trojan generic13.atph

Ok I see,


Download the GMER rootkit scan from here: GMER

1. Unzip it and start GMER.
   
2. Click the >>> tab and then click the Scan button.
   
3. Once done, click the Copy button.
   
4. This will copy the results to your clipboard.
   
5. Paste the results in your next reply.
   

Note:
If you're having problems with running GMER.exe, try it in safe mode. This tools works in safe mode.
You can also try renaming it since some malware blocks GMER.

GMER worked and found rootkit. The results follow. I have two quick questions. If I connect my external hard drive to my compter and copy all of my important documents to it can the external hard drive become infected and two if I reinstall xp will that remove the virus(I assume so but I have never been infected to this degree) thanks.

need to break into two pieces

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-23 22:19:54
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

Code 87BC7C30 ZwEnumerateKey
Code 87C2BC58 ZwFlushInstructionCache
Code 87BC8CAE IofCallDriver
Code 87C17E1E IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!IofCallDriver 804E13A7 5 Bytes JMP 87BC8CB3
.text ntoskrnl.exe!IofCompleteRequest 804E17BD 5 Bytes JMP 87C17E23
PAGE ntoskrnl.exe!ZwEnumerateKey 80578E14 5 Bytes JMP 87BC7C34
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80587BFB 5 Bytes JMP 87C2BC5C

---- User code sections - GMER 1.0.15 ----

.text C:\Documents and Settings\Administrator\Desktop\b6nhi.exe[636] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 009E000A
.text C:\Documents and Settings\Administrator\Desktop\b6nhi.exe[636] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 009F000A
.text C:\WINDOWS\Explorer.EXE[800] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00C0000A
.text C:\WINDOWS\Explorer.EXE[800] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00C1000A
.text C:\WINDOWS\system32\winlogon.exe[904] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0068000A
.text C:\WINDOWS\system32\winlogon.exe[904] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0069000A
.text C:\WINDOWS\system32\services.exe[952] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\services.exe[952] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\lsass.exe[964] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0071000A
.text C:\WINDOWS\system32\lsass.exe[964] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0075000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A0000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00A1000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 408BF341 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 40A5178F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 40A51710 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 40A51754 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 40A5169C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 40A516D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 40A517CA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 408E16B6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WININET.dll!HttpAddRequestHeadersA 7805FB4D 5 Bytes JMP 00DE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WININET.dll!HttpAddRequestHeadersW 780CD14D 5 Bytes JMP 00EC000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00EDF9F0 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00EE0A60 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00EE08A0 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00EE0780 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00EDFDA0 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1128] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00EDFFD0 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\WINDOWS\system32\ctfmon.exe[1580] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0098000A
.text C:\WINDOWS\system32\ctfmon.exe[1580] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0099000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[1804] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00AB000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[1804] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00AC000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[1804] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00E9F9F0 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[1804] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00EA0A60 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[1804] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00EA08A0 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[1804] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00EA0780 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[1804] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00E9FDA0 \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \FileSystem\Fastfat \Fat B8FA0D20
---- Processes - GMER 1.0.15 ----

Library \\?\globalroot\systemroot\system32\UACjobrqoxadmxrqkg.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1116] 0x02D00000
Library \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [1128] 0x00ED0000
Library \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1252] 0x00A00000
Library \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1360] 0x00A00000
Library \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1428] 0x00A00000
Library \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1512] 0x00A00000
Library \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll (*** hidden *** ) @ C:\Program Files\Mozilla Firefox\firefox.exe [1804] 0x00E90000

