterCriticalRegion, PsGetCurrentProcessId, PsSetThreadWin32Thread, KeTickCount, ExReleaseFastMutexUnsafe, KeLeaveCriticalRegion, ObfDereferenceObject, ObfReferenceObject, RtlNtStatusToDosError, strchr, strncpy, KeAreApcsDisabled, ExAllocatePoolWithTagPriority, RtlRandom, MmIsVerifierEnabled, PsGetCurrentThread, KeBugCheckEx, PsGetCurrentProcess, ProbeForWrite, _except_handler3, ExRaiseAccessViolation, SeReleaseSecurityDescriptor, SeCaptureSecurityDescriptor, RtlInitUnicodeString, swprintf, _wcsicmp, ExRaiseDatatypeMisalignment, ObReferenceObjectByHandle, PsGetProcessSessionId, PsProcessType, ExAcquireResourceExclusiveLite, ExReleaseResourceLite, ExRaiseStatus, ObCloseHandle, InterlockedExchange, RtlAreAnyAccessesGranted, memmove, PsGetJobUIRestrictionsClass, PsGetJobLock, PsJobType, wcsncpy, RtlIntegerToUnicode, RtlIntegerToUnicodeString, PsGetThreadId, PsGetThreadProcessId, PsDereferenceImpersonationToken, PsDereferencePrimaryToken, SeTokenType, SeCreateClientSecurity, wcslen, ObOpenObjectByPointer, ExDesktopObjectType, RtlCopyUnicodeString, KeInitializeEvent, ExFreePoolWithTag, ExInitializeResourceLite, ExAllocatePoolWithTag, ZwCreateDirectoryObject, RtlUnicodeStringToInteger, wcschr, wcsstr, MmMapViewOfSection, MmCreateSection, MmMapViewInSessionSpace, MmUnmapViewInSessionSpace, RtlAllocateHeap, ZwSetSystemInformation, NlsMbCodePageTag, NlsAnsiCodePage, PsGetThreadProcess, PsIsSystemThread, PsGetProcessJob, wcscpy, RtlGetNtGlobalFlags, RtlCheckRegistryKey, ExWindowStationObjectType, PsGetCurrentProcessSessionId, PsGetProcessWin32WindowStation, RtlCompareUnicodeString, ZwQueryDefaultLocale, PsGetProcessPeb, InterlockedPopEntrySList, InterlockedPushEntrySList, PsGetProcessCreateTimeQuadPart, KeQuerySystemTime, KeClearEvent, RtlFreeHeap, PsLookupProcessByProcessId, PsGetThreadSessionId, PsLookupThreadByThreadId, ExDeletePagedLookasideList, ExIsResourceAcquiredExclusiveLite, ExInitializePagedLookasideList, KeWaitForMultipleObjects, KeWaitForSingleObject, _allmul, KeSetEvent, PsIsThreadTerminating, ZwClose, ExEventObjectType, ZwCreateEvent, ObReferenceObjectByPointer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, PsGetProcessImageFileName, PsThreadType, SeQueryAuthenticationIdToken, PsReferencePrimaryToken, PsGetProcessInheritedFromUniqueProcessId, PsSetProcessWindowStation, RtlInitializeBitMap, PsGetProcessId, PsGetProcessExitStatus, PsGetProcessExitProcessCalled, ZwQueryInformationProcess, KeSetKernelStackSwapEnable, SeTokenIsWriteRestricted, PsGetProcessSectionBaseAddress, ZwTerminateProcess, ExRaiseHardError, RtlWalkFrameChain, ExAllocatePoolWithQuotaTag, DbgBreakPoint, DbgPrint, KdDebuggerEnabled, ZwQueryValueKey, ZwOpenKey, RtlDestroyHeap, _wcsnicmp, wcscat, KeDelayExecutionThread, InterlockedDecrement, NtQueryInformationProcess, RtlDestroyAtomTable, ExDeleteResourceLite, KeCancelTimer, KeRemoveSystemServiceTable, KeQueryInterruptTime, MmPageEntireDriver, MmUserProbeAddress, PsEstablishWin32Callouts, KeAddSystemServiceTable, ZwQueryDefaultUILanguage, ZwSetDefaultUILanguage, ZwSetDefaultLocale, ExIsResourceAcquiredSharedLite, ExAcquireResourceSharedLite, RtlQueryRegistryValues, ZwPowerInformation, KeResetEvent, ZwDeviceIoControlFile, IoGetRelatedDeviceObject, KeInitializeTimerEx, PsGetCurrentThreadId, InitSafeBootMode, RtlAreAllAccessesGranted, SeDeleteAccessState, ObCheckObjectAccess, SeCreateAccessState, SeReleaseSubjectContext, SeUnlockSubjectContext, SePrivilegeObjectAuditAlarm, SePrivilegeCheck, SeLockSubjectContext, SeCaptureSubjectContext, RtlCopySid, RtlLengthSid, RtlSetGroupSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlSetSaclSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlAddAce, RtlCreateAcl, RtlCreateSecurityDescriptor, SeExports, ZwFreeVirtualMemory, ZwAllocateVirtualMemory, ZwQueryInformationToken, RtlEqualUnicodeString, ZwSetInformationObject, ZwQueryObject, ObCreateObject, KeUnstackDetachProcess, KeStackAttachProcess, ZwDuplicateObject, ObFindHandleForObject, RtlClearBits, RtlSetBits, ZwSetSecurityObject, RtlInitializeSid, RtlSubAuthoritySid, RtlLengthRequiredSid, RtlMapGenericMask, ObReleaseObjectSecurity, ObAssignSecurity, ObGetObjectSecurity, ObCheckCreateObjectAccess, MmUnmapViewOfSection, ObOpenObjectByName, PsGetThreadTeb, KeDetachProcess, KeAttachProcess, RtlAppendUnicodeStringToString, RtlAppendUnicodeToString, KePulseEvent, ObQueryNameString, ZwOpenEvent, ZwSetInformationThread, RtlPinAtomInAtomTable, RtlAddAtomToAtomTable, RtlCreateAtomTable, ExReleaseRundownProtection, LpcRequestWaitReplyPort, SeDeassignSecurity, ObSetSecurityDescriptorInfo, SeAssignSecurity, ObInsertObject, ZwOpenDirectoryObject, ExAcquireRundownProtection, ZwOpenProcessTokenEx, ZwOpenThreadTokenEx, PsReferenceImpersonationToken, SeQueryInformationToken, SeTokenIsRestricted, PsCreateSystemThread, ObSetHandleAttributes, PsGetProcessDebugPort, ZwYieldExecution, RtlIntegerToChar, RtlUnicodeStringToAnsiString, PsSetProcessPriorityByClass, PsSetProcessPriorityClass, PsGetProcessPriorityClass, KeSetPriorityThread, RtlUnicodeToMultiByteN, SeImpersonateClientEx, MmAdjustWorkingSetSize, KeSetTimer, RtlFreeUnicodeString, RtlFormatCurrentUserKeyPath, ZwQueryKey, ZwEnumerateValueKey, ZwSetValueKey, RtlMultiByteToUnicodeN, RtlFindMessage, wcsrchr, RtlEqualString, strrchr, ExGetSharedWaiterCount, ExGetExclusiveWaiterCount, IoQueryDeviceDescription, ExRundownCompleted, ExWaitForRundownProtectionRelease, ZwSetEvent, PoSetSystemState, PoRequestShutdownEvent, KeInitializeTimer, NlsOemCodePage, RtlLookupAtomInAtomTable, RtlDeleteAtomFromAtomTable, RtlQueryAtomInAtomTable, ZwUnmapViewOfSection, ZwMapViewOfSection, ZwCreateSection, PsGetThreadFreezeCount, InterlockedIncrement, RtlUnicodeToMultiByteSize, RtlMultiByteToUnicodeSize, KeUserModeCallback, MmSystemRangeStart, IoFileObjectType, ZwOpenFile, IofCallDriver, IoBuildSynchronousFsdRequest, IoBuildDeviceIoControlRequest, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, IoGetStackLimits, MmCommitSessionMappedView, RtlCreateHeap, IoUnregisterPlugPlayNotification, IoWMIQuerySingleInstance, IoWMIHandleToInstanceName, IoWMIOpenBlock, ZwCreateFile, ZwCancelIoFile, wcsncmp, IoGetDeviceObjectPointer, IoRegisterPlugPlayNotification, ZwReadFile, ObReferenceObjectByName, IoDriverObjectType, IoCreateDriver, IoPnPDeliverServicePowerNotification, IoInvalidateDeviceRelations, LpcRequestPort, KeIsAttachedProcess, RtlEmptyAtomTable, RtlZeroHeap, _alldiv, _allshr, vsprintf, MmSecureVirtualMemory, KeRestoreFloatingPointState, KeSaveFloatingPointState, ZwQuerySystemInformation, ExSystemTimeToLocalTime, InterlockedCompareExchange, MmUnsecureVirtualMemory, RtlInsertElementGenericTableAvl, RtlDeleteElementGenericTableAvl, RtlLookupElementGenericTableAvl, KeInitializeDpc, ExIsProcessorFeaturePresent, RtlFillMemoryUlong, RtlTimeToTimeFields, MmGrowKernelStack, PsGetCurrentThreadStackBase, ExSystemExceptionFilter, KeReadStateEvent, ZwQueryInformationFile, LdrAccessResource, LdrFindResource_U, RtlUnicodeToCustomCPN, RtlCustomCPToUnicodeN, RtlInitCodePageTable, RtlGetDefaultCodePage, ZwDeleteFile, LdrFindResourceDirectory_U, RtlEqualSid, MmHighestUserAddress, PsRevertToSelf, RtlUnicodeToOemN, ZwCreateKey, RtlFreeAnsiString, RtlImageNtHeader, RtlImageDirectoryEntryToData, _strnicmp, PsSetThreadHardErrorsAreDisabled, PsGetThreadHardErrorsAreDisabled, strncmp, toupper, RtlWriteRegistryValue, ZwEnumerateKey, IoOpenDeviceRegistryKey, wcscmp, IoGetDeviceProperty, ZwDeleteKey, IoOpenDeviceInterfaceRegistryKey, IoGetDeviceInterfaces, IoSynchronousInvalidateDeviceRelations, IoCreateFile, MmSectionObjectType, ZwSetInformationFile, ZwQueryVolumeInformationFile, IoSetThreadHardErrorMode, _alldvrm, _aulldiv, PsGetCurrentThreadPreviousMode, RtlCompareMemory, RtlCreateRegistryKey, MmQuerySystemSize, RtlEnumerateGenericTableAvl, RtlInitializeGenericTableAvl, PsTerminateSystemThread, RtlUpcaseUnicodeString, RtlExtendedLargeIntegerDivide, _aulldvrm, IoQueueThreadIrp, IoBuildAsynchronousFsdRequest, qsort, MmAddVerifierThunks, PsGetThreadWin32Thread watchdog.sys: WdDdiWatchdogDpcCallback, WdResumeDeferredWatch, WdSuspendDeferredWatch, WdAllocateDeferredWatchdog, WdStartDeferredWatch, WdStopDeferredWatch, WdFreeDeferredWatchdog, WdExitMonitoredSection, WdEnterMonitoredSection [[ 225 export(s) ]] BRUSHOBJ_hGetColorTransform, BRUSHOBJ_pvAllocRbrush, BRUSHOBJ_pvGetRbrush, BRUSHOBJ_ulGetBrushColor, CLIPOBJ_bEnum, CLIPOBJ_cEnumStart, CLIPOBJ_ppoGetPath, EngAcquireSemaphore, EngAllocMem, EngAllocPrivateUserMem, EngAllocSectionMem, EngAllocUserMem, EngAlphaBlend, EngAssociateSurface, EngBitBlt, EngBugCheckEx, EngCheckAbort, EngClearEvent, EngComputeGlyphSet, EngControlSprites, EngCopyBits, EngCreateBitmap, EngCreateClip, EngCreateDeviceBitmap, EngCreateDeviceSurface, EngCreateDriverObj, EngCreateEvent, EngCreatePalette, EngCreatePath, EngCreateSemaphore, EngCreateWnd, EngDebugBreak, EngDebugPrint, EngDeleteClip, EngDeleteDriverObj, EngDeleteEvent, EngDeleteFile, EngDeletePalette, EngDeletePath, EngDeleteSafeSemaphore, EngDeleteSemaphore, EngDeleteSurface, EngDeleteWnd, EngDeviceIoControl, EngDitherColor, EngDxIoctl, EngEnumForms, EngEraseSurface, EngFileIoControl, EngFileWrite, EngFillPath, EngFindImageProcAddress, EngFindResource, EngFntCacheAlloc, EngFntCacheFault, EngFntCacheLookUp, EngFreeMem, EngFreeModule, EngFreePrivateUserMem, EngFreeSectionMem, EngFreeUserMem, EngGetCurrentCodePage, EngGetCurrentProcessId, EngGetCurrentThreadId, EngGetDriverName, EngGetFileChangeTime, EngGetFilePath, EngGetForm, EngGetLastError, EngGetPrinter, EngGetPrinterData, EngGetPrinterDataFileName, EngGetPrinterDriver, EngGetProcessHandle, EngGetTickCount, EngGetType1FontList, EngGradientFill, EngHangNotification, EngInitializeSafeSemaphore, EngIsSemaphoreOwned, EngIsSemaphoreOwnedByCurrentThread, EngLineTo, EngLoadImage, EngLoadModule, EngLoadModuleForWrite, EngLockDirectDrawSurface, EngLockDriverObj, EngLockSurface, EngLpkInstalled, EngMapEvent, EngMapFile, EngMapFontFile, EngMapFontFileFD, EngMapModule, EngMapSection, EngMarkBandingSurface, EngModifySurface, EngMovePointer, EngMulDiv, EngMultiByteToUnicodeN, EngMultiByteToWideChar, EngNineGrid, EngPaint, EngPlgBlt, EngProbeForRead, EngProbeForReadAndWrite, EngQueryDeviceAttribute, EngQueryLocalTime, EngQueryPalette, EngQueryPerformanceCounter, EngQueryPerformanceFrequency, EngQuerySystemAttribute, EngReadStateEvent, EngReleaseSemaphore, EngRestoreFloatingPointState, EngSaveFloatingPointState, EngSecureMem, EngSetEvent, EngSetLastError, EngSetPointerShape, EngSetPointerTag, EngSetPrinterData, EngSort, EngStretchBlt, EngStretchBltROP, EngStrokeAndFillPath, EngStrokePath, EngTextOut, EngTransparentBlt, EngUnicodeToMultiByteN, EngUnloadImage, EngUnlockDirectDrawSurface, EngUnlockDriverObj, EngUnlockSurface, EngUnmapEvent, EngUnmapFile, EngUnmapFontFile, EngUnmapFontFileFD, EngUnsecureMem, EngWaitForSingleObject, EngWideCharToMultiByte, EngWritePrinter, FLOATOBJ_Add, FLOATOBJ_AddFloat, FLOATOBJ_AddFloatObj, FLOATOBJ_AddLong, FLOATOBJ_Div, FLOATOBJ_DivFloat, FLOATOBJ_DivFloatObj, FLOATOBJ_DivLong, FLOATOBJ_Equal, FLOATOBJ_EqualLong, FLOATOBJ_GetFloat, FLOATOBJ_GetLong, FLOATOBJ_GreaterThan, FLOATOBJ_GreaterThanLong, FLOATOBJ_LessThan, FLOATOBJ_LessThanLong, FLOATOBJ_Mul, FLOATOBJ_MulFloat, FLOATOBJ_MulFloatObj, FLOATOBJ_MulLong, FLOATOBJ_Neg, FLOATOBJ_SetFloat, FLOATOBJ_SetLong, FLOATOBJ_Sub, FLOATOBJ_SubFloat, FLOATOBJ_SubFloatObj, FLOATOBJ_SubLong, FONTOBJ_cGetAllGlyphHandles, FONTOBJ_cGetGlyphs, FONTOBJ_pQueryGlyphAttrs, FONTOBJ_pfdg, FONTOBJ_pifi, FONTOBJ_pjOpenTypeTablePointer, FONTOBJ_pvTrueTypeFontFile, FONTOBJ_pwszFontFilePaths, FONTOBJ_pxoGetXform, FONTOBJ_vGetInfo, HT_ComputeRGBGammaTable, HT_Get8BPPFormatPalette, HT_Get8BPPMaskPalette, HeapVidMemAllocAligned, PALOBJ_cGetColors, PATHOBJ_bCloseFigure, PATHOBJ_bEnum, PATHOBJ_bEnumClipLines, PATHOBJ_bMoveTo, PATHOBJ_bPolyBezierTo, PATHOBJ_bPolyLineTo, PATHOBJ_vEnumStart, PATHOBJ_vEnumStartClipLines, PATHOBJ_vGetBounds, RtlAnsiCharToUnicodeChar, RtlMultiByteToUnicodeN, RtlRaiseException, RtlUnicodeToMultiByteN, RtlUnicodeToMultiByteSize, RtlUnwind, RtlUpcaseUnicodeChar, RtlUpcaseUnicodeToMultiByteN, STROBJ_bEnum, STROBJ_bEnumPositionsOnly, STROBJ_bGetAdvanceWidths, STROBJ_dwGetCodePage, STROBJ_fxBreakExtra, STROBJ_fxCharacterExtra, STROBJ_vEnumStart, VidMemFree, WNDOBJ_bEnum, WNDOBJ_cEnumStart, WNDOBJ_vSetConsumer, XFORMOBJ_bApplyXform, XFORMOBJ_iGetFloatObjXform, XFORMOBJ_iGetXform, XLATEOBJ_cGetPalette, XLATEOBJ_hGetColorTransform, XLATEOBJ_iXlate, XLATEOBJ_piVector, _abnormal_termination, _except_handler2, _global_unwind2, _itoa, _itow, _local_unwind2 ExifTool: file metadata CharacterSet: Unicode CodeSize: 1658624 CompanyName: Microsoft Corporation EntryPoint: 0x1b2f7f FileDescription: Multi-User Win32 Driver FileFlagsMask: 0x003f FileOS: Windows NT 32-bit FileSize: 1815 kB FileSubtype: 7 FileType: Win32 EXE FileVersion: 5.1.2600.6149 (xpsp_sp3_gdr.110906-1620) FileVersionNumber: 5.1.2600.6149 ImageVersion: 5.1 InitializedDataSize: 199424 InternalName: win32k.sys LanguageCode: English (U.S.) LegalCopyright: Microsoft Corporation. All rights reserved. LinkerVersion: 7.1 MIMEType: application/octet-stream MachineType: Intel 386 or later, and compatibles OSVersion: 5.1 ObjectFileType: Driver OriginalFilename: win32k.sys PEType: PE32 ProductName: Microsoft Windows Operating System ProductVersion: 5.1.2600.6149 ProductVersionNumber: 5.1.2600.6149 Subsystem: Native SubsystemVersion: 5.1 TimeStamp: 2011:09:06 15:20:41+02:00 UninitializedDataSize: 0 VT Community 0 This file has never been reviewed by any VT Community member. Be the first one to comment on it! VirusTotal Team