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\drivers\SKYNETxeaxcwbr.sys (*** hidden *** ) [SYSTEM] SKYNETlluycnln <-- ROOTKIT !!!
Service C:\WINDOWS\system32\drivers\UACkndjklvmyqxrmuj.sys (*** hidden *** ) [SYSTEM] UACd.sys <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln@imagepath \systemroot\system32\drivers\SKYNETxeaxcwbr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main@aid 10002
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main@sid 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main@cmddelay 7200
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main\injector@* SKYNETwsp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\modules@SKYNETrk.sys \systemroot\system32\drivers\SKYNETxeaxcwbr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\modules@SKYNETcmd.dll \systemroot\system32\SKYNETdqdaufod.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\modules@SKYNETlog.dat \systemroot\system32\SKYNETnlgubfdc.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\modules@SKYNETwsp.dll \systemroot\system32\SKYNETfnhdnvdi.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETlluycnln\modules@SKYNET.dat \systemroot\system32\SKYNETbusqjavu.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkndjklvmyqxrmuj.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkndjklvmyqxrmuj.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACdemvkbebpjejboa.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACitqrqjowqpskbto.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uaclog

Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACymnpqltqswylnwo.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACemftilkohsdliyg.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACariyvgcrfmsrgsx.db
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACjobrqoxadmxrqkg.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACqfhxsvvalghvmos.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACtrqujdrebgeayuy.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACstwtuwunvhlfmep.log
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln@imagepath \systemroot\system32\drivers\SKYNETxeaxcwbr.sys
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main@aid 10002
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main@sid 0
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main@cmddelay 7200
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main\delete
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main\injector
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main\injector@* SKYNETwsp.dll
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\main\tasks
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\modules
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\modules@SKYNETrk.sys \systemroot\system32\drivers\SKYNETxeaxcwbr.sys
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\modules@SKYNETcmd.dll \systemroot\system32\SKYNETdqdaufod.dll
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\modules@SKYNETlog.dat \systemroot\system32\SKYNETnlgubfdc.dat
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\modules@SKYNETwsp.dll \systemroot\system32\SKYNETfnhdnvdi.dll
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETlluycnln\modules@SKYNET.dat \systemroot\system32\SKYNETbusqjavu.dat
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkndjklvmyqxrmuj.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkndjklvmyqxrmuj.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACdemvkbebpjejboa.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACitqrqjowqpskbto.dat
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACyrdlugicwpktkmo.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACymnpqltqswylnwo.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACemftilkohsdliyg.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACariyvgcrfmsrgsx.db
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACjobrqoxadmxrqkg.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACqfhxsvvalghvmos.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACtrqujdrebgeayuy.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACstwtuwunvhlfmep.log
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln@imagepath \systemroot\system32\drivers\SKYNETxeaxcwbr.sys
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main@aid

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main@sid 0
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main@cmddelay 7200
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main\delete
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main\injector
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main\injector@* SKYNETwsp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\main\tasks
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\modules
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\modules@SKYNETrk.sys \systemroot\system32\drivers\SKYNETxeaxcwbr.sys
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\modules@SKYNETcmd.dll \systemroot\system32\SKYNETdqdaufod.dll
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\modules@SKYNETlog.dat \systemroot\system32\SKYNETnlgubfdc.dat
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\modules@SKYNETwsp.dll \systemroot\system32\SKYNETfnhdnvdi.dll
Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETlluycnln\modules@SKYNET.dat \systemroot\system32\SKYNETbusqjavu.dat
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkndjklvmyqxrmuj.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkndjklvmyqxrmuj.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACdemvkbebpjejboa.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACitqrqjowqpskbto.dat
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACyrdlugicwpktkmo.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACymnpqltqswylnwo.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACemftilkohsdliyg.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACariyvgcrfmsrgsx.db
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACjobrqoxadmxrqkg.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACaharaniiqttftbg.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACqfhxsvvalghvmos.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACtrqujdrebgeayuy.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACstwtuwunvhlfmep.log
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs 1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\jon & lisa\Local Settings\Temp\UAC2bb5.tmp 343040 bytes executable
File C:\Program Files\Wolfram Research\Mathematica\6.0\Documentation\English\System\ReferencePages\Characters\UAcute.nb 6603 bytes
File C:\Program Files\Lenovo\System Update\UACSdk.exe 91448 bytes executable
File C:\WINDOWS\Temp\UACafd7.tmp 66560 bytes
File C:\WINDOWS\Temp\UACb223.tmp 36864 bytes
File C:\WINDOWS\system32\drivers\UACkndjklvmyqxrmuj.sys 51712 bytes executable <-- ROOTKIT !!!
File C:\WINDOWS\system32\UACaharaniiqttftbg.dll 66560 bytes
File C:\WINDOWS\system32\UACariyvgcrfmsrgsx.db 1110399 bytes
File C:\WINDOWS\system32\UACdemvkbebpjejboa.dll 23552 bytes executable
File C:\WINDOWS\system32\UACemftilkohsdliyg.dll 19456 bytes executable
File C:\WINDOWS\system32\uacinit.dll 5871 bytes
File C:\WINDOWS\system32\UACitqrqjowqpskbto.dat 224 bytes
File C:\WINDOWS\system32\UACjobrqoxadmxrqkg.dll 30208 bytes executable
File C:\WINDOWS\system32\UACkjkkxndqcqhdaky.dat 224 bytes
File C:\WINDOWS\system32\UACqfhxsvvalghvmos.log 140725 bytes
File C:\WINDOWS\system32\uactmp.db 3976714 bytes
File C:\WINDOWS\system32\UACymnpqltqswylnwo.dll 17408 bytes executable
File C:\WINDOWS\system32\UACyrdlugicwpktkmo.dll 19968 bytes executable

---- EOF - GMER 1.0.15 ----

Hello.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to disable:
UACd.sys
SKYNETlluycnln

Drivers to delete:
UACd.sys
SKYNETlluycnln

Files to delete:
C:\WINDOWS\system32\drivers\SKYNETxeaxcwbr.sys
C:\WINDOWS\system32\drivers\UACkndjklvmyqxrmuj.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

avenger ran successfully
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Disablement of driver "UACd.sys" failed!
Status: 0xc0000001 (STATUS_UNSUCCESSFUL)

Driver "SKYNETlluycnln" disabled successfully.
Driver "UACd.sys" deleted successfully.
Driver "SKYNETlluycnln" deleted successfully.
File "C:\WINDOWS\system32\drivers\SKYNETxeaxcwbr.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\UACkndjklvmyqxrmuj.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.38
Database version: 2333
Windows 5.1.2600 Service Pack 3

6/25/2009 7:46:43 AM
mbam-log-2009-06-25 (07-46-43).txt

Scan type: Quick Scan
Objects scanned: 97738
Time elapsed: 2 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 30

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Manson (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
c:\WINDOWS\system32\SKYNETdqdaufod.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\SKYNETfnhdnvdi.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACaharaniiqttftbg.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACemftilkohsdliyg.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACjobrqoxadmxrqkg.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACymnpqltqswylnwo.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACyrdlugicwpktkmo.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETdriwqqhxri.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETitcofmegpy.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETiutfrntpfh.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETjwivfuycbq.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETksmntssprq.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNEToqojeqnfpy.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETorentipmba.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETqouofxxplb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETqprvbrnsok.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETqxdnfyfucr.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETriyqxtcxxt.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETthqocvcdcy.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETufqhpftiob.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETvbxwvfhhiv.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETvnyyyfibap.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETwopcjqpxmd.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\SKYNETxetenxbprp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\program files\Manson\liser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Manson\liser.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\tj.vbs (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACdemvkbebpjejboa.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\UACkndjklvmyqxrmuj.sys (Trojan.Agent) -> Quarantined and deleted successfully.

ran it but it only produced a bunch of nonsense symbols

Try Combofix again, even if it says AVG is active.

ComboFix 09-06-25.01 - jon & lisa 06/25/2009 20:51.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3050.2566 [GMT -4:00]
Running from: c:\documents and settings\jon & lisa\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\SKYNETnlgubfdc.dat
c:\windows\system32\UACitqrqjowqpskbto.dat
c:\windows\system32\UACkjkkxndqcqhdaky.dat
c:\windows\system32\uactmp.db

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 )))))))))))))))))))))))))))))))
.