I did the other one too just in case: Filename: win32k.sys Status: Scan finished. 0 out of 20 scanners reported malware. Scan taken on: Fri 28 Oct 2011 23:18:14 (CET) Permalink

That file looks fine, I am sure it was but better to be safe than sorry.

See if you can run this free online virus scanner, you would have to boot to safemode with networking


ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
• Check [external image: Posted Image]
• Click the [external image: Posted Image] button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Make sure that the option "Remove found threats" is Unchecked
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
• Push the [external image: Posted Image] button.
• Push [external image: Posted Image]

Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.

It said that it found no threats… this scan took over 2 hours…

That ESET scan can run in less than an hour on some systems and I have seen it run all afternoon on others. How are things running now, any better, if not explain to me in detail exactly what your experiencing

Well, I can only run the computer in Safe Mode with Networking… When i allow the computer to boot up normally, everything seems to startup fine and my wallpaper shows up but no icons, and then it just stays that way forever. I can move the mouse cursor around, but the rest of windows just never shows up. So really, the computer just wont load up…

Well, from the scans we have run I am leaning towards this being a plain old windows problem, do you have your windows CD or the Recovery disk that came with your computer?

Post here in our Windows forum, you can tell them you posted here and we found no malware, once they get you up and running post back here and let me know how it went

http://forums.whatthetech.com/index.php?showforum=119