2009-06-25 11:41 . 2009-06-17 15:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-25 11:41 . 2009-06-25 11:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-25 11:41 . 2009-06-17 15:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-22 02:12 . 2009-06-22 02:12 -------- d-----w- c:\program files\VS Revo Group
2009-06-21 23:19 . 2009-06-21 23:20 -------- d-s---w- C:\Combo-Fix
2009-06-20 15:46 . 2009-06-20 15:46 -------- d-----w- c:\windows\system32\scripting
2009-06-20 15:46 . 2009-06-20 15:46 -------- d-----w- c:\windows\system32\en
2009-06-20 15:46 . 2009-06-20 15:46 -------- d-----w- c:\windows\system32\bits
2009-06-20 15:46 . 2009-06-20 15:46 -------- d-----w- c:\windows\l2schemas
2009-06-20 15:45 . 2009-06-20 15:45 -------- d-----w- c:\windows\ServicePackFiles
2009-06-20 15:40 . 2008-04-14 00:12 33792 ------w- c:\windows\system32\mmcperf.exe
2009-06-20 14:49 . 2009-06-20 14:49 -------- d-----w- c:\program files\Sun
2009-06-20 14:34 . 2009-06-20 14:34 -------- d-----w- c:\windows\system32\LogFiles
2009-06-17 01:08 . 2009-06-17 01:08 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-06-14 22:02 . 2009-06-14 22:02 -------- d-----w- c:\documents and settings\jon & lisa\Local Settings\Application Data\McNeel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-22 02:17 . 2008-12-10 11:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-20 15:48 . 2006-04-30 07:12 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-20 14:49 . 2009-05-01 21:08 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-20 14:49 . 2008-12-05 07:17 -------- d-----w- c:\program files\Java
2009-06-17 03:23 . 2008-12-09 19:20 -------- d-----w- c:\program files\Windows Live Toolbar
2009-06-16 03:24 . 2009-05-01 21:09 -------- d-----w- c:\documents and settings\jon & lisa\Application Data\LimeWire
2009-06-06 19:05 . 2008-12-11 15:46 -------- d-----w- c:\program files\Wolfram Research
2009-06-01 15:49 . 2009-01-19 19:59 -------- d-----w- c:\program files\Flickr Uploadr
2009-05-16 14:52 . 2008-12-11 19:46 -------- d-----w- c:\program files\Common Files\McNeel Shared
2009-05-16 14:51 . 2009-05-16 14:51 -------- d-----w- c:\program files\Common Files\InstallShield Shared
2009-05-16 14:51 . 2009-05-16 14:51 -------- d-----w- c:\program files\ASGvis
2009-05-16 14:51 . 2008-12-05 07:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-09 04:19 . 2009-05-09 04:19 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-09 04:14 . 2009-05-09 04:14 -------- d-----w- c:\program files\Netflix
2009-05-07 15:32 . 2006-04-30 06:55 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-02 19:43 . 2008-12-16 00:05 -------- d-----w- c:\documents and settings\jon & lisa\Application Data\Move Networks
2009-05-02 13:26 . 2009-05-02 13:26 -------- d-----w- c:\documents and settings\jon & lisa\Application Data\Malwarebytes
2009-05-02 13:26 . 2009-05-02 13:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-01 21:07 . 2009-05-01 21:07 152576 ------w- c:\documents and settings\jon & lisa\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
2009-04-29 04:56 . 2006-04-30 06:56 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2006-04-30 06:55 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-21 00:08 . 2008-12-05 07:14 123864 ------w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 12:26 . 2006-04-30 06:55 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2006-04-30 06:55 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2008-07-30 60192]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-03-24 68464]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-05-15 487424]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2008-08-31 165208]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2008-08-31 124248]
"RoxioDragToDisc"="c:\program files\Lenovo\Drag-to-Disc\DrgToDsc.exe" [2007-03-13 1116920]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-09-18 331776]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2008-06-14 3073336]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2008-06-07 181536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 07:37 34344 ----a-w- c:\program files\Lenovo\HOTKEY\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-08-08 10:14 28672 ----a-w- c:\program files\Lenovo\HOTKEY\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2008-09-27 06:17 32768 ----a-w- c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ACGina

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"SamSs"=2 (0x2)
"RSVP"=3 (0x3)
"RoxMediaDB10"=3 (0x3)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"ProtectedStorage"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Netlogon"=3 (0x3)
"MSIServer"=3 (0x3)
"mnmsrvc"=3 (0x3)
"mi-raysat_3dsMax2009_32"=2 (0x2)
"IviRegMgr"=2 (0x2)
"iPod Service"=3 (0x3)
"InstallShield Licensing Service"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"CryptSvc"=3 (0x3)
"btwdins"=2 (0x2)
"Browser"=2 (0x2)
"Bonjour Service"=2 (0x2)
"BITS"=3 (0x3)
"BcmSqlStartupSvc"=2 (0x2)
"avg8wd"=2 (0x2)
"Autodesk Network Licensing Service"=3 (0x3)
"Autodesk Licensing Service"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"ALG"=3 (0x3)
"AcSvc"=2 (0x2)
"AcPrfMgrSvc"=2 (0x2)
"aawservice"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\math.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [5/14/2008 8:21 PM 114728]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [5/14/2008 8:21 PM 19496]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [12/5/2008 3:24 AM 4442]
R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [5/9/2008 9:50 AM 46144]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [12/5/2008 3:24 AM 94208]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [5/14/2008 8:25 PM 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [5/9/2008 9:50 AM 253952]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [12/5/2008 2:45 AM 243856]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2/22/2008 7:54 PM 37312]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [4/30/2006 3:28 AM 26488]
S4 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [1/11/2008 9:50 PM 30312]
S4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [3/10/2008 1:04 AM 65536]
S4 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [4/25/2008 12:15 PM 1120752]
S4 SessionLauncher;SessionLauncher;c:\docume~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2009-06-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1939128119-3152334995-3733480193-1008.job
- c:\documents and settings\jon & lisa\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-10 06:18]

2009-06-26 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2008-12-05 16:46]
.
.

------- Supplementary Scan -------
.
uStart Page = hxxp://lenovo.live.com
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
IE: {{F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - c:\program files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-25 20:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1120)
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Lenovo\HOTKEY\tphklock.dll

- - - - - - - > 'lsass.exe'(1180)
c:\program files\ThinkPad\ConnectUtilities\ACGina.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACON.dll
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgr.dll
c:\program files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll
c:\program files\ThinkPad\ConnectUtilities\ACTurinSupport.dll
c:\program files\ThinkPad\ConnectUtilities\AcSmBiosHelper.dll
c:\program files\ThinkPad\ConnectUtilities\AcAdaptersInfo.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\ZOOM\TpScrex.exe
c:\windows\system32\rundll32.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\ThinkPad\ConnectUtilities\AcFnF5.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\TPHDEXLG.exe
c:\program files\Lenovo\Client Security Solution\tvttcsd.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Lenovo\System Update\SUService.exe
c:\windows\system32\wscntfy.exe
c:\program files\ThinkPad\ConnectUtilities\AcFnF5.exe
.
**************************************************************************
.
Completion time: 2009-06-26 20:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-26 00:58

Pre-Run: 84,515,647,488 bytes free
Post-Run: 84,663,103,488 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

258 --- E O F --- 2009-06-20 22:42

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

Seems like everything is back to normal. Ran Malwarebytes and it found NO problems! Great Job!

It seems like I'm having the same problems as the OP. Is it safe for me to follow all of the steps advised to him, or should I make a new topic with my own logs, etc? Thanks.

Make your own topic please.

Thank you for the reply. I am at work right now, but when I get home I will definitely make my own topic.